update gortsplib

go.mod

@@ -5,7 +5,7 @@ go 1.18
 require (
 	code.cloudfoundry.org/bytefmt v0.0.0
 	github.com/abema/go-mp4 v0.9.0
-	github.com/aler9/gortsplib/v2 v2.0.4
+	github.com/aler9/gortsplib/v2 v2.0.5
 	github.com/asticode/go-astits v1.10.1-0.20220319093903-4abe66a9b757
 	github.com/fsnotify/fsnotify v1.4.9
 	github.com/gin-gonic/gin v1.8.1

go.sum

@@ -4,8 +4,8 @@ github.com/alecthomas/template v0.0.0-20190718012654-fb15b899a751 h1:JYp7IbQjafo
 github.com/alecthomas/template v0.0.0-20190718012654-fb15b899a751/go.mod h1:LOuyumcjzFXgccqObfd/Ljyb9UuFJ6TxHnclSeseNhc=
 github.com/alecthomas/units v0.0.0-20190924025748-f65c72e2690d h1:UQZhZ2O0vMHr2cI+DC1Mbh0TJxzA3RcLoMsFw+aXw7E=
 github.com/alecthomas/units v0.0.0-20190924025748-f65c72e2690d/go.mod h1:rBZYJk541a8SKzHPHnH3zbiI+7dagKZ0cgpgrD7Fyho=
-github.com/aler9/gortsplib/v2 v2.0.4 h1:k/drBmiMqrBRh94nrR11dbp3zdPahxG3JNJFaU/b6gU=
-github.com/aler9/gortsplib/v2 v2.0.4/go.mod h1:cGD/4JW43Elv/f4HfNBdH78IO5ZfwZIY52fByVASmsU=
+github.com/aler9/gortsplib/v2 v2.0.5 h1:K1dxSVMCRB22tNcpqAjSQBHj6YoIp2ad0FakEJAe+lo=
+github.com/aler9/gortsplib/v2 v2.0.5/go.mod h1:cGD/4JW43Elv/f4HfNBdH78IO5ZfwZIY52fByVASmsU=
 github.com/aler9/writerseeker v0.0.0-20220601075008-6f0e685b9c82 h1:9WgSzBLo3a9ToSVV7sRTBYZ1GGOZUpq4+5H3SN0UZq4=
 github.com/aler9/writerseeker v0.0.0-20220601075008-6f0e685b9c82/go.mod h1:qsMrZCbeBf/mCLOeF16KDkPu4gktn/pOWyaq1aYQE7U=
 github.com/asticode/go-astikit v0.20.0 h1:+7N+J4E4lWx2QOkRdOf6DafWJMv6O4RRfgClwQokrH8=

internal/core/rtsp_conn.go

@@ -254,6 +254,13 @@ func (c *rtspConn) OnResponse(res *base.Response) {
 // onDescribe is called by rtspServer.
 func (c *rtspConn) onDescribe(ctx *gortsplib.ServerHandlerOnDescribeCtx,
 ) (*base.Response, *gortsplib.ServerStream, error) {
+	if len(ctx.Path) == 0 || ctx.Path[0] != '/' {
+		return &base.Response{
+			StatusCode: base.StatusBadRequest,
+		}, nil, fmt.Errorf("invalid path")
+	}
+	ctx.Path = ctx.Path[1:]
+
 	res := c.pathManager.describe(pathDescribeReq{
 		pathName: ctx.Path,
 		url:      ctx.Request.URL,

internal/core/rtsp_session.go

@@ -124,6 +124,13 @@ func (s *rtspSession) onClose(err error) {
 
 // onAnnounce is called by rtspServer.
 func (s *rtspSession) onAnnounce(c *rtspConn, ctx *gortsplib.ServerHandlerOnAnnounceCtx) (*base.Response, error) {
+	if len(ctx.Path) == 0 || ctx.Path[0] != '/' {
+		return &base.Response{
+			StatusCode: base.StatusBadRequest,
+		}, fmt.Errorf("invalid path")
+	}
+	ctx.Path = ctx.Path[1:]
+
 	res := s.pathManager.publisherAdd(pathPublisherAddReq{
 		author:   s,
 		pathName: ctx.Path,
@@ -169,8 +176,15 @@ func (s *rtspSession) onAnnounce(c *rtspConn, ctx *gortsplib.ServerHandlerOnAnno
 // onSetup is called by rtspServer.
 func (s *rtspSession) onSetup(c *rtspConn, ctx *gortsplib.ServerHandlerOnSetupCtx,
 ) (*base.Response, *gortsplib.ServerStream, error) {
+	if len(ctx.Path) == 0 || ctx.Path[0] != '/' {
+		return &base.Response{
+			StatusCode: base.StatusBadRequest,
+		}, nil, fmt.Errorf("invalid path")
+	}
+	ctx.Path = ctx.Path[1:]
+
 	// in case the client is setupping a stream with UDP or UDP-multicast, and these
-	// transport protocols are disabled, gortsplib/v2 already blocks the request.
+	// transport protocols are disabled, gortsplib already blocks the request.
 	// we have only to handle the case in which the transport protocol is TCP
 	// and it is disabled.
 	if ctx.Transport == gortsplib.TransportTCP {