harden/2026.6: CVE-2026-1991 null-guard + upstream robustness backports (ceralive-v0.0.7.2)

[andrescera]

Summary

This branch delivers two targeted hardening commits on top of ceralive-v0.0.7.1 (21bc89ab), tagged as ceralive-v0.0.7.2 (90cc679).

---

Commits

26ec74a — fix(stream): accept smaller max payloads than requested (backport upstream 047920b)

File: src/stream.c

Backport of upstream commit 047920bcdfb1dac42424c90de5cc77dfc9fba04d ("Accept smaller Max payloads than required", upstream PR #273).

The original check required dwMaxPayloadTransferSize to equal the requested value exactly. Some HighSpeed/USB cameras report a smaller-than-requested max payload during UVC probe/commit negotiation — the old check rejected these, causing streaming to fail. The fix relaxes the equality to >=, so cameras that report a smaller (but still usable) payload size negotiate successfully.

Impact: improves real-camera compatibility; low risk (one-line semantic change in the negotiation check).

---

90cc679 — fix(security): guard uvc_scan_streaming NULL-deref (CVE-2026-1991) + backport e001f04

File: src/device.c

CVE-2026-1991 (NVD, public PoC — libuvc Issue #300): uvc_scan_streaming() dereferences config->interface[interface_idx].altsetting[0] without validating interface_idx against bNumInterfaces or checking that num_altsetting > 0. A malformed USB descriptor (attacker-controlled baInterfaceNr byte, 0–255) triggers an out-of-bounds array read or NULL dereference. Upstream libuvc is unpatched (effectively dead since 2024).

Fix: two early-return guards in uvc_scan_streaming():

1. interface_idx >= config->bNumInterfaces → return (bounds check)
2. if_desc->num_altsetting < 1 → return (NULL altsetting guard)

Both reachable deref paths are closed, not just the line cited in the CVE.

Also backports upstream e001f04d53367f9c8d26a162c65c24b07fd46729: wraps get_device_descriptor() in uvc_scan_control() with a == UVC_SUCCESS check for robustness against descriptor read failures.

Verification: ASan reproduction harness (tests/test_cve_2026_1991.c in the consuming repo gstlibuvch264src) confirms crash on unpatched fork → clean exit on patched fork.

---

Scope

• Only device.c and stream.c were modified — no other files touched.
• No refactoring, no API changes, no symbol additions or removals.
• The ~47-symbol ABI surface consumed by gstlibuvch264src is fully preserved.
• H.265 support and UVC 1.5 patches from prior CeraLive commits are untouched.

Tag

ceralive-v0.0.7.2 is tagged at 90cc679 and pushed. The consuming repo (gstlibuvch264src) has already bumped its FORK_SHA pin to this commit in scripts/build-libuvc.sh.

Rollback path

The CVE fix is also mirrored as patches/cve-2026-1991-scan-streaming-nullguard.patch in gstlibuvch264src for the LIBUVC_USE_FORK=OFF upstream fallback path — the rollback path is not a regress-to-vulnerable escape hatch.