diff --git a/modules/rtp_rtcp/source/rtp_packet.cc b/modules/rtp_rtcp/source/rtp_packet.cc index 27c940ce49..3d86a8c47f 100644 --- a/modules/rtp_rtcp/source/rtp_packet.cc +++ b/modules/rtp_rtcp/source/rtp_packet.cc @@ -165,11 +165,13 @@ void RtpPacket::ZeroMutableExtensions() { break; } case RTPExtensionType::kRtpExtensionVideoTiming: { - // Nullify 3 last entries: packetization delay and 2 network timestamps. - // Each of them is 2 bytes. - memset( - WriteAt(extension.offset + VideoSendTiming::kPacerExitDeltaOffset), - 0, 6); + // Nullify last entries, starting at pacer delay. + // These are set by pacer and SFUs + if (VideoSendTiming::kPacerExitDeltaOffset < extension.length) { + memset(WriteAt(extension.offset + + VideoSendTiming::kPacerExitDeltaOffset), + 0, extension.length - VideoSendTiming::kPacerExitDeltaOffset); + } break; } case RTPExtensionType::kRtpExtensionTransportSequenceNumber: diff --git a/test/fuzzers/rtp_packet_fuzzer.cc b/test/fuzzers/rtp_packet_fuzzer.cc index e256eec963..25fec2c094 100644 --- a/test/fuzzers/rtp_packet_fuzzer.cc +++ b/test/fuzzers/rtp_packet_fuzzer.cc @@ -156,5 +156,8 @@ void FuzzOneInput(const uint8_t* data, size_t size) { break; } } + + // Check that zero-ing mutable extensions wouldn't cause any problems. + packet.ZeroMutableExtensions(); } } // namespace webrtc