Skip to content

Limit AMF string and array parsing#3353

Merged
chenBright merged 1 commit into
apache:masterfrom
wwbmmm:limit-amf-string-and-array-parsing
Jun 21, 2026
Merged

Limit AMF string and array parsing#3353
chenBright merged 1 commit into
apache:masterfrom
wwbmmm:limit-amf-string-and-array-parsing

Conversation

@wwbmmm

@wwbmmm wwbmmm commented Jun 21, 2026

Copy link
Copy Markdown
Contributor

What problem does this PR solve?

Issue Number: null

Problem Summary:

AMF parsing accepted declared string lengths and array counts directly from the input stream. Malformed RTMP/AMF payloads could make the parser reserve excessive memory or spend a long time walking impossible element counts before discovering that the stream was incomplete.

What is changed and the side effects?

Changed:

  • Add configurable AMF string and array limits.
  • Read AMF string bodies incrementally instead of resizing the destination string to the declared length up front.
  • Reject ECMA array and strict array counts above the configured limit before parsing their elements.
  • Add RTMP AMF unit tests for truncated long strings and oversized array counts.

Side effects:

  • Performance effects: AMF string parsing now copies through a small stack buffer, avoiding large zero-fill allocations for malformed payloads.

  • Breaking backward compatibility: AMF payloads whose string length or array count exceed the new defaults will be rejected. The defaults are 64 MiB per string and 1,048,576 array elements.


Check List:

@wwbmmm wwbmmm requested a review from chenBright June 21, 2026 06:59

@chenBright chenBright left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

@chenBright chenBright merged commit 1c9c053 into apache:master Jun 21, 2026
15 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants