Source: libtgowt
Version: 0~git20251117.d067233+dfsg-3
Severity: wishlist
Dear Maintainer,
the packaged snapshot of libtgowt (upstream commit d067233, 2025-11-17)
is 11 commits behind the commit current Telegram Desktop pins
(d1cf250ea73de26c4c1f0a3c8173eb2648efbb04, 2026-10-07, see
Telegram/build/docker/centos_env/Dockerfile in tdesktop).
Several of the newer commits fix crashes and memory safety issues in
the WebRTC stack reachable from remote peers during calls:
d1cf250 Clear channels before removing stopped transceivers.
b857c26 Fix VP8 temporal layer bounds checking.
e2d0e88 Fix possible use-after-free on GOOG_DELTA_ACK.
09d55d6 Fix possible crash on DTLS/SCTP in unsupported media.
328e647 Fix possible crash on zero-length GOOG_MISC_INFO.
The rest are build fixes, some of which Debian already carries as
patches:
9826d0e Fix building with GCC 16
19d51d3 Build with OpenSSL 4 (ASN1_STRING became opaque)
3923b67 Check for GL/gl.h and EGL/egl.h instead of gl.pc and egl.pc
89df288 Remove ABSL_ATTRIBUTE_LIFETIME_BOUND from void functions
26068e2 Fixed missing include cstring.
d888bc3 Fix building with Pipewire 1.5.81 and later. Resolves #167
Please consider updating to d1cf250. Given the use-after-free fix, it
may be worth checking with the security team whether the severity
should be raised.
Side note, in case it helps when telegram-desktop is updated as well:
because of Unbundle-libyuv.patch, current tdesktop master fails to
build against libtgowt-dev, since tgcalls includes
"third_party/libyuv/include/libyuv.h" (desktop_capturer/
DesktopCaptureSourceHelper.cpp and DesktopCaptureSourceManager.cpp).
Building tg_owt at d1cf250 from source works fine on arm64, and the
resulting Telegram Desktop runs on a 16K page size kernel (Asahi).
-- System Information:
Debian Release: forky/sid
Architecture: arm64 (aarch64)
Kernel: Linux 7.1.12-trace-g6e493064d864 (SMP w/8 CPU threads; PREEMPT)
Locale: LANG=C
Versions of packages libtgowt-dev depends on:
libyuv-dev 0.0.1974.20261008-1
Thanks,
Thomas
