This is an automated email from the ASF dual-hosted git repository.
wasphin pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/brpc.git
The following commit(s) were added to refs/heads/master by this push:
new f5307aad reject stray amf0 object-end marker instead of CHECK-fatal in
readers (#3597)
f5307aad is described below
commit f5307aad6d416669575b1beef8ceb2e6e9df3d37
Author: sahvx655-wq <[email protected]>
AuthorDate: Mon Oct 12 10:09:30 2026 +0530
reject stray amf0 object-end marker instead of CHECK-fatal in readers
(#3597)
---
src/brpc/amf.cpp | 10 +++++-----
test/brpc_rtmp_unittest.cpp | 43 +++++++++++++++++++++++++++++++++++++++++++
2 files changed, 48 insertions(+), 5 deletions(-)
diff --git a/src/brpc/amf.cpp b/src/brpc/amf.cpp
index 290ce642..d4c4829f 100644
--- a/src/brpc/amf.cpp
+++ b/src/brpc/amf.cpp
@@ -540,7 +540,7 @@ static bool ReadAMFObjectField(AMFInputStream* stream,
LOG(ERROR) << marker2str(marker) << " is not supported yet";
return false;
case AMF_MARKER_OBJECT_END:
- CHECK(false) << "object-end shouldn't be present here";
+ LOG(ERROR) << "Unexpected object-end marker in a value position";
return false;
case AMF_MARKER_LONG_STRING: {
std::string val;
@@ -760,8 +760,8 @@ static bool ReadAMFObjectField(AMFInputStream* stream,
LOG(ERROR) << marker2str(marker) << " is not supported yet";
return false;
case AMF_MARKER_OBJECT_END:
- CHECK(false) << "object-end shouldn't be present here";
- break;
+ LOG(ERROR) << "Unexpected object-end marker in a value position";
+ return false;
case AMF_MARKER_LONG_STRING: {
std::string val;
if (!ReadAMFLongStringBody(&val, stream)) {
@@ -921,8 +921,8 @@ static bool ReadAMFArrayItem(AMFInputStream* stream,
AMFArray* arr, int depth) {
LOG(ERROR) << marker2str(marker) << " is not supported yet";
return false;
case AMF_MARKER_OBJECT_END:
- CHECK(false) << "object-end shouldn't be present here";
- break;
+ LOG(ERROR) << "Unexpected object-end marker in a value position";
+ return false;
case AMF_MARKER_LONG_STRING: {
std::string val;
if (!ReadAMFLongStringBody(&val, stream)) {
diff --git a/test/brpc_rtmp_unittest.cpp b/test/brpc_rtmp_unittest.cpp
index da2e77af..3694df3a 100644
--- a/test/brpc_rtmp_unittest.cpp
+++ b/test/brpc_rtmp_unittest.cpp
@@ -860,6 +860,49 @@ TEST(RtmpTest, amf_rejects_oversized_strict_array_count) {
EXPECT_EQ(0u, arr.size());
}
+TEST(RtmpTest, amf_rejects_stray_object_end_marker) {
+ // A stray object-end marker (0x09) in a value position used to hit
+ // CHECK(false): the process aborted with -crash_on_fatal_log, and the
+ // object/array readers then continued as if the input were valid.
+ {
+ // As the value of a field in a generic object.
+ std::string req_buf;
+ AppendAMFObjectHeader(&req_buf);
+ AppendAMFShortStringBody(&req_buf, "a");
+ req_buf.push_back((char)brpc::AMF_MARKER_OBJECT_END);
+ AppendAMFObjectEnd(&req_buf);
+
+ google::protobuf::io::ArrayInputStream zc_stream(req_buf.data(),
req_buf.size());
+ brpc::AMFInputStream istream(&zc_stream);
+ brpc::AMFObject obj;
+ EXPECT_FALSE(brpc::ReadAMFObject(&obj, &istream));
+ }
+ {
+ // As an item of a strict array.
+ std::string req_buf;
+ AppendAMFStrictArrayHeader(&req_buf, 1);
+ req_buf.push_back((char)brpc::AMF_MARKER_OBJECT_END);
+
+ google::protobuf::io::ArrayInputStream zc_stream(req_buf.data(),
req_buf.size());
+ brpc::AMFInputStream istream(&zc_stream);
+ brpc::AMFArray arr;
+ EXPECT_FALSE(brpc::ReadAMFArray(&arr, &istream));
+ }
+ {
+ // As the value of a field mapped to a protobuf message.
+ std::string req_buf;
+ AppendAMFObjectHeader(&req_buf);
+ AppendAMFShortStringBody(&req_buf, "code");
+ req_buf.push_back((char)brpc::AMF_MARKER_OBJECT_END);
+ AppendAMFObjectEnd(&req_buf);
+
+ google::protobuf::io::ArrayInputStream zc_stream(req_buf.data(),
req_buf.size());
+ brpc::AMFInputStream istream(&zc_stream);
+ brpc::RtmpInfo info;
+ EXPECT_FALSE(brpc::ReadAMFObject(&info, &istream));
+ }
+}
+
TEST(RtmpTest, amf_rejects_deep_nested_arrays) {
ScopedAMFMaxDepth scoped_depth(4);
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
