From d1e39735e2515cc18c3791228a5fa0050fdcfd48 Mon Sep 17 00:00:00 2001 From: David Chen Date: Fri, 28 Aug 2026 20:27:11 -0700 Subject: [PATCH] Validate FlexFEC payload type range --- pkg/rtc/mediaengine.go | 4 ++++ pkg/rtc/transport_fec_test.go | 4 ++++ 2 files changed, 8 insertions(+) diff --git a/pkg/rtc/mediaengine.go b/pkg/rtc/mediaengine.go index b148054c6..8139630f5 100644 --- a/pkg/rtc/mediaengine.go +++ b/pkg/rtc/mediaengine.go @@ -53,6 +53,10 @@ func isFlexFEC03MimeType(mimeType string) bool { // validateFlexFECPayloadType ensures the configured flexfec payload type does // not collide with any known codec payload type or its RTX (pt+1) slot. func validateFlexFECPayloadType(payloadType uint8) error { + if payloadType > 127 { + return fmt.Errorf("flexfec payload type %d is outside the RTP payload type range 0-127", payloadType) + } + pt := webrtc.PayloadType(payloadType) for _, codec := range protoCodecs.VideoCodecsParameters { if pt == codec.PayloadType || pt == codec.PayloadType+1 { diff --git a/pkg/rtc/transport_fec_test.go b/pkg/rtc/transport_fec_test.go index a311c32f3..dd25c4af9 100644 --- a/pkg/rtc/transport_fec_test.go +++ b/pkg/rtc/transport_fec_test.go @@ -78,6 +78,10 @@ a=ssrc:1111 cname:test func TestFlexFECPayloadTypeValidation(t *testing.T) { assert.NoError(t, validateFlexFECPayloadType(115)) + // upper boundary of the 7-bit RTP payload type field + assert.NoError(t, validateFlexFECPayloadType(127)) + assert.Error(t, validateFlexFECPayloadType(128)) + assert.Error(t, validateFlexFECPayloadType(255)) // VP8 payload type assert.Error(t, validateFlexFECPayloadType(96)) // RTX slot of VP8 (pt+1)