Commit 150295ecff for freeswitch.com

commit 150295ecff43b5ffecf43f250eef3c4fba37b6d5
Author: Dmitry Verenitsin <morbit85@gmail.com>
Date:   Sat Aug 8 23:16:07 2026 +0500

    Merge commit from fork

    Two invoke handlers read an AMF argument's value without first
    checking its type, so a wrong-typed argument reads the wrong union
    member:

    - `rtmp_i_connect()` passed the first invoke argument straight into
      `amf0_object_get()`, which walks the value as a node list. Treat
      the command object as a field source only when it is an AMF object
      or ECMA array, otherwise leave the lookups empty.
    - `rtmp_i_receiveaudio()` and `rtmp_i_receivevideo()` read the flag
      argument with `amf0_boolean_get_value()`, which returns the raw
      union byte. Use `amf0_get_boolean()`, which yields `SWITCH_FALSE`
      unless the argument is an AMF boolean.

diff --git a/src/mod/endpoints/mod_rtmp/rtmp_sig.c b/src/mod/endpoints/mod_rtmp/rtmp_sig.c
index 810647279d..145647b0e5 100644
--- a/src/mod/endpoints/mod_rtmp/rtmp_sig.c
+++ b/src/mod/endpoints/mod_rtmp/rtmp_sig.c
@@ -45,6 +45,13 @@ RTMP_INVOKE_FUNCTION(rtmp_i_connect)
 	amf0_data *object1 = amf0_object_new(), *object2 = amf0_object_new(), *params = argv[0], *d;
 	const char *s;

+	/* amf0_object_get() walks the node list without checking the AMF type; only
+	   an object or ECMA array stores its contents that way. Drop any other type
+	   so the lookups return nothing instead of misreading the union. */
+	if (params && params->type != AMF0_TYPE_OBJECT && params->type != AMF0_TYPE_ECMA_ARRAY) {
+		params = NULL;
+	}
+
 	if ((d = amf0_object_get(params, "app")) && (s = amf0_get_string(d))) {
 		rsession->app = switch_core_strdup(rsession->pool, s);
 	}
@@ -158,7 +165,7 @@ RTMP_INVOKE_FUNCTION(rtmp_i_noop)

 RTMP_INVOKE_FUNCTION(rtmp_i_receiveaudio)
 {
-		switch_bool_t enabled = argv[1] ? amf0_boolean_get_value(argv[1]) : SWITCH_FALSE;
+		switch_bool_t enabled = amf0_get_boolean(argv[1]);

 		if (enabled) {
 			switch_set_flag(rsession, SFLAG_AUDIO);
@@ -173,7 +180,7 @@ RTMP_INVOKE_FUNCTION(rtmp_i_receiveaudio)

 RTMP_INVOKE_FUNCTION(rtmp_i_receivevideo)
 {
-		switch_bool_t enabled = argv[1] ? amf0_boolean_get_value(argv[1]) : SWITCH_FALSE;
+		switch_bool_t enabled = amf0_get_boolean(argv[1]);

 		if (enabled) {
 			switch_set_flag(rsession, SFLAG_VIDEO);