R3944Realms/srs
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Bridge: Fix heap-use-after-free in SrsCompositeBridge iterator. v6.0.183 (#4535)

Browse Source
This commit is contained in:
OSSRS-AI 2025-10-21 07:35:35 -04:00 committed by winlin
parent fcb2992230
commit e82dc112e7
3 changed files with 14 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
trunk/doc/CHANGELOG.md
View File

@ -7,6 +7,7 @@ The changelog for SRS.
<a name="v6-changes"></a> <a name="v6-changes"></a>
## SRS 6.0 Changelog ## SRS 6.0 Changelog
* v6.0, 2025-10-21, Merge [#4535](https://github.com/ossrs/srs/issues/4535): Bridge: Fix heap-use-after-free in SrsCompositeBridge iterator. v6.0.183 (#4535)
* v6.0, 2025-10-17, Merge [#4534](https://github.com/ossrs/srs/pull/4534): HLS: Fix a iterator bug in hls_ctx cleanup function. v6.0.182 (#4534) * v6.0, 2025-10-17, Merge [#4534](https://github.com/ossrs/srs/pull/4534): HLS: Fix a iterator bug in hls_ctx cleanup function. v6.0.182 (#4534)
* v6.0, 2025-10-14, Disable sanitizer by default to fix memory leak. (#4364) v6.0.181 * v6.0, 2025-10-14, Disable sanitizer by default to fix memory leak. (#4364) v6.0.181
* v6.0, 2025-10-01, SRT: Support configurable default_streamid option. v6.0.180 * v6.0, 2025-10-01, SRT: Support configurable default_streamid option. v6.0.180

15
trunk/src/app/srs_app_stream_bridge.cpp
View File

@ -173,7 +173,10 @@ srs_error_t SrsCompositeBridge::initialize(SrsRequest* r)
{ {
srs_error_t err = srs_success; srs_error_t err = srs_success;
for (vector<ISrsStreamBridge*>::iterator it = bridges_.begin(); it != bridges_.end(); ++it) { // Make a copy of bridges to avoid iterator invalidation if bridges_ is modified during iteration.
// See https://github.com/ossrs/srs/issues/4535
vector<ISrsStreamBridge*> bridges_copy = bridges_;
for (vector<ISrsStreamBridge*>::iterator it = bridges_copy.begin(); it != bridges_copy.end(); ++it) {
ISrsStreamBridge* bridge = *it; ISrsStreamBridge* bridge = *it;
if ((err = bridge->initialize(r)) != srs_success) { if ((err = bridge->initialize(r)) != srs_success) {
return err; return err;
@ -187,7 +190,10 @@ srs_error_t SrsCompositeBridge::on_publish()
{ {
srs_error_t err = srs_success; srs_error_t err = srs_success;
for (vector<ISrsStreamBridge*>::iterator it = bridges_.begin(); it != bridges_.end(); ++it) { // Make a copy of bridges to avoid iterator invalidation if bridges_ is modified during iteration.
// See https://github.com/ossrs/srs/issues/4535
vector<ISrsStreamBridge*> bridges_copy = bridges_;
for (vector<ISrsStreamBridge*>::iterator it = bridges_copy.begin(); it != bridges_copy.end(); ++it) {
ISrsStreamBridge* bridge = *it; ISrsStreamBridge* bridge = *it;
if ((err = bridge->on_publish()) != srs_success) { if ((err = bridge->on_publish()) != srs_success) {
return err; return err;
@ -199,7 +205,10 @@ srs_error_t SrsCompositeBridge::on_publish()
void SrsCompositeBridge::on_unpublish() void SrsCompositeBridge::on_unpublish()
{ {
for (vector<ISrsStreamBridge*>::iterator it = bridges_.begin(); it != bridges_.end(); ++it) { // Make a copy of bridges to avoid iterator invalidation if bridges_ is modified during iteration.
// See https://github.com/ossrs/srs/issues/4535
vector<ISrsStreamBridge*> bridges_copy = bridges_;
for (vector<ISrsStreamBridge*>::iterator it = bridges_copy.begin(); it != bridges_copy.end(); ++it) {
ISrsStreamBridge* bridge = *it; ISrsStreamBridge* bridge = *it;
bridge->on_unpublish(); bridge->on_unpublish();
} }

2
trunk/src/core/srs_core_version6.hpp
View File

@ -9,6 +9,6 @@
#define VERSION_MAJOR 6 #define VERSION_MAJOR 6
#define VERSION_MINOR 0 #define VERSION_MINOR 0
#define VERSION_REVISION 182 #define VERSION_REVISION 183
#endif #endif