From 3e5545434a7d89928e29303c849f71d352344273 Mon Sep 17 00:00:00 2001
From: Juliusz Chroboczek <jch@irif.fr>
Date: Fri, 6 Jan 2023 22:59:20 +0100
Subject: [PATCH] Handle empty VP8 headers.

Only the first byte of the VP8 header is mandatory, but we
used to reject packets smaller than 4 bytes.  The major part
of the fix is actually in pion/rtp.
---
 codecs/codecs.go      | 33 ++++++++++++++++++++++-----------
 codecs/codecs_test.go | 39 +++++++++++++++++++++++++++++++++++++++
 go.mod                |  2 +-
 go.sum                |  3 ++-
 4 files changed, 64 insertions(+), 13 deletions(-)

diff --git a/codecs/codecs.go b/codecs/codecs.go
index 70628f8..ea5ab4c 100644
--- a/codecs/codecs.go
+++ b/codecs/codecs.go
@@ -233,7 +233,7 @@ type Flags struct {
 	Start           bool
 	End             bool
 	Keyframe        bool
-	Pid             uint16	// only returned for VP8
+	Pid             uint16 // only returned for VP8
 	Tid             uint8
 	Sid             uint8
 	TidUpSync       bool
@@ -243,7 +243,7 @@ type Flags struct {
 }
 
 func PacketFlags(codec string, buf []byte) (Flags, error) {
-	if len(buf) < 12 {
+	if len(buf) < 4 {
 		return Flags{}, errTruncated
 	}
 
@@ -309,7 +309,7 @@ func RewritePacket(codec string, data []byte, setMarker bool, seqno uint16, delt
 		return errTruncated
 	}
 
-	if(setMarker) {
+	if setMarker {
 		data[1] |= 0x80
 	}
 
@@ -321,7 +321,7 @@ func RewritePacket(codec string, data []byte, setMarker bool, seqno uint16, delt
 
 	offset := 12
 	offset += int(data[0]&0x0F) * 4
-	if len(data) < offset+4 {
+	if len(data) <= offset {
 		return errTruncated
 	}
 
@@ -339,19 +339,30 @@ func RewritePacket(codec string, data []byte, setMarker bool, seqno uint16, delt
 		if !x {
 			return nil
 		}
-		i := (data[offset+1] & 0x80) != 0
+		offset++
+		if len(data) <= offset {
+			return errTruncated
+		}
+		i := (data[offset] & 0x80) != 0
 		if !i {
 			return nil
 		}
-		m := (data[offset+2] & 0x80) != 0
+		offset++
+		if len(data) <= offset {
+			return errTruncated
+		}
+		m := (data[offset] & 0x80) != 0
 		if m {
-			pid := (uint16(data[offset+2]&0x7F) << 8) |
-				uint16(data[offset+3])
+			if len(data) <= offset+1 {
+				return errTruncated
+			}
+			pid := (uint16(data[offset]&0x7F) << 8) |
+				uint16(data[offset+1])
 			pid = (pid + delta) & 0x7FFF
-			data[offset+2] = 0x80 | byte((pid>>8)&0x7F)
-			data[offset+3] = byte(pid & 0xFF)
+			data[offset] = 0x80 | byte((pid>>8)&0x7F)
+			data[offset+1] = byte(pid & 0xFF)
 		} else {
-			data[offset+2] = (data[offset+2] + uint8(delta)) & 0x7F
+			data[offset] = (data[offset] + uint8(delta)) & 0x7F
 		}
 		return nil
 	}
diff --git a/codecs/codecs_test.go b/codecs/codecs_test.go
index c276e97..de0c728 100644
--- a/codecs/codecs_test.go
+++ b/codecs/codecs_test.go
@@ -138,6 +138,14 @@ var vp8 = []byte{
 	0, 0, 0, 0,
 }
 
+var emptyVP8 = []byte{
+	0x80, 0, 0, 42,
+	0, 0, 0, 0,
+	0, 0, 0, 0,
+
+	0x00,
+}
+
 func TestPacketFlagsVP8(t *testing.T) {
 	buf := append([]byte{}, vp8...)
 	flags, err := PacketFlags("video/vp8", buf)
@@ -151,6 +159,19 @@ func TestPacketFlagsVP8(t *testing.T) {
 	}
 }
 
