fix(conn): close aggregate unknown sub-tag budget bypass (#302)

[cursor]

Security fix (medium)

Finding: Aggregate unknown sub-tag types bypass per-message processing budgets enabling CPU amplification

Severity: Medium (CPU amplification / poll-loop DoS)

Location: src/session/conn.rs (Conn::handle_aggregate)

Impact

Remote RTMP peers can pack Aggregate messages with up to 4096 non-audio/video/script sub-tags. The 0.8.0 budget repair for issue #233 only decremented messages_budget for 0x08/0x09/0x12 sub-tags; unknown types were parsed in a tight loop without budget accounting, yielding ~64× more parse work per recv than the 256-message cap allows. Play-side clients had the same gap in Client::handle_aggregate_message.

Fix

• Decrement the per-recv message budget for every aggregate sub-tag before dispatch, regardless of type.
• Reject zero-length aggregate sub-tags (mirror multitrack_media zero-size guard).
• Add server and client regression tests.

CI

cargo test, cargo clippy --all-features --all-targets, and sanitizer workflows should cover the new tests.

  

---

Note

Medium Risk
Security-relevant change to aggregate parsing and recv fairness caps; behavior tightens (more sub-tags stop processing earlier, zero-length tags fail) but scope is bounded protocol handling on both server and client.

Overview
Closes a CPU amplification path where RTMP Aggregate messages could pack thousands of unknown sub-tag types that were parsed without counting against per-recv message limits (only audio/video/script decremented the budget).

Server (Conn::handle_aggregate) and play client (Client::handle_aggregate_message) now decrement the message budget for every aggregate sub-tag before dispatch, regardless of type, and reject zero-length sub-tags with ErrorCode::Protocol (aligned with multitrack zero-size handling). Budget checks were moved out of the A/V/script branches so skipped unknown types still consume quota.

Regression tests assert unknown sub-tags exhaust MAX_MESSAGES_PER_POLL / messages_budget and that zero-size sub-tags are rejected on the server.

^{Reviewed by Cursor Bugbot for commit 84acebf. Bugbot is set up for automated code reviews on this repo. Configure here.}

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Advanced

Run ID: fd29fa5f-051b-498d-a5f8-71d25677f1b3

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[sonarqubecloud]

Quality Gate failed

Failed conditions
10.3% Duplication on New Code (required ≤ 3%)

See analysis details on SonarQube Cloud

[cursor]

Bugbot couldn't run - usage limit reached

Bugbot is counted against Cursor usage for this user or team, and this run hit a usage or spend limit.

A user or team admin can review and increase usage limits in the Cursor dashboard.

(requestId: serverGenReqId_cf44d023-9835-4371-b312-a0496f998f66)

[AlexanderWagnerDev]

@codex review

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. Keep them coming!

Reviewed commit: 84acebf007

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".