From 54585d6caf6402a8b28993eb319d6115d6e7bea0 Mon Sep 17 00:00:00 2001
From: Davis Clark <davis@futuremodel.io>
Date: Wed, 17 Jun 2026 12:05:50 -0500
Subject: [PATCH] Fix out-of-bounds crash on truncated RTMP User Control
 messages
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

RTMPUserControlMessage.init reads header.payload[1] and
header.payload[2..<header.payload.count] without validating the payload
length. A User Control message shorter than its 6-byte layout (2-byte event
type + 4-byte value) — e.g. a truncated or malformed message from the peer —
indexes past the end of the Data and traps (EXC_BREAKPOINT / fatal
out-of-bounds) on the RTMPConnection receive loop, crashing the host process.

Re-base the payload to a 0-indexed copy (a Data slice keeps its parent's
indices) and fall back to a safe default (.unknown / 0) when the payload is
too short. Adds regression tests for the truncated and well-formed cases.
---
 RTMPHaishinKit/Sources/RTMP/RTMPMessage.swift | 17 ++++++-
 .../RTMP/RTMPUserControlMessageTests.swift    | 47 +++++++++++++++++++
 2 files changed, 62 insertions(+), 2 deletions(-)
 create mode 100644 RTMPHaishinKit/Tests/RTMP/RTMPUserControlMessageTests.swift

diff --git a/RTMPHaishinKit/Sources/RTMP/RTMPMessage.swift b/RTMPHaishinKit/Sources/RTMP/RTMPMessage.swift
index 043b94949..f224b2e79 100644
--- a/RTMPHaishinKit/Sources/RTMP/RTMPMessage.swift
+++ b/RTMPHaishinKit/Sources/RTMP/RTMPMessage.swift
@@ -659,8 +659,21 @@ struct RTMPUserControlMessage: RTMPMessage {
     init(_ header: RTMPChunkMessageHeader) {
         streamId = header.messageStreamId
         timestamp = header.timestamp
-        event = Event(rawValue: header.payload[1]) ?? .unknown
-        value = Int32(data: header.payload[2..<header.payload.count]).bigEndian
+        // A well-formed user control message is at least 6 bytes: a 2-byte
+        // event type followed by a 4-byte value. A truncated payload from the
+        // peer would otherwise index past the end of `payload` and trap
+        // (EXC_BREAKPOINT / out of bounds), crashing the whole process from
+        // the RTMP receive loop. Re-base to a 0-indexed copy (a Data slice
+        // keeps its parent's indices) and bail out to a safe default when the
+        // payload is too short.
+        let payload = Data(header.payload)
+        guard payload.count >= 6 else {
+            event = .unknown
+            value = 0
+            return
+        }
+        event = Event(rawValue: payload[1]) ?? .unknown
+        value = Int32(data: payload[2..<payload.count]).bigEndian
     }
 
     init(event: Event, value: Int32) {
diff --git a/RTMPHaishinKit/Tests/RTMP/RTMPUserControlMessageTests.swift b/RTMPHaishinKit/Tests/RTMP/RTMPUserControlMessageTests.swift
new file mode 100644
index 000000000..11495c52f
--- /dev/null
+++ b/RTMPHaishinKit/Tests/RTMP/RTMPUserControlMessageTests.swift
@@ -0,0 +1,47 @@
+import Foundation
+import Testing
+
+@testable import RTMPHaishinKit
+
+@Suite struct RTMPUserControlMessageTests {
+    // Regression: a truncated user control message (shorter than the 6-byte
+    // event-type + value layout) must not trap on an out-of-bounds Data
+    // subscript. Before the bounds guard this crashed the process from the
+    // RTMP receive loop (EXC_BREAKPOINT in RTMPUserControlMessage.init).
+    @Test func truncatedPayloadDoesNotCrash() {
+        // messageLength 0 -> empty payload, position 0 == count 0, so
+        // makeMessage() builds the message and runs the (previously
+        // unguarded) decode against an empty buffer.
+        let header = RTMPChunkMessageHeader(
+            timestmap: 0,
+            messageLength: 0,
+            messageTypeId: RTMPMessageType.user.rawValue,
+            messageStreamId: 0
+        )
+        let message = header.makeMessage() as? RTMPUserControlMessage
+        #expect(message?.event == .unknown)
+        #expect(message?.value == 0)
+    }
+
+    // A well-formed 6-byte user control message must still decode correctly
+    // (2-byte event type + 4-byte big-endian value).
+    @Test func wellFormedPayloadDecodes() {
+        let buffer = RTMPChunkBuffer()
+        // basic header (fmt 0, csid 2) | timestamp(3) | length(3)=6 |
+        // typeId(1)=4 | streamId(4) | payload: event 0x0000 (streamBegin),
+        // value 0x00000001.
+        buffer.put(Data([2, 0, 0, 0, 0, 0, 6, 4, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1]))
+        do {
+            let (chunkType, chunkStreamId) = try buffer.getBasicHeader()
+            #expect(chunkType == .zero)
+            #expect(chunkStreamId == 2)
+            let header = RTMPChunkMessageHeader()
+            try buffer.getMessageHeader(chunkType, messageHeader: header)
+            let message = header.makeMessage() as? RTMPUserControlMessage
+            #expect(message?.event == .streamBegin)
+            #expect(message?.value == 1)
+        } catch {
+            Issue.record("unexpected error decoding user control message: \(error)")
+        }
+    }
+}