From 9d18015e3284b4c019c4f1ffe854d913f33d8022 Mon Sep 17 00:00:00 2001
From: baigao-X <1007668733@qq.com>
Date: Sat, 26 Jul 2025 15:43:36 +0800
Subject: [PATCH] fix: SrtCaller and SrtSession crash (#4328)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

1.修改SrtCaller 多线程发送造成的crash
2.修改SrtCaller 接收的期望外的控制包可能造成的空指针引用
3.修改异常的streamid ext可能造成的crash
---
 src/Srt/SrtCaller.cpp | 31 +++++++++++++++++++++++++++++--
 src/Srt/SrtPlayer.cpp | 10 +++++++++-
 src/Srt/SrtPusher.cpp | 10 +++++++++-
 srt/HSExt.cpp         |  6 ++++--
 4 files changed, 51 insertions(+), 6 deletions(-)

diff --git a/src/Srt/SrtCaller.cpp b/src/Srt/SrtCaller.cpp
index 2d0da89f..64936052 100644
--- a/src/Srt/SrtCaller.cpp
+++ b/src/Srt/SrtCaller.cpp
@@ -218,8 +218,8 @@ void SrtCaller::inputSockData(uint8_t *buf, int len, struct sockaddr *addr) {
 
     // 处理srt数据
     if (DataPacket::isDataPacket(buf, len)) {
-        uint32_t socketId = DataPacket::getSocketID(buf, len);
-        if (isPlayer()) {
+        if (_is_handleshake_finished && isPlayer()) {
+            uint32_t socketId = DataPacket::getSocketID(buf, len);
             if (socketId == _socket_id) {
                 _pkt_recv_rate_context->inputPacket(_now, len + UDP_HDR_SIZE);
                 handleDataPacket(buf, len, addr);
@@ -702,6 +702,11 @@ void SrtCaller::handleHandshakeConclusion(SRT::HandshakePacket &pkt, struct sock
 void SrtCaller::handleACK(uint8_t *buf, int len, struct sockaddr *addr) {
     // TraceL;
     //Acknowledgement of Acknowledgement (ACKACK) control packets are sent to acknowledge the reception of a Full ACK
+ 
+    if (!_is_handleshake_finished) {
+        return;
+    }
+
     ACKPacket ack;
     if (!ack.loadFromData(buf, len)) {
         return;
@@ -722,6 +727,10 @@ void SrtCaller::handleACK(uint8_t *buf, int len, struct sockaddr *addr) {
 
 void SrtCaller::handleACKACK(uint8_t *buf, int len, struct sockaddr *addr) {
     // TraceL;
+
+    if (!_is_handleshake_finished) {
+        return;
+    }
     ACKACKPacket::Ptr pkt = std::make_shared<ACKACKPacket>();
     pkt->loadFromData(buf, len);
 
@@ -757,6 +766,15 @@ void SrtCaller::handleACKACK(uint8_t *buf, int len, struct sockaddr *addr) {
 }
 
 void SrtCaller::handleNAK(uint8_t *buf, int len, struct sockaddr *addr) {
+    if (!_is_handleshake_finished) {
+        return;
+    }
+
+    if (isPlayer()) {
+        //player should not handle nak 
+        return;
+    }
+
     //TraceL;
     NAKPacket pkt;
     pkt.loadFromData(buf, len);
@@ -783,6 +801,15 @@ void SrtCaller::handleNAK(uint8_t *buf, int len, struct sockaddr *addr) {
 }
 
 void SrtCaller::handleDropReq(uint8_t *buf, int len, struct sockaddr *addr) {
+    if (!_is_handleshake_finished) {
+        return;
+    }
+
+    if (!isPlayer()) {
+        //pusher should not handle drop req
+        return;
+    }
+
     MsgDropReqPacket pkt;
     pkt.loadFromData(buf, len);
     std::list<DataPacket::Ptr> list;
diff --git a/src/Srt/SrtPlayer.cpp b/src/Srt/SrtPlayer.cpp
index e77becc9..02d3fc83 100644
--- a/src/Srt/SrtPlayer.cpp
+++ b/src/Srt/SrtPlayer.cpp
@@ -36,7 +36,15 @@ void SrtPlayer::play(const string &strUrl) {
         onResult(SockException(Err_other, StrPrinter << "illegal srt url:" << ex.what()));
         return;
     }
-    onConnect();
+
+    weak_ptr<SrtPlayer> weak_self = static_pointer_cast<SrtPlayer>(shared_from_this());
+    getPoller()->async([weak_self]() {
+        auto strong_self = weak_self.lock();
+        if (!strong_self) {
+            return;
+        }
+        strong_self->onConnect();
+    });
     return;
 }
 
diff --git a/src/Srt/SrtPusher.cpp b/src/Srt/SrtPusher.cpp
index d68af082..113a2c04 100644
--- a/src/Srt/SrtPusher.cpp
+++ b/src/Srt/SrtPusher.cpp
@@ -32,7 +32,15 @@ void SrtPusher::publish(const string &strUrl) {
         onResult(SockException(Err_other, StrPrinter << "illegal srt url:" << ex.what()));
         return;
     }
-    onConnect();
+
+    weak_ptr<SrtPusher> weak_self = static_pointer_cast<SrtPusher>(shared_from_this());
+    getPoller()->async([weak_self]() {
+        auto strong_self = weak_self.lock();
+        if (!strong_self) {
+            return;
+        }
+        strong_self->onConnect();
+    });
     return;
 }
 
diff --git a/srt/HSExt.cpp b/srt/HSExt.cpp
index 45be1a12..69c86c1f 100644
--- a/srt/HSExt.cpp
+++ b/srt/HSExt.cpp
@@ -83,8 +83,10 @@ bool HSExtStreamID::loadFromData(uint8_t *buf, size_t len) {
         ptr += 4;
     }
     char zero = 0x00;
-    if (streamid.back() == zero) {
-        streamid.erase(streamid.find_first_of(zero), streamid.size());
+    if (!streamid.empty()) {
+        if (streamid.back() == zero) {
+            streamid.erase(streamid.find_first_of(zero), streamid.size());
+        }
     }
     return true;
 }