fix: add bounds checks in AAC RTP demuxer to prevent panic#126
Open
kimarti wants to merge 1 commit into
Open
Conversation
Cacsjep
added a commit
to Cacsjep/vdk
that referenced
this pull request
May 27, 2026
Add several robustness fixes to the RTSP demuxer and client and introduce unit tests. - Add mergeResponseHeader to preserve Digest over Basic in WWW-Authenticate responses (prefer strongest scheme) to avoid downgrading to Basic (backports upstream PR deepch#104) and use it when parsing response headers. - Use RFC 7826 default ports: 322 for rtsps and 554 for rtsp (backports upstream PR deepch#118) when parsing URLs; normalize unknown schemes to rtsp. Add URL parsing tests. - Fix RTP timestamp slice to read exactly 4 bytes (avoid leaking SSRC into timestamp) (backports upstream PR deepch#119) and add tests verifying timestamp behavior. - Harden H.264 STAP-A parsing to guard against size==0 causing OOB reads (prevents panics, referenced upstream issue deepch#114). - Add bounds checks in AAC handling to avoid panics from malformed AU headers and frame sizes (backports upstream PR deepch#126). - Add comprehensive tests: client_test.go and demuxer_test.go covering URL parsing, WWW-Authenticate merging, H.264 STAP-A, AAC malformed packets, metadata reassembly, and other demuxer behaviors. Remove older demuxer_metadata_test.go in favor of unified tests.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This happens in a goroutine spawned by
Dial, so the caller cannotrecover from it — the panic kills the entire process.
Add bounds checks before slicing in the
case av.AACbranch:framesPayloadOffsetdoes not exceedlen(nal)len(auHeaders) >= 2before reading AU-header bytesframeSizedoes not exceedlen(framesPayload)Malformed packets are silently skipped instead of crashing.