[Live-devel] Remote use-after-free in RTSP-over-HTTP tunneling

[Qingyang Zhou]

Hello live555 maintainers:

There is an unauthenticated, remotely-triggerable use-after-free in the
RTSP-over-HTTP tunneling code of RTSPServer.cpp (liveMedia 2026.07.06, affects
any RTSPServer-based server).

Root cause: the server maps an "x-sessioncookie" to a raw RTSPClientConnection*
in fClientConnectionsForHTTPTunneling. handleHTTPCmd_TunnelingGET()
(RTSPServer.cpp:633) can Add() several cookies for one connection but only
records the last in fOurSessionCookie, and ~RTSPClientConnection()
(RTSPServer.cpp:344) removes only that one. A connection that registers two
different cookies thus leaves a stale table entry after it is freed; a later
HTTP POST that references it (Lookup at :657, then changeClientInputSocket at
:669/:1247) dereferences the freed connection.

Reproduction (single client, "\r\n" = CR LF):

  Connection #1 -- send, then close the socket:
      GET / HTTP/1.0\r\nx-sessioncookie: AAAA\r\n\r\n
      GET / HTTP/1.0\r\nx-sessioncookie: BBBB\r\n\r\n
    -> connection freed; only "BBBB" removed, "AAAA -> freed connection" remains.

  Connection #2 -- new socket:
      POST / HTTP/1.0\r\nx-sessioncookie: AAAA\r\n\r\n
    -> Lookup("AAAA") returns the freed connection -> use-after-free.

Under AddressSanitizer: heap-use-after-free (READ of size 8) in
ClientConnection::envir() via handleHTTPCmd_TunnelingPOST -> changeClientInputSocket;
freed at ~RTSPClientConnection ("delete this", RTSPServer.cpp:1036).

The PoC (server.cc + client.py) is ready and reproduces the transcript above in
a single run against the stock library. I'm happy to provide any further detail
or test a patch. If you would like to assign a CVE for this, I can also supply
whatever information you need for the request and coordinate on disclosure
timing.


Best regards,
Zhou Qingyang
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.live555.com/pipermail/live-devel/attachments/20260706/f515fc8e/attachment.htm>