From: Michael Froman <mfroman@mozilla.com>
Date: Mon, 6 Apr 2026 21:43:00 +0000
Subject: Bug 2027499 - adhere to spec on number of CSRCs in rtp packets. r=bwc

Differential Revision: https://phabricator.services.mozilla.com/D291629
Mercurial Revision: https://hg.mozilla.org/mozilla-central/rev/ccdaaef4f2b19d4a849d5a6f1e4aedba392c0f91
---
 modules/rtp_rtcp/source/rtp_packet.cc | 11 +++++++++--
 modules/rtp_rtcp/source/rtp_packet.h  |  9 ++++++++-
 2 files changed, 17 insertions(+), 3 deletions(-)

diff --git a/modules/rtp_rtcp/source/rtp_packet.cc b/modules/rtp_rtcp/source/rtp_packet.cc
index 034fcd225f..12aae063d6 100644
--- a/modules/rtp_rtcp/source/rtp_packet.cc
+++ b/modules/rtp_rtcp/source/rtp_packet.cc
@@ -224,20 +224,27 @@ void RtpPacket::ZeroMutableExtensions() {
   }
 }
 
-void RtpPacket::SetCsrcs(ArrayView<const uint32_t> csrcs) {
+void RtpPacket::SetCsrcs(std::span<const uint32_t> csrcs) {
   RTC_DCHECK_EQ(extensions_size_, 0);
   RTC_DCHECK_EQ(payload_size_, 0);
   RTC_DCHECK_EQ(padding_size_, 0);
   RTC_DCHECK_LE(csrcs.size(), 0x0fu);
   RTC_DCHECK_LE(kFixedHeaderSize + 4 * csrcs.size(), capacity());
+
+  if (csrcs.size() > kMaxCsrcs) {
+    RTC_LOG(LS_WARNING) << "Truncating CSRC list to spec length " << kMaxCsrcs
+                        << " from " << csrcs.size();
+    csrcs = csrcs.first(kMaxCsrcs);
+  }
+
   payload_offset_ = kFixedHeaderSize + 4 * csrcs.size();
+  buffer_.SetSize(payload_offset_);
   WriteAt(0, (data()[0] & 0xF0) | dchecked_cast<uint8_t>(csrcs.size()));
   size_t offset = kFixedHeaderSize;
   for (uint32_t csrc : csrcs) {
     ByteWriter<uint32_t>::WriteBigEndian(WriteAt(offset), csrc);
     offset += 4;
   }
-  buffer_.SetSize(payload_offset_);
 }
 
 ArrayView<uint8_t> RtpPacket::AllocateRawExtension(int id, size_t length) {
diff --git a/modules/rtp_rtcp/source/rtp_packet.h b/modules/rtp_rtcp/source/rtp_packet.h
index 3d27520b10..e9288a4f5d 100644
--- a/modules/rtp_rtcp/source/rtp_packet.h
+++ b/modules/rtp_rtcp/source/rtp_packet.h
@@ -14,6 +14,7 @@
 #include <cstdint>
 #include <cstring>
 #include <optional>
+#include <span>
 #include <string>
 #include <utility>
 #include <vector>
@@ -30,6 +31,12 @@ class RtpPacket {
   using ExtensionType = RTPExtensionType;
   using ExtensionManager = RtpHeaderExtensionMap;
 
+  // Maximum number of CSRCs in an RTP packet as specified in section
+  // "5.1 RTP Fixed Header Fields" of RFC 3550.
+  // Note: This is a different limit than the one that applies to RTCP packets
+  // (which is specified in section 6.1).
+  static constexpr size_t kMaxCsrcs = 15;
+
   // `extensions` required for SetExtension/ReserveExtension functions during
   // packet creating and used if available in Parse function.
   // Adding and getting extensions will fail until `extensions` is
@@ -118,7 +125,7 @@ class RtpPacket {
   // Writes csrc list. Assumes:
   // a) There is enough room left in buffer.
   // b) Extension headers, payload or padding data has not already been added.
-  void SetCsrcs(ArrayView<const uint32_t> csrcs);
+  void SetCsrcs(std::span<const uint32_t> csrcs);
 
   // Header extensions.
   template <typename Extension>