ben.carrasco/freeswitch
1
0
Fork 0
mirror of https://github.com/signalwire/freeswitch.git synced 2026-08-19 09:40:21 +00:00
Code Issues Packages Projects Releases Wiki Activity

Merge commit from fork

Browse Source 
Two invoke handlers read an AMF argument's value without first
checking its type, so a wrong-typed argument reads the wrong union
member:

- `rtmp_i_connect()` passed the first invoke argument straight into
  `amf0_object_get()`, which walks the value as a node list. Treat
  the command object as a field source only when it is an AMF object
  or ECMA array, otherwise leave the lookups empty.
- `rtmp_i_receiveaudio()` and `rtmp_i_receivevideo()` read the flag
  argument with `amf0_boolean_get_value()`, which returns the raw
  union byte. Use `amf0_get_boolean()`, which yields `SWITCH_FALSE`
  unless the argument is an AMF boolean.
This commit is contained in:
Dmitry Verenitsin
2026-08-08 21:16:07 +03:00
committed by GitHub
parent b999d2a594
commit 150295ecff
1 changed files with 9 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/mod/endpoints/mod_rtmp/rtmp_sig.c
+9 -2
View File
@@ -45,6 +45,13 @@ RTMP_INVOKE_FUNCTION(rtmp_i_connect)
amf0_data *object1 = amf0_object_new(), *object2 = amf0_object_new(), *params = argv[0], *d;
const char *s;
/* amf0_object_get() walks the node list without checking the AMF type; only
an object or ECMA array stores its contents that way. Drop any other type
so the lookups return nothing instead of misreading the union. */
if (params && params->type != AMF0_TYPE_OBJECT && params->type != AMF0_TYPE_ECMA_ARRAY) {
params = NULL;
}
if ((d = amf0_object_get(params, "app")) && (s = amf0_get_string(d))) {
rsession->app = switch_core_strdup(rsession->pool, s);
}
@@ -158,7 +165,7 @@ RTMP_INVOKE_FUNCTION(rtmp_i_noop)
RTMP_INVOKE_FUNCTION(rtmp_i_receiveaudio)
{
switch_bool_t enabled = argv[1] ? amf0_boolean_get_value(argv[1]) : SWITCH_FALSE;
switch_bool_t enabled = amf0_get_boolean(argv[1]);
if (enabled) {
switch_set_flag(rsession, SFLAG_AUDIO);
@@ -173,7 +180,7 @@ RTMP_INVOKE_FUNCTION(rtmp_i_receiveaudio)
RTMP_INVOKE_FUNCTION(rtmp_i_receivevideo)
{
switch_bool_t enabled = argv[1] ? amf0_boolean_get_value(argv[1]) : SWITCH_FALSE;
switch_bool_t enabled = amf0_get_boolean(argv[1]);
if (enabled) {
switch_set_flag(rsession, SFLAG_VIDEO);