curl RTSP connection reuse routes response headers to the RTP callback (rtsp_conn state machine not reset between sessions)
该报告还没有中文解读。
原文摘录
摘自原文(11753 字符中的一小部分)
libcurl's RTSP client keeps a per-connection RTP parsing state machine in `struct rtsp_conn` (`state`, `in_header`, `rtp_len`, `buf`). This state machine is initialised exactly once, when a brand-new connection is allocated, and is never reset thereafter. RTSP connections are pooled and reused …
原文中的代码
// lib/rtsp.c:105-122 rtsp_setup_connection() // rtspc = Curl_conn_meta_get(...); curlx_calloc(...) -> all fields zero // (state = RTP_PARSE_SKIP, in_header = FALSE, rtp_len = 0, buf empty) // Called ONLY when a new connection is created — not on reuse.
默认不展示报告全文。以上为简短摘录,完整复现过程请阅读原文。版权归研究员与 curl 所有。
时间线
- 报告提交
- 公开披露
阅读 HackerOne 原文 ↗作者 @noraqiu · 版权归作者与 curl 所有