From 75b17b3a6af5d5c8529ef2b6e5d111c66fed1e64 Mon Sep 17 00:00:00 2001
From: alexliyu7352 <liyu7352@gmail.com>
Date: Wed, 6 Apr 2022 14:16:48 +0800
Subject: [PATCH] =?UTF-8?q?=E9=81=BF=E5=85=8Dm3u8=E6=96=87=E4=BB=B6?=
 =?UTF-8?q?=E4=B8=BAchunked=E6=97=B6=E5=B4=A9=E6=BA=83=20(#1543)?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

* Update HttpChunkedSplitter.h

* 避免m3u8文件为chunked时崩溃

具体问题见
https://github.com/ZLMediaKit/ZLMediaKit/issues/1407

当数据最后小于2个字节时, 应该放弃回调.
做个保险, 避免导致溢出后崩溃.

这个bug很难出现, 但是的确存在. 一些特殊的服务器采用chunked返回的m3u8文件解析时, 有可能会遇到.

* Update HttpChunkedSplitter.cpp

Co-authored-by: 夏楚 <771730766@qq.com>
---
 src/Http/HttpChunkedSplitter.cpp | 21 ++++++++++++---------
 src/Http/HttpChunkedSplitter.h   |  8 +++-----
 2 files changed, 15 insertions(+), 14 deletions(-)

diff --git a/src/Http/HttpChunkedSplitter.cpp b/src/Http/HttpChunkedSplitter.cpp
index 3083a67f..2b8b3d84 100644
--- a/src/Http/HttpChunkedSplitter.cpp
+++ b/src/Http/HttpChunkedSplitter.cpp
@@ -9,29 +9,32 @@
  */
 
 #include <string.h>
+#include "Common/macros.h"
 #include "HttpChunkedSplitter.h"
 
 using namespace std;
 
+//[chunk size][\r\n][chunk data][\r\n][chunk size][\r\n][chunk data][\r\n][chunk size = 0][\r\n][\r\n]
+
 namespace mediakit{
-    
+
 const char *HttpChunkedSplitter::onSearchPacketTail(const char *data, size_t len) {
-    auto pos = strstr(data,"\r\n");
-    if(!pos){
+    auto pos = strstr(data, "\r\n");
+    if (!pos) {
         return nullptr;
     }
     return pos + 2;
 }
 
 void HttpChunkedSplitter::onRecvContent(const char *data, size_t len) {
-    onRecvChunk(data,len - 2);
+    onRecvChunk(data, len - 2);
 }
 
 ssize_t HttpChunkedSplitter::onRecvHeader(const char *data, size_t len) {
-    string str(data,len - 2);
-    int ret;
-    sscanf(str.data(),"%X",&ret);
-    return ret + 2;
+    int size;
+    CHECK(sscanf(data, "%X", &size) == 1 && size >= 0);
+    //包括后面\r\n两个字节
+    return size + 2;
 }
 
-}//namespace mediakit
\ No newline at end of file
+}//namespace mediakit
diff --git a/src/Http/HttpChunkedSplitter.h b/src/Http/HttpChunkedSplitter.h
index ae16c58d..6d8561f1 100644
--- a/src/Http/HttpChunkedSplitter.h
+++ b/src/Http/HttpChunkedSplitter.h
@@ -21,12 +21,10 @@ public:
     /**
      * len == 0时代表结束
      */
-    typedef std::function<void (const char *data,size_t len)> onChunkData;
+   using onChunkData = std::function<void(const char *data, size_t len)>;
 
-    HttpChunkedSplitter(const onChunkData &cb){
-        _onChunkData = cb;
-    };
-    ~HttpChunkedSplitter() override {} ;
+    HttpChunkedSplitter(const onChunkData &cb) { _onChunkData = cb; };
+    ~HttpChunkedSplitter() override { _onChunkData = nullptr; };
 
 protected:
     ssize_t onRecvHeader(const char *data,size_t len) override;