Skip to content

fix: keep WHIP/WHEP session credentials and bound signaling JSON - #430

Merged
devopvoid merged 2 commits into
mainfrom
fix/whip-session-config-json-depth
Oct 24, 2026
Merged

devopvoid merged 2 commits into
mainfrom
fix/whip-session-config-json-depth

Conversation

@devopvoid

Copy link
Copy Markdown
Owner
  • Whip.publish() and Whep.play() read the bearer token and timeout from the builder again once the answer arrived. A builder changed in between sent the DELETE with other credentials than the POST, which could leave the resource on the server. The session now keeps what it started with.
  • The signaling JSON parser recursed without a depth limit, so a deeply nested member, even an unknown one, overflowed the stack with an Error that message handlers don't catch. Nesting beyond 64 levels and text beyond 1 MiB now throw IllegalArgumentException.

publish() and play() read the bearer token and timeout from the builder again once the answer arrived, so a builder changed in between sent the DELETE with other credentials than the POST and could leave the resource on the server.
The recursive parser had no depth limit, so a deeply nested member, even an unknown one, overflowed the stack with an Error that message handlers do not catch. Nesting beyond 64 levels and text beyond a MiB now throw IllegalArgumentException.
@devopvoid
devopvoid merged commit 704a166 into main Oct 24, 2026
25 checks passed
@devopvoid
devopvoid deleted the fix/whip-session-config-json-depth branch October 24, 2026 01:38
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant