This is an automated email from the ASF dual-hosted git repository.

chenBright pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/brpc.git


The following commit(s) were added to refs/heads/master by this push:
     new f04e0e06 bounds-check OnUserControlMessage like sibling control 
handlers (#3329)
f04e0e06 is described below

commit f04e0e06051c21e3b83ca883c8b68a1a60f35784
Author: sahvx655-wq <[email protected]>
AuthorDate: Tue Jun 16 07:47:58 2026 +0530

    bounds-check OnUserControlMessage like sibling control handlers (#3329)
    
    * bounds-check OnUserControlMessage like sibling control handlers
    
    * Use unsigned literals for user control message length bounds
---
 src/brpc/policy/rtmp_protocol.cpp | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/src/brpc/policy/rtmp_protocol.cpp 
b/src/brpc/policy/rtmp_protocol.cpp
index d7064686..62322018 100644
--- a/src/brpc/policy/rtmp_protocol.cpp
+++ b/src/brpc/policy/rtmp_protocol.cpp
@@ -1925,8 +1925,8 @@ bool RtmpChunkStream::OnSetPeerBandwidth(
 
 bool RtmpChunkStream::OnUserControlMessage(
     const RtmpMessageHeader& mh, butil::IOBuf* msg_body, Socket* socket) {
-    if (mh.message_length > 32) {
-        RTMP_ERROR(socket, mh) << "No user control message long as "
+    if (mh.message_length < 2u || mh.message_length > 32u) {
+        RTMP_ERROR(socket, mh) << "Invalid user control message length="
                                << mh.message_length << " bytes";
         return false;
     }


---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]

Reply via email to