From 0ea715ae6f5beb80bdb160c2e8f161f3027e08d5 Mon Sep 17 00:00:00 2001 From: Kevin Caffrey Date: Thu, 6 Aug 2026 14:02:33 -0400 Subject: [PATCH 1/2] Fix SLI feedback type `unmarshal()` in packet.go correctly uses `TypePayloadSpecificFeedback` for `SliceLossIndication` messages, but both the `Marshal` and `Unmarshal` for `SliceLossIndication` use `TypeTransportSpecificFeedback`. This makes it impossible to unmarshal a SLI message, as we will correctly only attempt to unmarshal when type is 206, but the unmarshal implementation in slice_loss_indication.go looks for type=205. RFC 4585 section 6.3.2 states that the packet type must be PSFB (defined as 206 in section 6.1). While SLI is no longer implemented in libwebrtc, when it was it was defined as having a packet type of PSFB (206). --- slice_loss_indication.go | 4 ++-- slice_loss_indication_test.go | 6 +++--- 2 files changed, 5 insertions(+), 5 deletions(-) diff --git a/slice_loss_indication.go b/slice_loss_indication.go index 66eda54..52e7cc4 100644 --- a/slice_loss_indication.go +++ b/slice_loss_indication.go @@ -76,7 +76,7 @@ func (p *SliceLossIndication) Unmarshal(rawPacket []byte) error { return errPacketTooShort } - if header.Type != TypeTransportSpecificFeedback || header.Count != FormatSLI { + if header.Type != TypePayloadSpecificFeedback || header.Count != FormatSLI { return errWrongType } @@ -103,7 +103,7 @@ func (p *SliceLossIndication) MarshalSize() int { func (p *SliceLossIndication) Header() Header { return Header{ Count: FormatSLI, - Type: TypeTransportSpecificFeedback, + Type: TypePayloadSpecificFeedback, Length: uint16((p.MarshalSize() / 4) - 1), //nolint:gosec // G115 } } diff --git a/slice_loss_indication_test.go b/slice_loss_indication_test.go index 817fe33..dd48d9f 100644 --- a/slice_loss_indication_test.go +++ b/slice_loss_indication_test.go @@ -22,7 +22,7 @@ func TestSliceLossIndicationUnmarshal(t *testing.T) { Name: "valid", Data: []byte{ // SliceLossIndication - 0x82, 0xcd, 0x0, 0x3, + 0x82, 0xce, 0x0, 0x3, // sender=0x902f9e2e 0x90, 0x2f, 0x9e, 0x2e, // media=0x902f9e2e @@ -39,7 +39,7 @@ func TestSliceLossIndicationUnmarshal(t *testing.T) { { Name: "short report", Data: []byte{ - 0x81, 0xcd, 0x0, 0x2, + 0x81, 0xce, 0x0, 0x2, // ssrc=0x902f9e2e 0x90, 0x2f, 0x9e, 0x2e, // report ends early @@ -115,7 +115,7 @@ func TestSliceLossIndicationRoundTrip(t *testing.T) { func TestSliceLossIndicationUnmarshalMaxLength(t *testing.T) { rawPacket := make([]byte, 4*(0xFFFF+1)) rawPacket[0] = 0x82 - rawPacket[1] = 0xcd + rawPacket[1] = 0xce rawPacket[2] = 0xff rawPacket[3] = 0xff From b65b27228e14a427386c04e3ff07d361c552fc11 Mon Sep 17 00:00:00 2001 From: Kevin Caffrey Date: Thu, 6 Aug 2026 15:44:09 -0400 Subject: [PATCH 2/2] Fix SLI length check SLI Unmarshal was previously unreachable, but now panics on bad input. Fix the length check to avoid the panic. --- slice_loss_indication.go | 2 +- testdata/fuzz/FuzzUnmarshal/0e87471a44c119a6 | 2 ++ 2 files changed, 3 insertions(+), 1 deletion(-) create mode 100644 testdata/fuzz/FuzzUnmarshal/0e87471a44c119a6 diff --git a/slice_loss_indication.go b/slice_loss_indication.go index 52e7cc4..fa2762b 100644 --- a/slice_loss_indication.go +++ b/slice_loss_indication.go @@ -63,7 +63,7 @@ func (p SliceLossIndication) Marshal() ([]byte, error) { // Unmarshal decodes the SliceLossIndication from binary. func (p *SliceLossIndication) Unmarshal(rawPacket []byte) error { - if len(rawPacket) < (headerLength + ssrcLength) { + if len(rawPacket) < (headerLength + (ssrcLength * 2)) { return errPacketTooShort } diff --git a/testdata/fuzz/FuzzUnmarshal/0e87471a44c119a6 b/testdata/fuzz/FuzzUnmarshal/0e87471a44c119a6 new file mode 100644 index 0000000..e019550 --- /dev/null +++ b/testdata/fuzz/FuzzUnmarshal/0e87471a44c119a6 @@ -0,0 +1,2 @@ +go test fuzz v1 +[]byte("\x82\xce\x00\x010000")