From 7f1c175a3876fe5cdc2e37f173ae6b651c410dde Mon Sep 17 00:00:00 2001
From: Raja Subramanian <raja.gobi@tutanota.com>
Date: Tue, 11 Aug 2026 12:04:19 +0530
Subject: [PATCH] Check layer value in dependency descriptor and keep it in
 bounds. (#4739)

---
 pkg/sfu/buffer/fps.go                     | 12 +++++++++++-
 pkg/sfu/streamtracker/streamtracker_dd.go |  4 +++-
 2 files changed, 14 insertions(+), 2 deletions(-)

diff --git a/pkg/sfu/buffer/fps.go b/pkg/sfu/buffer/fps.go
index 070d9ae7e..9ac69cd8f 100644
--- a/pkg/sfu/buffer/fps.go
+++ b/pkg/sfu/buffer/fps.go
@@ -356,7 +356,17 @@ func (f *FrameRateCalculatorDD) Completed() bool {
 }
 
 func (f *FrameRateCalculatorDD) SetMaxLayer(spatial, temporal int32) {
-	f.maxSpatial, f.maxTemporal = spatial, temporal
+	if spatial <= DefaultMaxLayerSpatial {
+		f.maxSpatial = spatial
+	} else {
+		f.logger.Warnw("max spatial layer out of range", nil, "spatial", spatial)
+	}
+
+	if temporal <= DefaultMaxLayerTemporal {
+		f.maxTemporal = temporal
+	} else {
+		f.logger.Warnw("max temporal layer out of range", nil, "temporal", temporal)
+	}
 }
 
 func (f *FrameRateCalculatorDD) RecvPacket(ep *ExtPacket) bool {
diff --git a/pkg/sfu/streamtracker/streamtracker_dd.go b/pkg/sfu/streamtracker/streamtracker_dd.go
index 1616d72ca..a3ba48a67 100644
--- a/pkg/sfu/streamtracker/streamtracker_dd.go
+++ b/pkg/sfu/streamtracker/streamtracker_dd.go
@@ -215,7 +215,9 @@ func (s *StreamTrackerDependencyDescriptor) Observe(temporalLayer int32, pktSize
 			continue
 		}
 
-		s.bytesForBitrate[dt.Layer.Spatial][dt.Layer.Temporal] += int64(pktSize)
+		if int(dt.Layer.Spatial) < len(s.bytesForBitrate) && int(dt.Layer.Temporal) < len(s.bytesForBitrate[dt.Layer.Spatial]) {
+			s.bytesForBitrate[dt.Layer.Spatial][dt.Layer.Temporal] += int64(pktSize)
+		}
 	}
 
 	s.lock.Unlock()