Skip to content

Fix receive amf checking #1782

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Open
wants to merge 3 commits into
base: master
Choose a base branch
from
Open

Fix receive amf checking #1782

wants to merge 3 commits into from

Conversation

Fahnenfluchtige
Copy link

The Svace static analysis tool identified a potential issue in the function ngx_rtmp_relay_on_status(), where the return value of ngx_rtmp_receive_amf() is not checked (line 1292):

ngx_rtmp_receive_amf(s, in, in_elts_meta,
        sizeof(in_elts_meta) / sizeof(in_elts_meta[0]));

The function ngx_rtmp_receive_amf() calls ngx_rtmp_amf_read(), which can return NGX_ERROR in case of a parsing failure. However, no error handling is performed, and the function ngx_rtmp_relay_on_status() always returns NGX_OK, even if parsing fails.

So, the solution is to add error checking:

@@ -1289,11 +1289,23 @@ ngx_rtmp_relay_on_status(ngx_rtmp_session_t *s, ngx_rtmp_header_t *h,

    ngx_memzero(&v, sizeof(v));
    if (h->type == NGX_RTMP_MSG_AMF_META) {
-        ngx_rtmp_receive_amf(s, in, in_elts_meta,
-                sizeof(in_elts_meta) / sizeof(in_elts_meta[0]));
+        if (ngx_rtmp_receive_amf(s, in, in_elts_meta,
+                             sizeof(in_elts_meta) / sizeof(in_elts_meta[0])) != NGX_OK)
+        {
+            ngx_log_error(NGX_LOG_ERR, s->connection->log, 0,
+                      "relay: failed to parse AMF metadata");
+
+            return NGX_ERROR;
+        }
    } else {
-        ngx_rtmp_receive_amf(s, in, in_elts,
-                sizeof(in_elts) / sizeof(in_elts[0]));
+        if (ngx_rtmp_receive_amf(s, in, in_elts,
+                                 sizeof(in_elts) / sizeof(in_elts[0])) != NGX_OK)
+        {
+            ngx_log_error(NGX_LOG_ERR, s->connection->log, 0,
+                      "relay: failed to parse AMF message");
+
+            return NGX_ERROR;
+        }
    }

    ngx_log_debug3(NGX_LOG_DEBUG_RTMP, s->connection->log, 0,

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers
No reviews
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
1 participant
@Fahnenfluchtige