ubeddulla opened a new pull request, #3593: URL: https://github.com/apache/brpc/pull/3593
### What problem does this PR solve? Issue Number: none Problem Summary: ReadAMFUint32 in src/brpc/amf.cpp casts a peer-controlled AMF0 number straight to uint32_t. For NaN or any value outside [0, UINT32_MAX] that conversion is undefined (UBSan float-cast-overflow), and in practice the same wire bytes decode to different ids on x86-64 (truncating cvttsd2si) and aarch64 (saturating fcvtzu). The function reads the TransactionId of every RTMP command message (connect, createStream, play, ...) and the stream id in createStream results, so any RTMP peer controls the double. ### What is changed and the side effects? Changed: ReadAMFUint32 rejects non-finite and out-of-range numbers before the cast, returning false like the existing malformed-stream paths. Added a regression test in test/brpc_rtmp_unittest.cpp that fails on the unpatched tree. Side effects: - Performance effects: none, one range check per uint32 read. - Breaking backward compatibility: none, every number that has a uint32 representation decodes as before. --- ### Check List: - Please make sure your changes are compilable. - When providing us with a new feature, it is best to add related tests. - Please follow [Contributor Covenant Code of Conduct](https://github.com/apache/brpc/blob/master/CODE_OF_CONDUCT.md). -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
