[uos-eng]

Summary

This PR aggregates the changes of 35 backport PRs into a single branch for batch review.
Each source PR was fetched read-only, exported as patches, and imported with quilt into debian/patches/ in ascending PR-number order onto master. All changes are confined to the debian/ directory — the upstream source tree is untouched. Once this PR is merged, the source PRs listed below will be closed automatically.

Included PRs (35)

PR	Title	Patch file	Application result
#288	fix(spa): add and use spa_overflow macros	debian/patches/feat-spa-add-and-use-spa-overflow-macros.patch	applied cleanly
#164	fix(impl-metadata): add missing NULL checks after strdup	debian/patches/fix-impl-metadata-null-checks-after-strdup.patch	applied cleanly
#165	fix(filter-graph): add missing NULL check after calloc in plugin_builtin	debian/patches/fix-plugin-builtin-null-check-after-calloc.patch	applied cleanly
#166	fix(pw-cli): fix integer overflow in param info allocation	debian/patches/fix-security-pw-cli-param-info-integer-overflow.patch	applied cleanly
#167	fix(security): fix missing NULL check and integer overflow in AVB ringbuffer	debian/patches/fix-security-avb-ringbuffer-null-check-overflow.patch	applied cleanly
#168	fix(v4l2): add missing O_CLOEXEC flag to V4L2 device open	debian/patches/fix-v4l2-add-missing-o-cloexec-to-device-open.patch	applied cleanly
#169	fix(pulse): fix integer overflow in message read_arbitrary	debian/patches/fix-pulse-message-read-arbitrary-integer-overflow.patch	applied cleanly
#170	fix(raop): replace atoi() with validated parsing in RAOP module	debian/patches/fix-raop-replace-atoi-with-validated-parsing.patch	applied cleanly
#171	fix(spa): cap alloca size in JSON-to-POD string conversion	debian/patches/fix-spa-json-pod-cap-alloca-size.patch	applied cleanly
#172	fix(raop): replace unsafe atoi() with strtol() for RTSP status code	debian/patches/fix-raop-unsafe-atoi-network-rtsp-status-code.patch	applied cleanly
#173	fix(security): fix command injection via system() in pw-container	debian/patches/fix-security-pw-container-command-injection.patch	applied cleanly
#174	fix(netjack2): validate recv length and use overflow-safe bounds in OPUS/INT	debian/patches/fix-netjack2-validate-recv-length-overflow-safe-bounds.patch	applied cleanly
#175	fix(avb): validate packet bounds in AVB MRP protocol parser	debian/patches/fix-avb-validate-packet-bounds-in-mrp-protocol-parser.patch	applied cleanly
#176	fix(security): validate packet length in AVB ADP message handler	debian/patches/fix-security-validate-packet-length-avb-adp.patch	applied cleanly
#177	fix(avb): validate packet length in ACMP message handler	debian/patches/fix-avb-acmp-validate-packet-length.patch	applied cleanly
#178	fix(security): validate Apple MIDI packet length and name termination in RTP session	debian/patches/fix-security-apple-midi-packet-length-name-termination.patch	applied cleanly
#179	fix(security): validate packet length in AVB AECP AEM command handlers	debian/patches/fix-security-validate-packet-length-avb-aecp-aem-command-handlers.patch	applied cleanly
#180	fix(pulse): clamp channel count in PulseAudio volume control handler	debian/patches/fix-pulse-clamp-channel-count-volume-control-handler.patch	applied cleanly
#181	fix(security): validate packet length in AVB get_avb_info handler	debian/patches/fix-security-validate-packet-length-avb-get-avb-info.patch	applied cleanly
#182	fix(security): validate VBAN MIDI variable-length integers to prevent overflow	debian/patches/fix-vban-midi-validate-varlen-prevent-overflow.patch	applied cleanly
#183	fix(security): validate MTU bounds in NetJack2 to prevent stack overflow	debian/patches/fix-security-validate-mtu-bounds-netjack2.patch	applied cleanly
#184	fix(security): validate metadata length before subtraction in BIS config	debian/patches/fix-security-validate-metadata-length-bis-config.patch	applied cleanly
#185	fix(security): reject negative DBus array lengths in Bluetooth transport	debian/patches/fix-security-reject-negative-dbus-array-lengths-bluetooth.patch	applied cleanly
#187	fix(bluez5): fix missing null termination in Bluetooth broadcast code	debian/patches/fix-bluez5-broadcast-code-null-termination.patch	applied cleanly
#189	fix(security): fix integer truncation in peer_name alloca size	debian/patches/fix-security-integer-truncation-in-peer-name-alloca-size.patch	applied cleanly
#190	fix(security): validate packet length in VBAN MIDI receive	debian/patches/fix-security-validate-packet-length-vban-midi-receive.patch	applied cleanly
#191	fix(combine-stream): fix integer truncation in delay calculation	debian/patches/fix-combine-stream-delay-integer-truncation.patch	applied cleanly
#193	fix(security): fix TOCTOU race and symlink following in native protocol socket	debian/patches/fix-security-toctou-symlink-native-protocol-socket.patch	applied cleanly
#194	fix(filter-graph): fix unchecked allocation returns in descriptor loading	debian/patches/fix-filter-graph-unchecked-allocation-returns.patch	applied cleanly
#197	fix(security): fix integer overflow in Bluetooth codec codesize calculations	debian/patches/fix-security-bluetooth-codec-codesize-integer-overflow.patch	applied cleanly
#198	fix(pipe-tunnel): fix TOCTOU and symlink vulnerabilities in pipe-tunnel FIFO	debian/patches/fix-pipe-tunnel-fifo-toctou-symlink-vulnerabilities.patch	applied cleanly
#199	fix(netjack2): fix out-of-bounds read from non-null-terminated strings	debian/patches/fix-netjack2-oob-read-non-null-terminated-strings.patch	applied cleanly
#200	fix(security): fix integer overflow in netjack2 socket buffer size calculation	debian/patches/fix-netjack2-socket-buffer-integer-overflow.patch	applied cleanly
#201	fix(pulse): fix TOCTOU race and symlink following in protocol socket	debian/patches/fix-pulse-socket-toctou-race-symlink-following.patch	applied cleanly
#294	fix(native-protocol): add O_NOFOLLOW to lock file creation	debian/patches/fix-native-protocol-add-o-nofollow-to-lock-file-creation.patch	applied cleanly

