[EnriqueWood]

Description

Bound requests on the two GameStream servers to 64 KiB and give them an on_error handler, before routing or authentication. GameStream requests carry everything in the query string, including the pairing certificate, and have no body.

With the pinned Simple-Web-Server, a chunked request cut short after its chunk data reaches an unchecked on_error call and throws std::bad_function_call out of the server thread, which aborts Sunshine. Setting the handler avoids that until the library fix lands.

The dependency fixes that were part of this PR at first went upstream instead:

• MiniUPnPc: I asked for a release with the minixml fixes in miniupnpc: new release with the minixml out-of-bounds read fixes? miniupnp/miniupnp#953
• Simple-Web-Server: the two parser fixes are in https://gitlab.com/eidheim/Simple-Web-Server/-/merge_requests/286
• Simple-Web-Server: an option to refuse request bodies is in https://gitlab.com/eidheim/Simple-Web-Server/-/merge_requests/287

Screenshot

Issues Fixed or Closed

Roadmap Issues

Testing

• Added four loopback regressions in tests/unit/test_http_request_limits.cpp: a truncated chunk in one read and split over two reads, a 64 KiB header next to a pairing-sized query, and a body over the limit.
• Built test_sunshine on Fedora 44 with GCC 16.2.1 (Release, BUILD_WERROR=ON). The four tests pass, and all four fail without the settings in configure_gamestream_server.
• The rest of the suite passes, except four suites that can't set up inside my container (X11 grab, audio, mouse HID, encoder).
• Ran clang-format 23.1.0 on the three files.
• Ran a host built from this branch (Nobara, KDE Wayland) with Moonlight 6.2.0 on Windows: pairing, app list and launch work, and a 720p H.264 stream with the software encoder had video and audio.
• On that host, a chunked request cut short on the plain HTTP port closes its connection and /serverinfo keeps answering. The same tree without the settings in configure_gamestream_server aborts the process on that request.

Type of Change

• feat: New feature (non-breaking change which adds functionality)
• fix: Bug fix (non-breaking change which fixes an issue)
• docs: Documentation only changes
• style: Changes that do not affect the meaning of the code (white-space, formatting, missing semicolons, etc.)
• refactor: Code change that neither fixes a bug nor adds a feature
• perf: Code change that improves performance
• test: Adding missing tests or correcting existing tests
• build: Changes that affect the build system or external dependencies
• ci: Changes to CI configuration files and scripts
• chore: Other changes that don't modify src or test files
• revert: Reverts a previous commit
• BREAKING CHANGE: Introduces a breaking change (can be combined with any type above)

Checklist

• Code follows the style guidelines of this project
• Code has been self-reviewed
• Code has been commented, particularly in hard-to-understand areas
• Code docstring/documentation-blocks for new or existing methods/components have been added or updated
• Tests have been added or updated for new or modified functionality, including regression tests for bug fixes

AI Usage

See our AI usage policy.

• AI tools were used while preparing this PR

[ReenigneArcher]

Thanks for investigating these fixes and adding regression coverage. I don't want Sunshine to maintain dependency backports; please take an upstream-first approach here:

• MiniUPnPc: Please ask upstream for a client release containing both XML bounds fixes linked in this PR, then update the Flatpak dependency to that release instead of carrying miniupnpc-minixml-bounds.patch or pinning an unreleased commit.
• Simple-Web-Server: Please submit the generic parser fixes upstream and link that submission here. Once accepted, update the submodule to a revision containing the fixes rather than carrying the patches and build-tree patching machinery in Sunshine.

Sunshine-specific request limits and GameStream policy can remain in Sunshine, with the regression coverage retained. This is feedback on the dependency-maintenance approach, not a claim that the fixes themselves are incorrect or that full integration testing has passed.

_{Review completed by Codex | Model: unavailable | Thinking: unavailable}

[EnriqueWood]

Thanks for the review, that makes sense. I went upstream first and trimmed this PR.

• MiniUPnPc: I asked for a release in miniupnpc: new release with the minixml out-of-bounds read fixes? miniupnp/miniupnp#953. master has three minixml fixes after 2.3.3 by now (the two linked here plus miniupnp/miniupnp@42965d7), and there is no tag with them yet. The Flatpak patch is gone from this PR.
• Simple-Web-Server: I sent the two parser fixes with tests in https://gitlab.com/eidheim/Simple-Web-Server/-/merge_requests/286. The patches, the build-tree copy and the CMake changes are gone too.

What's left is Sunshine's own part: the 64 KiB limit on GameStream requests and an on_error handler on the two GameStream servers. With the current submodule that handler is also what keeps a truncated chunked request from stopping them.

Two things from the first version are not in this one:

• Rejecting request bodies on the GameStream ports needs a new option in Simple-Web-Server. I sent that separately in https://gitlab.com/eidheim/Simple-Web-Server/-/merge_requests/287. Until then, bodies are bounded by the same 64 KiB limit.
• The chunk size overflow can only be fixed in the library, so it stays until the submodule moves.

I rebased on master and built test_sunshine on Fedora 44 with GCC 16.2.1. The 4 new tests pass, and all 4 fail if I take the two settings out of configure_gamestream_server. The rest of the suite passes, except four suites that can't set up inside my container (X11 grab, audio, mouse HID, encoder).

I also ran a host built from this branch next to my installed one and used Moonlight 6.2.0 on Windows against it: pairing, the app list and launching work as before, and a 720p H.264 stream with the software encoder had video and audio. On the same host, a chunked request cut short on the plain HTTP port just closes that connection. The same tree without the two settings aborts the whole process on that one request (std::bad_function_call).

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud