sahvx655-wq opened a new pull request, #3625: URL: https://github.com/apache/brpc/pull/3625
### What problem does this PR solve? Issue Number: resolve Problem Summary: `AVCDecoderConfigurationRecord::Create` stores `lengthSizeMinusOne` from byte 4 of an AVC sequence header into the record and only then rejects the reserved value 2. The rejected header still overwrites `length_size_minus1` of a record that was parsed successfully before. `TsWriter::Write` keeps `_has_avc_seq_header` set when a later sequence header is rejected and goes on muxing frames with the same record, so the next video frame constructs an `AVCNaluIterator` with `length_size_minus1 == 2` and fails `CHECK_NE(_length_size_minus1, 2u)` in `next_as_ibmf`. An RTMP publisher reaches this with three messages: a valid sequence header, a copy of it with bits 0-1 of byte 4 set to `10`, then any video frame. Every frame after that logs at FATAL level with a stack trace, and with `-crash_on_fatal_log` the process aborts. A small program feeding that sequence into `TsWriter` ends in: ``` F1018 21:17:10.145007 8195 0 src/brpc/rtmp.cpp:951 next_as_ibmf] Check failed: _length_size_minus1 != 2u (2 vs 2). ``` ### What is changed and the side effects? Changed: `Create()` checks the field before assigning it, so a rejected header leaves the record as it was and the `CHECK` in `AVCNaluIterator` keeps guarding a record invariant instead of wire input. `RtmpTest.avc_seq_header_rejected_length_size_keeps_record` fails on master (`length_size_minus1` reads 2 after the rejected header) and passes with the fix; the `TsWriter` program above completes and reports the rejected header through the returned status. All 32 tests in `brpc_rtmp_unittest` pass locally. Side effects: - Performance effects: none. - Breaking backward compatibility: none. Headers with `lengthSizeMinusOne == 2` were already rejected; only the state left behind changes. --- ### Check List: - Please make sure your changes are compilable. - When providing us with a new feature, it is best to add related tests. - Please follow [Contributor Covenant Code of Conduct](https://github.com/apache/brpc/blob/master/CODE_OF_CONDUCT.md). -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
