Guard short TWCC extensions in FEC packets

pkg/sfu/buffer/buffer.go

@@ -468,7 +468,7 @@ func (b *Buffer) writeFEC(fecPkt *rtp.Packet, arrivalTime int64) {
 	// publisher send side BWE sees the FEC packets acked. The repair stream
 	// shares the media m-line, extension ids match the primary stream.
 	if b.twcc != nil && b.twccExtID != 0 {
-		if ext := fecPkt.GetExtension(b.twccExtID); ext != nil {
+		if ext := fecPkt.GetExtension(b.twccExtID); len(ext) >= 2 {
 			b.twcc.Push(fecPkt.SSRC, binary.BigEndian.Uint16(ext[0:2]), arrivalTime, fecPkt.Marker)
 		}
 	}

pkg/sfu/buffer/buffer_fec_test.go

@@ -24,6 +24,8 @@ import (
 	"github.com/pion/webrtc/v4"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
+
+	"github.com/livekit/mediatransportutil/pkg/twcc"
 )
 
 const (
@@ -289,6 +291,32 @@ func TestBufferFECIgnoresUnexpectedPayloadType(t *testing.T) {
 	assert.EqualValues(t, 0, stats.PacketsRecovered)
 }
 
+func TestBufferFECIgnoresShortTWCCExtension(t *testing.T) {
+	factory := NewFactoryOfBufferFactory(500, 200).CreateBufferFactory()
+
+	primary := factory.GetOrNew(packetio.RTPBufferPacket, fecTestMediaSSRC).(*Buffer)
+	fecBuff := factory.GetOrNew(packetio.RTPBufferPacket, fecTestFECSSRC).(*Buffer)
+	factory.SetFECPair(fecTestFECSSRC, fecTestMediaSSRC)
+	bindFECTestBuffer(t, primary)
+
+	const twccExtID = 3
+	primary.SetTWCCAndExtID(twcc.NewTransportWideCCResponder(), twccExtID)
+
+	fecPacket := rtp.Packet{
+		Header: rtp.Header{
+			Version:        2,
+			PayloadType:    fecTestFECPT,
+			SequenceNumber: 1,
+			SSRC:           fecTestFECSSRC,
+		},
+		Payload: []byte{0},
+	}
+	require.NoError(t, fecPacket.SetExtension(twccExtID, []byte{1}))
+
+	writePacket(t, fecBuff, &fecPacket)
+	assert.EqualValues(t, 1, primary.FECDecoderStats().FECPacketsDiscarded)
+}
+
 func TestBufferFECNACKSuppression(t *testing.T) {
 	// a recovered packet must clear the pending NACK for its sequence number
 	factory := NewFactoryOfBufferFactory(500, 200).CreateBufferFactory()