diff --git a/3rdpart/ZLToolKit b/3rdpart/ZLToolKit
index d2016522..a4b8b5e0 160000
--- a/3rdpart/ZLToolKit
+++ b/3rdpart/ZLToolKit
@@ -1 +1 @@
-Subproject commit d2016522a0e4b1d8df51a78b7415fe148f7245ca
+Subproject commit a4b8b5e00aac6251254a513c7759605c0ba35f90
diff --git a/server/WebApi.cpp b/server/WebApi.cpp
index 11e06ea1..6f40403d 100755
--- a/server/WebApi.cpp
+++ b/server/WebApi.cpp
@@ -537,7 +537,7 @@ void addStreamProxy(const string &vhost, const string &app, const string &stream
     lock_guard<recursive_mutex> lck(s_proxyMapMtx);
     if (s_proxyMap.find(key) != s_proxyMap.end()) {
         //已经在拉流了
-        cb(SockException(Err_success), key);
+        cb(SockException(Err_other, "This stream already exists"), key);
         return;
     }
     //添加拉流代理
diff --git a/src/Http/HttpFileManager.cpp b/src/Http/HttpFileManager.cpp
index 3ec4d40c..66e5f7fa 100644
--- a/src/Http/HttpFileManager.cpp
+++ b/src/Http/HttpFileManager.cpp
@@ -524,7 +524,7 @@ static void accessFile(Session &sender, const Parser &parser, const MediaInfo &m
     });
 }
 
-static string getFilePath(const Parser &parser,const MediaInfo &media_info, Session &sender){
+static string getFilePath(const Parser &parser,const MediaInfo &media_info, Session &sender) {
     GET_CONFIG(bool, enableVhost, General::kEnableVhost);
     GET_CONFIG(string, rootPath, Http::kRootPath);
     GET_CONFIG_FUNC(StrCaseMap, virtualPathMap, Http::kVirtualPath, [](const string &str) {
@@ -549,6 +549,13 @@ static string getFilePath(const Parser &parser,const MediaInfo &media_info, Sess
         }
     }
     auto ret = File::absolutePath(enableVhost ? media_info.vhost + url : url, path);
+    auto http_root = File::absolutePath(enableVhost ? media_info.vhost + "/" : "/", path);
+    if (!start_with(ret, http_root)) {
+        // 访问的http文件不得在http根目录之外
+        throw std::runtime_error("Attempting to access files outside of the http root directory");
+    }
+    // 替换url，防止返回的目录索引网页被注入非法内容
+    const_cast<Parser&>(parser).setUrl("/" + ret.substr(http_root.size()));
     NoticeCenter::Instance().emitEvent(Broadcast::kBroadcastHttpBeforeAccess, parser, ret, static_cast<SockInfo &>(sender));
     return ret;
 }
diff --git a/src/Record/MP4Reader.cpp b/src/Record/MP4Reader.cpp
index 5c144d2e..2def3781 100644
--- a/src/Record/MP4Reader.cpp
+++ b/src/Record/MP4Reader.cpp
@@ -184,8 +184,10 @@ bool MP4Reader::speed(MediaSource &sender, float speed) {
         WarnL << "播放速度取值范围非法:" << speed;
         return false;
     }
-    //设置播放速度后应该恢复播放
-    pause(sender, false);
+    //_seek_ticker重置，赋值_seek_to
+    setCurrentStamp(getCurrentStamp());
+    // 设置播放速度后应该恢复播放
+    _paused = false;
     if (_speed == speed) {
         return true;
     }
diff --git a/src/Rtsp/Rtsp.cpp b/src/Rtsp/Rtsp.cpp
index b5b50360..579a881e 100644
--- a/src/Rtsp/Rtsp.cpp
+++ b/src/Rtsp/Rtsp.cpp
@@ -8,12 +8,13 @@
  * may be found in the AUTHORS file in the root of the source tree.
  */
 
+#include <cstdlib>
+#include <cinttypes>
+#include <random>
 #include "Rtsp.h"
 #include "Common/Parser.h"
 #include "Common/config.h"
 #include "Network/Socket.h"
-#include <cinttypes>
-#include <cstdlib>
 
 using namespace std;
 using namespace toolkit;
@@ -392,9 +393,13 @@ public:
 
 private:
     void setRange(uint16_t start_pos, uint16_t end_pos) {
+        std::mt19937 rng(std::random_device {}());
         lock_guard<recursive_mutex> lck(_pool_mtx);
+        auto it = _port_pair_pool.begin();
         while (start_pos < end_pos) {
-            _port_pair_pool.emplace_back(start_pos++);
+            // 随机端口排序，防止重启后导致分配的端口重复
+            _port_pair_pool.insert(it, start_pos++);
+            it = _port_pair_pool.begin() + (rng() % (1 + _port_pair_pool.size()));
         }
     }
 
diff --git a/src/Rtsp/RtspPlayer.cpp b/src/Rtsp/RtspPlayer.cpp
index 599677ec..676d89b1 100644
--- a/src/Rtsp/RtspPlayer.cpp
+++ b/src/Rtsp/RtspPlayer.cpp
@@ -483,6 +483,11 @@ void RtspPlayer::handleResPAUSE(const Parser &parser, int type) {
 }
 
 void RtspPlayer::onWholeRtspPacket(Parser &parser) {
+    if (!start_with(parser.method(), "RTSP")) {
+        // 不是rtsp回复，忽略
+        WarnL << "Not rtsp response: " << parser.method();
+        return;
+    }
     try {
         decltype(_on_response) func;
         _on_response.swap(func);
diff --git a/src/Rtsp/UDPServer.cpp b/src/Rtsp/UDPServer.cpp
index 4f648ddf..bb9e4642 100644
--- a/src/Rtsp/UDPServer.cpp
+++ b/src/Rtsp/UDPServer.cpp
@@ -82,10 +82,12 @@ void UDPServer::onRecv(int interleaved, const Buffer::Ptr &buf, struct sockaddr*
         return;
     }
     auto &ref = it0->second;
-    for (auto it1 = ref.begin(); it1 != ref.end(); ++it1) {
+    for (auto it1 = ref.begin(); it1 != ref.end();) {
         auto &func = it1->second;
         if (!func(interleaved, buf, peer_addr)) {
             it1 = ref.erase(it1);
+        } else {
+            ++it1;
         }
     }
     if (ref.size() == 0) {
diff --git a/www/webrtc/index.html b/www/webrtc/index.html
index 269ae9b2..a340f0c1 100644
--- a/www/webrtc/index.html
+++ b/www/webrtc/index.html
@@ -322,7 +322,7 @@
         json.then((json)=> fillStreamList(json));
       }
       setInterval(() => {
-       get_media_list(); 
+       // get_media_list();
       }, 5000);
 
     </script>