Changeset 11128 in ntrip for trunk/BNC/src/bncnetqueryrtp.cpp

Timestamp:

Oct 24, 2026, 11:37:52 PM (13 days ago)

Author:

stuerze

Message:

Some fixes from security point of view

File:

• trunk/BNC/src/bncnetqueryrtp.cpp (modified) (2 diffs)

trunk/BNC/src/bncnetqueryrtp.cpp

@@ -77 +77 @@
 void bncNetQueryRtp::waitForReadyRead(QByteArray& outData) {
 
-  // Wait Loop
-  // ---------
-  if (!_udpSocket->hasPendingDatagrams()) {
-    _eventLoop->exec();
-  }
-
-  // Append Data
-  // -----------
-  QByteArray datagram;
-  datagram.resize(_udpSocket->pendingDatagramSize());
-  _udpSocket->readDatagram(datagram.data(), datagram.size());
-
-  if (datagram.size() > 12) {
-    outData.append(datagram.mid(12));
+  while (true) {
+
+    // Wait Loop
+    // ---------
+    if (!_udpSocket->hasPendingDatagrams()) {
+      _eventLoop->exec();
+      if (!_udpSocket->hasPendingDatagrams()) { // stopped
+        return;
+      }
+    }
+
+    // Append Data, only from the RTSP server (anybody else could feed in data)
+    // ------------------------------------------------------------------------
+    QByteArray datagram;
+    QHostAddress sender;
+    datagram.resize(_udpSocket->pendingDatagramSize());
+    _udpSocket->readDatagram(datagram.data(), datagram.size(), &sender);
+    if (!sender.isEqual(_serverAddress, QHostAddress::ConvertV4MappedToIPv4)) {
+      continue;
+    }
+
+    if (datagram.size() > 12) {
+      outData.append(datagram.mid(12));
+    }
+    return;
   }
 }
@@ -126 +137 @@
   // --------------
   if (_socket->waitForConnected(timeOut)) {
+    _serverAddress = _socket->peerAddress();
     QString uName = QUrl::fromPercentEncoding(_url.userName().toLatin1());
     QString passW = QUrl::fromPercentEncoding(_url.password().toLatin1());