libsrt: baixar versions anteriors

## Security Notice

This release includes important security hardening and multiple vulnerability fixes identified during extensive security audits of the SRT codebase. Several issues could allow memory corruption, protocol state manipulation, resource exhaustion, or misuse of auxiliary tools and CI infrastructure.

Users are strongly encouraged to upgrade to this version to benefit from these security improvements and protocol hardening measures.

## Security Improvements

### Handshake and Encryption Security

• Fully remediated the KMREQ processing vulnerability by validating all incoming KM message lengths before they reach internal conversion and copy routines, protecting both HSv4 and HSv5 negotiation paths.
• Completed the remediation of the encryption downgrade vulnerability by preventing post-establishment KMRSP messages from modifying the security state of already secured sessions. Additional protections were added for both HSv4 and HSv5 negotiation paths.
• Added minimum MSS enforcement during connection negotiation to prevent undersized payload buffers that could otherwise lead to heap corruption and information disclosure during handshake generation.
• Hardened handshake state processing to correctly derive connection state from the live connection status and prevent unintended state rollback caused by late or malformed handshake exchanges.

### Data Plane Protection

• Fixed validation of ACK control messages to prevent send-buffer corruption caused by forged or malformed acknowledgements. Additional bounds checking now ensures that sequence number ranges remain valid before buffer state updates occur.
• Added protection against invalid DROPREQ ranges. Reversed ranges and invalid sequence number distances are now rejected before modifying receiver buffer state.
• Corrected receive-path connection status handling to prevent non-addressed packets from affecting unrelated connection attempts.

### FEC Robustness

• Added payload-size validation in FEC clipping operations to prevent out-of-bounds writes when processing oversized payloads.
• Introduced minimum-size validation for FEC control packets, eliminating integer-underflow conditions that could occur when processing malformed packets.
• Added upper bounds for peer-supplied FEC configuration values and improved error handling to prevent excessive memory allocation during connection establishment.

### Bonding Reliability

• Fixed a use-after-free condition in the bonding BACKUP send path. Internal member context tracking now safely handles members removed while locks are temporarily released, preventing dangling references during failover processing.

### Application Hardening

• Added validation of remotely supplied filenames in the `srt-file-transmit` utility. Path separators, parent directory references, and platform-specific path manipulation patterns are now rejected before files are created.

## Build and CI Security Enhancements

• Replaced the dynamic Codecov script download mechanism with a pinned and integrity-verified version.
• Pinned ABI compatibility checker dependencies to specific versions and removed reliance on mutable default branches.
• Improved GitHub workflow supply-chain protection by pinning third-party actions, container images, and external dependencies to known revisions.

## Stability Improvements

• Fixed local connection teardown handling following rejected late handshakes, ensuring the local endpoint correctly terminates invalid connection states.
• Improved error handling for FEC initialization failures and memory allocation exceptions, providing graceful connection rejection instead of abrupt failures.

## Test Coverage

Additional negative and security-focused test coverage has been added for:

• Malformed KMRSP messages.
• Encryption downgrade scenarios.
• ACK validation.
• DROPREQ malformed and reversed ranges.
• FEC oversized payloads and invalid configurations.
• Connection cleanup and shutdown paths.

## Security Notice

This release includes important security updates that address two significant CVE vulnerabilities affecting previous versions of the library. Users are strongly encouraged to upgrade to this version as soon as possible to benefit from these fixes and reduce exposure to the associated security risks.

The resolved CVEs are listed below:

• [CVE-2026-55869](https://www.cve.org/CVERecord?id=CVE-2026-55869)：Heap-Based Buffer Overflow in KMREQ Handling
• [CVE-2026-55868](https://www.cve.org/CVERecord?id=CVE-2026-55868)：Encryption State Machine Downgrade

## Security Improvements

• **PR #3317**：Implemented security improvements for KMREQ buffer validation. This fix addresses a vulnerability where received message sizes were not verified against the destination buffer size during the copy process. The update enforces word-aligned validation to prevent overflows when copying to internal arrays.
• **PR #3319**：Added strict validation of KMRSP wire length to prevent stack overflows.
• **PR #3324**：Resolved an OOB read in LOSSREPORT range parsing. The logic previously read a "HI" sequence number word following a "LO" marker without verifying if the "HI" word existed in the wire payload.
• **PR #3320**：Fixed an OOB read vulnerability in DROPREQ payload parsing. The handler now verifies that the wire payload meets the minimum 8-byte length requirement (two 32-bit sequence numbers) before attempting to process the request, preventing reads beyond the packet slot.
• **PR #3322**：Introduced a guard in `CRcvBuffer::dropMessage` to reject requested drop ranges that extend beyond the end of the receiver buffer.

## Important Bug Fixes
• **PR #3327**：Streamlined the library cleanup sequence by removing redundant post-cleaning of closed sockets. Architecture logic dictates that the Garbage Collector (GC) thread is the primary owner of socket deletion. Once the GC thread is joined, all sockets are considered deleted; further post-checks are unnecessary and avoid potential undefined behavior in cases where the library state might be corrupted.
• **PR #3310**：Fixed a segmentation fault (SEGV) occurring during global or static initialization when `ENABLE_HEAVY_LOGGING` was active.

## Build System Enhancements

• **PR #3300**：Transitioned the CI/CD pipeline to a robust Linux configuration matrix, serving as the modern replacement for Travis CI. The new system includes various platform and compiler combinations and incorporates specific fixes for MinGW builds and C++11 syntax compatibility.

## Documentation Updates

• **PR #3328**：Corrected a typographical error in the documentation regarding the separator used for `searchParameters`.

## Contributors

The following individuals contributed to the SRT v1.5.6 release:

@SergioTx @mszatmary-netflix @stevomatthews @ethouris @cl-ment

## Changelog

<details><summary>Click to expand/collapse</summary>
<p>

### Core Functionality

1e4c908c Removed unnecessary post-cleaning of closed socket in the cleanup. (#3327)
798f660b Vulnerability fixed：unchecked buffer size for KMREQ (#3317)

### Build Scripts (CMake, etc.)

c39196c9 Added configuration for Linux with various matrix combinations (#3300)

### Other

2dc8c18c [bug] searchParameters separator (#3328)
2e2ab20e [bug] Reject CRcvBuffer::dropMessage range past buffer end (#3322)
033d1d54 [bug] Fixed OOB read in LOSSREPORT range parsing (#3324)
d7957ac5 [bug] Fixed OOB read in DROPREQ payload parsing (#3320)
604a4065 [bug] Validate KMRSP wire length to prevent stack overflow (#3319)
8e68635c [bug] Fixed a heavy-logging instruction that may crash on initialization (#3310)

</p>
</details>