From a8e2d602cb2faefadaf165b74e05c520c439d753 Mon Sep 17 00:00:00 2001
From: yujitai <atailikec@163.com>
Date: Fri, 1 Dec 2023 10:45:24 +0800
Subject: [PATCH] =?UTF-8?q?RTC:=20=E4=BF=AE=E5=A4=8DTWCC=20feedback=20rtcp?=
 =?UTF-8?q?=E8=A7=A3=E6=9E=90status=20chunk=E9=94=99=E8=AF=AF=E7=9A=84?=
 =?UTF-8?q?=E9=97=AE=E9=A2=98=20(#3059)?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

在解析packet status chunk的时候使用了uint8_t类型的循环变量，如果反馈的包数量超过255，那么解析会陷入循环，出现异常
---
 src/Rtcp/RtcpFCI.cpp | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/Rtcp/RtcpFCI.cpp b/src/Rtcp/RtcpFCI.cpp
index 8ed27670..6fcdcba9 100644
--- a/src/Rtcp/RtcpFCI.cpp
+++ b/src/Rtcp/RtcpFCI.cpp
@@ -432,7 +432,7 @@ FCI_TWCC::TwccPacketStatus FCI_TWCC::getPacketChunkList(size_t total_size) const
     CHECK(ptr < end);
     auto seq = getBaseSeq();
     auto rtp_count = getPacketCount();
-    for (uint8_t i = 0; i < rtp_count;) {
+    for (uint16_t i = 0; i < rtp_count;) {
         CHECK(ptr + RunLengthChunk::kSize <= end);
         RunLengthChunk *chunk = (RunLengthChunk *)ptr;
         if (!chunk->type) {