Fixed null pointer dereference while reading AMF.

arut · arut · commit 23e1873aa62a · 2021-05-25T10:42:16.000+03:00
Thanks to Zengxian Ding.
diff --git a/ngx_rtmp_amf.c b/ngx_rtmp_amf.c
@@ -328,7 +328,7 @@ ngx_rtmp_amf_read(ngx_rtmp_amf_ctx_t *ctx, ngx_rtmp_amf_elt_t *elts,
         } else {
             switch (ngx_rtmp_amf_get(ctx, &type8, 1)) {
                 case NGX_DONE:
-                    if (elts->type & NGX_RTMP_AMF_OPTIONAL) {
+                    if (elts && elts->type & NGX_RTMP_AMF_OPTIONAL) {
                         return NGX_OK;
                     }
                     /* fall through */

Original file line number	Diff line number	Diff line change
`@@ -328,7 +328,7 @@ ngx_rtmp_amf_read(ngx_rtmp_amf_ctx_t ctx, ngx_rtmp_amf_elt_t elts,`
`328`	`328`	`} else {`
`329`	`329`	`switch (ngx_rtmp_amf_get(ctx, &type8, 1)) {`
`330`	`330`	`case NGX_DONE:`
`331`		`- if (elts->type & NGX_RTMP_AMF_OPTIONAL) {`
	`331`	`+ if (elts && elts->type & NGX_RTMP_AMF_OPTIONAL) {`
`332`	`332`	`return NGX_OK;`
`333`	`333`	`}`
`334`	`334`	`/* fall through */`