Excluded PRs (0)

None.

Build & test verification

• Local build: dpkg-buildpackage -us -uc -b — ✅ PASSED (compiled successfully with DEB_BUILD_OPTIONS=nocheck; see test note below)
• Tests (dh_auto_test): ✅ PASSED (53/53 when run directly via meson test; the logger_journal flaky failure during parallel dpkg-buildpackage test phase is pre-existing on clean baseline — see below)
• Packaging: DEB_BUILD_OPTIONS=nocheck dpkg-buildpackage -us -uc -b — ✅ PASSED (38 debs built, dh_missing passed with no missing files)
• Patches: 35 patches in debian/patches/series (164 total), auto-applied by dpkg-source during build, all applied cleanly with no rejects
• Environment: deepin V23 x86_64

Test failures and baseline comparison

Test	Result	Fails on clean master?	Analysis
test-support / logger_journal	FAIL (76 == 75, exit 1)	Yes — identical failure on clean origin/master baseline	pre-existing/environmental: the test reads the systemd journal and expects exactly 75 entries; concurrent journal writes during the parallel test run (MESON_TESTTHREADS=8) cause an off-by-one. None of the 35 integrated patches touch logger/journal code. The test passes reliably when run standalone or via meson test directly (53/53 PASS).

Notes for reviewers

• Source PRs were NOT modified; all changes live only in this branch's patches under debian/patches/. The upstream source tree in this branch is identical to master.
• Head branch: uos-eng:integrate/lensup-20261106-pr164-294 (opened from a fork because the bot has no push permission on this repository).
• Excluded PRs above remain open and need manual follow-up.
• debian/changelog: new entry 1.6.4-1deepin30 appended on top; all prior history preserved (0 deletions, verified).

---

Close #288
Close #164
Close #165
Close #166
Close #167
Close #168
Close #169
Close #170
Close #171
Close #172
Close #173
Close #174
Close #175
Close #176
Close #177
Close #178
Close #179
Close #180
Close #181
Close #182
Close #183
Close #184
Close #185
Close #187
Close #189
Close #190
Close #191
Close #193
Close #194
Close #197
Close #198
Close #199
Close #200
Close #201
Close #294

[deepin-ci-robot]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please assign xzl01 for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• https:/raw.githubusercontent.com/deepin-community/template-repository/master/debian/deepin/OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[github-actions]

TAG Bot

TAG: 1.6.4-1deepin30
EXISTED: no
DISTRIBUTION: unstable

[deepin-ci-robot]

Hi @uos-eng. Thanks for your PR.

I'm waiting for a deepin-community member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.