+func TestEmptyPacketFlagsVP8(t *testing.T) {
+	buf := append([]byte{}, emptyVP8...)
+	flags, err := PacketFlags("video/vp8", buf)
+	if flags.Seqno != 42 || flags.Start ||
+		flags.Sid != 0 || flags.Tid != 0 ||
+		flags.TidUpSync || flags.Discardable || err != nil {
+		t.Errorf("Got %v, %v, %v, %v, %v, %v (%v)",
+			flags.Seqno, flags.Start, flags.Pid, flags.Sid,
+			flags.TidUpSync, flags.Discardable, err,
+		)
+	}
+}
+
 func TestRewriteVP8(t *testing.T) {
 	for i := uint16(0); i < 0x7fff; i++ {
 		buf := append([]byte{}, vp8...)
@@ -169,6 +190,24 @@ func TestRewriteVP8(t *testing.T) {
 	}
 }
 
+func TestRewriteEmptyVP8(t *testing.T) {
+	for i := uint16(0); i < 0x7fff; i++ {
+		buf := append([]byte{}, emptyVP8...)
+		err := RewritePacket("video/vp8", buf, true, i, i)
+		if err != nil {
+			t.Errorf("rewrite: %v", err)
+			continue
+		}
+		flags, err := PacketFlags("video/vp8", buf)
+		if err != nil || flags.Seqno != i ||
+			!flags.Marker {
+			t.Errorf("Expected %v %v, got %v %v (%v)",
+				i, (57+i)&0x7FFF,
+				flags.Seqno, flags.Pid, err)
+		}
+	}
+}
+
 var vp9 = []byte{
 	0x80, 0, 0, 42,
 	0, 0, 0, 0,
diff --git a/go.mod b/go.mod
index 8c29c03..8740539 100644
--- a/go.mod
+++ b/go.mod
@@ -11,7 +11,7 @@ require (
 	github.com/pion/ice/v2 v2.2.13
 	github.com/pion/interceptor v0.1.12 // indirect
 	github.com/pion/rtcp v1.2.10
-	github.com/pion/rtp v1.7.13
+	github.com/pion/rtp v1.7.14-0.20230109165057-d62c6716b99a
 	github.com/pion/sdp/v3 v3.0.6
 	github.com/pion/srtp/v2 v2.0.11 // indirect
 	github.com/pion/turn/v2 v2.0.9
diff --git a/go.sum b/go.sum
index fb1d4c7..9ae1b55 100644
--- a/go.sum
+++ b/go.sum
@@ -72,8 +72,9 @@ github.com/pion/rtcp v1.2.10 h1:nkr3uj+8Sp97zyItdN60tE/S6vk4al5CPRR6Gejsdjc=
 github.com/pion/rtcp v1.2.10/go.mod h1:ztfEwXZNLGyF1oQDttz/ZKIBaeeg/oWbRYqzBM9TL1I=
 github.com/pion/rtp v1.7.0/go.mod h1:bDb5n+BFZxXx0Ea7E5qe+klMuqiBrP+w8XSjiWtCUko=
 github.com/pion/rtp v1.7.2/go.mod h1:bDb5n+BFZxXx0Ea7E5qe+klMuqiBrP+w8XSjiWtCUko=
-github.com/pion/rtp v1.7.13 h1:qcHwlmtiI50t1XivvoawdCGTP4Uiypzfrsap+bijcoA=
 github.com/pion/rtp v1.7.13/go.mod h1:bDb5n+BFZxXx0Ea7E5qe+klMuqiBrP+w8XSjiWtCUko=
+github.com/pion/rtp v1.7.14-0.20230109165057-d62c6716b99a h1:2dsmWw+LyKy+4pgeXJeTyErucwsAP9QnrC0eao2UP2Q=
+github.com/pion/rtp v1.7.14-0.20230109165057-d62c6716b99a/go.mod h1:bDb5n+BFZxXx0Ea7E5qe+klMuqiBrP+w8XSjiWtCUko=
 github.com/pion/sctp v1.7.10/go.mod h1:EhpTUQu1/lcK3xI+eriS6/96fWetHGCvBi9MSsnaBN0=
 github.com/pion/sctp v1.7.12/go.mod h1:xFe9cLMZ5Vj6eOzpyiKjT9SwGM4KpK/8Jbw5//jc+0s=
 github.com/pion/sctp v1.8.5 h1:JCc25nghnXWOlSn3OVtEnA9PjQ2JsxQbG+CXZ1UkJKQ=