mirror of
https://github.com/ZLMediaKit/ZLMediaKit.git
synced 2026-07-28 13:04:07 +08:00
6b16281ab0
### Motivation
- Prevent unbounded recursive-descent parsing in the AMF decoder that
allowed deeply nested AMF objects/arrays to exhaust the process stack
and cause a pre-auth remote DoS.
### Description
- Add an RAII depth guard `AMFDecoder::DepthGuard` and a per-decoder
`depth` counter with `kMaxDepth = 64` to `AMFDecoder` in
`src/Rtmp/amf.h`/`src/Rtmp/amf.cpp`.
- Instrument `load_object()`, `load_ecma()`, and `load_arr()` to create
a `DepthGuard` at entry so nesting is incremented and reliably
decremented on return or exception, and throw
`std::runtime_error("Maximum AMF nesting depth exceeded")` when the
limit is exceeded.
- Add `tests/test_amf.cpp` to assert that a 64-level nested AMF
container is accepted and a 65-level nested container is rejected with
the expected error.
- Keep non-nested parsing behavior unchanged; the guard only enforces a
maximum container nesting depth.
### Testing
- Configured the project with tests enabled using `cmake -S . -B build
-DENABLE_TESTS=ON`, which generated the `test_amf` target successfully.
- Built the test target with `cmake --build build --target test_amf` and
performed smoke compiles of modified sources, with `src/Rtmp/amf.cpp`
compiling to object (`/tmp/amf.o`) successfully.
- Compiled the new test source with `c++ -std=gnu++11 -c
tests/test_amf.cpp` successfully and verified `git diff --cached
--check` passed.
------
[Codex
Task](https://chatgpt.com/codex/cloud/tasks/task_e_6a63c9326b9883209c857c0f4fa5d0cc)
此目录下的所有.cpp文件将被编译成可执行程序(不包含此目录下的子目录). 子目录DeviceHK为海康IPC的适配程序,需要先下载海康的SDK才能编译, 由于操作麻烦,所以仅把源码放在这里仅供参考.
-
test_benchmark.cpp
rtsp/rtmp性能测试客户端
-
test_httpApi.cpp
http api 测试服务器
-
test_httpClient.cpp
http 测试客户端
-
test_player.cpp
rtsp/rtmp带视频渲染的客户端
-
test_pusher.cpp
先拉流再推流的测试客户端
-
test_pusherMp4.cpp
解复用mp4文件再推流的测试客户端
-
test_server.cpp
rtsp/rtmp/http等服务器
-
test_wsClient.cpp
websocket测试客户端
-
test_wsServer.cpp
websocket回显测试服务器