mirror of
https://github.com/rustdesk/hbb_common.git
synced 2026-08-27 12:39:50 +00:00
rustdesk
a0d995f571
Four review findings on the receive path, all verified against the vendored webrtc-rs rather than inferred: - next() awaited pc.close() on every error/EOF path while every consumer polls next() inside a select! against a 1s timer. close() latches is_closed before its first await and fires the state handler last, so losing that race left a pc no later close() could retry, a SESSIONS entry only that handler evicts, and a state_notify that never reaches Closed. close_detached() hands the teardown to the runtime; being a non-async fn, its callers have no await point to be cancelled at. The send path's timeout arm passes its logical-message permit along, so the exclusion it relies on now outlives the caller too. - the reassembly cap was checked after extend_from_slice, so the peak was the cap plus a fragment, and BytesMut's reallocate-and-copy growth held old and new buffers at once. Check before appending, and stop borrowing bytes_codec's ~1 GiB MAX_FRAME_LENGTH: that bound is only affordable for TCP because its length prefix rejects an oversize frame before buffering any of it, while this framing can only discover the overrun by accumulating it - and the answerer runs before any password check. MAX_RECV_MESSAGE (64 MiB) bounds both directions. - the EOF path claimed an empty message could never be confused with a reset. It can: webrtc-data maps the StringEmpty/BinaryEmpty PPIDs to n == 0 and dc.read() discards the flag that separates them. Both mean the same thing to us, so the handling stands - the comment and the log line now say what actually happened. - on_data_channel bound whatever the remote opened, however it opened it. Reassembly spans messages, so it is sound only on an ordered, fully-reliable channel, and webrtc-rs derives those parameters verbatim from the remote's DCEP OPEN; extra channels additionally split teardown from the channel carrying traffic and re-arm Open over a latched Closed. Refuse both. Also release the accumulator on the EOF and read-error exits, which were the only paths that left a partial message reachable through the SESSIONS clone. Regression tests for the detached teardown and the bind-once guard, both mutation-checked; the test comments state what is and is not covered. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01ExUfAkYbq8UC9pQCiLy8TQ