Skip to content

AI: HTTP-FLV: Fix heap-use-after-free crash during stream unmount. v6.0.171 v7.0.50#4432

Merged
winlinvip merged 3 commits intoossrs:developfrom
winlinvip:bugfix/4429
Aug 11, 2025
Merged

AI: HTTP-FLV: Fix heap-use-after-free crash during stream unmount. v6.0.171 v7.0.50#4432
winlinvip merged 3 commits intoossrs:developfrom
winlinvip:bugfix/4429

Conversation

@winlinvip
Copy link
Copy Markdown
Member

@winlinvip winlinvip commented Aug 11, 2025

Summary

Fixes a critical heap-use-after-free crash in HTTP-FLV streaming that occurs when a client requests a stream while it's being unmounted asynchronously.

Problem

  • Issue: Heap-Use-After-Free Crash in SRS HTTP-FLV Streaming #4429 - Heap-use-after-free crash in SrsLiveStream::serve_http()
  • Root Cause: Race condition between coroutines in single-threaded SRS server:
    1. Coroutine A: HTTP client requests FLV stream → serve_http() starts
    2. Coroutine B: RTMP publisher disconnects → triggers async stream destruction
    3. Async Worker: Destroys SrsLiveStream object while Coroutine A is yielded
    4. Coroutine A: Resumes and accesses freed memory → CRASH

Solution

  1. Early viewer registration: Add HTTP connection to viewers_ list immediately in serve_http() before any I/O operations that could yield
  2. Lifecycle protection: Split serve_http() into wrapper and implementation to ensure proper viewer management
  3. Stream availability checks: Add fast checks for stream disposal state before critical operations
  4. Improved error handling: Convert warnings to fatal errors when trying to free alive streams

Key Changes

  • SrsLiveStream::serve_http(): Now immediately registers viewer and delegates to serve_http_impl()
  • SrsLiveStream::serve_http_impl(): Contains the actual HTTP serving logic
  • SrsHttpStreamDestroy::call(): Enhanced error handling and longer wait timeout
  • Stream state validation: Added checks for entry->enabled before proceeding with stream operations

Fixes #4429

@winlinvip winlinvip added the EnglishNative This issue is conveyed exclusively in English. label Aug 11, 2025
@winlinvip winlinvip linked an issue Aug 11, 2025 that may be closed by this pull request
@winlinvip winlinvip changed the title Fix #4429 HTTP-FLV: Fix heap-use-after-free crash during stream unmount. (#4429) Aug 11, 2025
@winlinvip winlinvip changed the title HTTP-FLV: Fix heap-use-after-free crash during stream unmount. (#4429) HTTP-FLV: Fix heap-use-after-free crash during stream unmount. (#4429). v6.0.171 v7.0.50 Aug 11, 2025
@winlinvip winlinvip added the RefinedByAI Refined by AI/GPT. label Aug 11, 2025
@winlinvip winlinvip changed the title HTTP-FLV: Fix heap-use-after-free crash during stream unmount. (#4429). v6.0.171 v7.0.50 AI: HTTP-FLV: Fix heap-use-after-free crash during stream unmount. (#4429) Aug 11, 2025
@winlinvip winlinvip added the AI Handled This issue is fixed by AI, or the PR is reviewed by AI, or the discussion is replied to by AI. label Aug 11, 2025
@winlinvip winlinvip changed the title AI: HTTP-FLV: Fix heap-use-after-free crash during stream unmount. (#4429) AI: HTTP-FLV: Fix heap-use-after-free crash during stream unmount. Aug 11, 2025
@winlinvip winlinvip changed the title AI: HTTP-FLV: Fix heap-use-after-free crash during stream unmount. AI: HTTP-FLV: Fix heap-use-after-free crash during stream unmount. v6.0.172 v7.0.51 Aug 11, 2025
@winlinvip winlinvip changed the title AI: HTTP-FLV: Fix heap-use-after-free crash during stream unmount. v6.0.172 v7.0.51 AI: HTTP-FLV: Fix heap-use-after-free crash during stream unmount. Aug 11, 2025
@winlinvip winlinvip changed the title AI: HTTP-FLV: Fix heap-use-after-free crash during stream unmount. AI: HTTP-FLV: Fix heap-use-after-free crash during stream unmount. v6.0.171 v7.0.50 Aug 11, 2025
@winlinvip winlinvip merged commit c762e82 into ossrs:develop Aug 11, 2025
17 checks passed
winlinvip added a commit that referenced this pull request Aug 11, 2025
….0.171 (#4432)

Fixes a critical heap-use-after-free crash in HTTP-FLV streaming that
occurs when a client requests a stream while it's being unmounted
asynchronously.

- **Issue**: #4429 - Heap-use-after-free crash in
`SrsLiveStream::serve_http()`
- **Root Cause**: Race condition between coroutines in single-threaded
SRS server:
1. **Coroutine A**: HTTP client requests FLV stream → `serve_http()`
starts
2. **Coroutine B**: RTMP publisher disconnects → triggers async stream
destruction
3. **Async Worker**: Destroys `SrsLiveStream` object while Coroutine A
is yielded
  4. **Coroutine A**: Resumes and accesses freed memory → **CRASH**

1. **Early viewer registration**: Add HTTP connection to `viewers_` list
immediately in `serve_http()` before any I/O operations that could yield
2. **Lifecycle protection**: Split `serve_http()` into wrapper and
implementation to ensure proper viewer management
3. **Stream availability checks**: Add fast checks for stream disposal
state before critical operations
4. **Improved error handling**: Convert warnings to fatal errors when
trying to free alive streams

- **`SrsLiveStream::serve_http()`**: Now immediately registers viewer
and delegates to `serve_http_impl()`
- **`SrsLiveStream::serve_http_impl()`**: Contains the actual HTTP
serving logic
- **`SrsHttpStreamDestroy::call()`**: Enhanced error handling and longer
wait timeout
- **Stream state validation**: Added checks for `entry->enabled` before
proceeding with stream operations

Fixes #4429
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

AI Handled This issue is fixed by AI, or the PR is reviewed by AI, or the discussion is replied to by AI. EnglishNative This issue is conveyed exclusively in English. RefinedByAI Refined by AI/GPT.

Development

Successfully merging this pull request may close these issues.

Heap-Use-After-Free Crash in SRS HTTP-FLV Streaming

1 participant