Summary
RtspMethods.valueOf() silently strips trailing control bytes (any character with code point <= 0x20, the full range that
String.trim() removes) before performing a cache lookup against its ten pre-populated method constants. A wire-delivered RTSP request whose method token ends with a trailing control byte — for example
PLAY\x00 or
PLAY\r, immediately before the separating space — is decoded by
RtspDecoder as a fully successful PLAY request, with
decoderResult().isSuccess() == true and request.method() == RtspMethods.PLAY (same object reference as the cached singleton). The application layer cannot distinguish this from a clean
PLAY request.
This is the same root cause as #16723 and #16971, in a sibling that those fixes did not reach. The fix for
HttpMethod hardened
HttpMethod.valueOf() directly, but
RtspMethods.valueOf() has its own independent
checkNonEmptyAfterTrim() call that runs before the cache lookup — meaning a trailing-control-byte token hits the cache before the hardened
HttpMethod constructor ever sees it.
Reproduction
Minimal wire-level reproduction
Send the following raw bytes to any Netty-based RTSP server using R