PJSIP Files

Release Focus

• Asynchronous SIP client authentication (#4816)
• AI real-time speech connectivity (#4866, [#4870])
• CMake improvements (#4900, [#4896], [#4704])

Backward incompatibility

• [#4888]: Default Opus library name on MSVC changed from libopus.a to opus.lib. To keep the old name, define PJMEDIA_CODEC_OPUS_LIB_NAME "libopus.a" in config_site.h.
• [#4830]: PJSUA2 Call::acc type changed from Account& to Account*; C++ callers must use -> instead of ..
• New pjsua_acc_del2() / Account::shutdown2() provide safer deletion that rejects while calls are active.
• [#4765]: INVITE transaction termination is delayed to absorb retransmissions, and 200 OK retransmissions are disabled (partial RFC 6026 adoption).

Security issue

• Buffer overflow in ICE with long username
• Use-after-free in H264 packetizer when packetizing fragmented NAL
• Heap buffer overflow in H.264 unpacketizer
• Stack buffer overflow in parsing RTP payload in pjmedia-codec framework
• Heap use-after-free in PJSIP presence subscription termination handler
• ICE session use-after-free race conditions
• Heap buffer overflow in DNS parser
• Out-of-bounds read in SIP multipart parsing
• Heap OOB read in VPX unpacketizer
• Heap buffer overflow in Opus codec decoding
• Stack buffer overflow in pjsip_auth_create_digest2()
• Asymmetric ptime integer overflow in Media Stream
• SIP Multipart CID URI Length Underflow
• GnuTLS backend silently skips certificate chain verification when verify_peer is false

For ticket list, please see Milestone 2.17