Three things in media/sdp/sdp.go, all reachable from a body a remote peer sends.
ConnectionInformation returns the session-level c=. It reads sd.Value("c"), which is the first one, so a c= in the media section does not override the session-level one as RFC 4566 section 5.7 requires. Both callers in media/media_session.go use that address as the RTP destination, so against a peer whose media section carries its own c= the RTP goes to the signalling host.
fields[1] and fields[2] are indexed unchecked. A truncated c= line panics. Reachable from any remote body, with no recover on the path.
nextLine tests line[lenline-2] without a length check. A bare LF line arrives as a 1-byte string and indexes -1.
Fix: take the last c= rather than the first, and bound both indexings.
Taking the last c= is only sound while the body carries a single m= line, since line order alone cannot bind a c= to its section. MediaDescription already rejects multi-m= bodies after 9f38abc; ConnectionInformation now rejects them too rather than answering with an address that may belong to another stream.
Note the nextLine guard: webrtc-pion already carries an equivalent one, so if that branch is landing you may want only the ConnectionInformation half of this.
Three things in media/sdp/sdp.go, all reachable from a body a remote peer sends.
ConnectionInformation returns the session-level c=. It reads sd.Value("c"), which is the first one, so a c= in the media section does not override the session-level one as RFC 4566 section 5.7 requires. Both callers in media/media_session.go use that address as the RTP destination, so against a peer whose media section carries its own c= the RTP goes to the signalling host.
fields[1] and fields[2] are indexed unchecked. A truncated c= line panics. Reachable from any remote body, with no recover on the path.
nextLine tests line[lenline-2] without a length check. A bare LF line arrives as a 1-byte string and indexes -1.
Fix: take the last c= rather than the first, and bound both indexings.
Taking the last c= is only sound while the body carries a single m= line, since line order alone cannot bind a c= to its section. MediaDescription already rejects multi-m= bodies after 9f38abc; ConnectionInformation now rejects them too rather than answering with an address that may belong to another stream.
Note the nextLine guard: webrtc-pion already carries an equivalent one, so if that branch is landing you may want only the ConnectionInformation half of this.