mediasoup 3.21.2 → 3.23.0

package/worker/fbs/transport.fbs

@@ -130,6 +130,7 @@ table Options {
     sctp_send_buffer_size: uint32;
     sctp_per_stream_send_queue_limit: uint32;
     sctp_max_receiver_window_buffer_size: uint32;
+    sctp_default_stream_buffered_amount_low_threshold: uint32;
     is_data_channel: bool = false;
 }
 

package/worker/fuzzer/src/RTC/RTP/FuzzerPacket.cpp

@@ -254,4 +254,48 @@ void FuzzerRtcRtcPacket::Fuzz(const uint8_t* data, size_t len)
 	packet->RemoveHeaderExtension();
 	packet->SetPayloadLength(sizeof(payload) - 2);
 	packet->RemovePayload();
+
+	// Regression test for GHSA-jhm4-v227-4375 (CWE-787 OOB write in
+	// UpdateDependencyDescriptor()). Build a fresh packet with a tightly-sized
+	// DEPENDENCY_DESCRIPTOR value and attempt to update it with the raw fuzzer
+	// input as the new descriptor bytes. When the new length exceeds the original
+	// the fixed code must return false without writing out of bounds; when it
+	// fits it must succeed. AddressSanitizer will catch any regression here.
+	{
+		constexpr size_t BufferLenght{ 512 };
+		static thread_local uint8_t buffer[BufferLenght];
+
+		std::unique_ptr<RTC::RTP::Packet> packet{ RTC::RTP::Packet::Factory(buffer, BufferLenght) };
+
+		if (!packet)
+		{
+			return;
+		}
+
+		// Use the first byte of the fuzzer input to pick the slot size
+		// (1..15 is the valid One-Byte extension range).
+		const uint8_t extenLen = (data[0] % 15u) + 1u;
+
+		static thread_local uint8_t extenValue[15];
+
+		// clang-format off
+		const std::vector<RTC::RTP::Packet::Extension> extensions {
+			{
+				RTC::RtpHeaderExtensionUri::Type::DEPENDENCY_DESCRIPTOR,
+				static_cast<uint8_t>(RTC::RtpHeaderExtensionUri::Type::DEPENDENCY_DESCRIPTOR),
+				extenLen,
+				extenValue
+			}
+		};
+		// clang-format off
+
+		packet->SetExtensions(RTC::RTP::Packet::ExtensionsType::OneByte, extensions);
+
+		// Call UpdateDependencyDescriptor() with the full fuzzer input as
+		// the replacement bytes. This covers:
+		//   len > slotLen  → no OOB write (was the bug).
+		//   len <= slotLen → in-place update.
+		//   len == 0       → must not crash.
+		packet->UpdateDependencyDescriptor(data, len);
+	}
 }

package/worker/include/RTC/DataConsumer.hpp

@@ -49,7 +49,8 @@ namespace RTC
 		  const std::string& dataProducerId,
 		  RTC::DataConsumer::Listener* listener,
 		  const FBS::Transport::ConsumeDataRequest* data,
-		  size_t maxMessageSize);
+		  size_t maxMessageSize,
+		  bool pipe);
 		~DataConsumer() override;
 
 	public:
@@ -67,20 +68,17 @@ namespace RTC
 		}
 		bool IsActive() const
 		{
-			// It's active it DataConsumer and DataProducer are not paused and the transport
-			// is connected.
+			// It's active it DataConsumer and DataProducer are not paused and the SCTP
+			// association (if any) is not closed.
 			// clang-format off
 			return (
-				this->transportConnected &&
-				(this->type == DataConsumer::Type::DIRECT || this->sctpAssociationConnected) &&
+				(this->type == DataConsumer::Type::DIRECT || !this->sctpAssociationClosed) &&
 				!this->paused &&
 				!this->dataProducerPaused &&
 				!this->dataProducerClosed
 			);
 			// clang-format on
 		}
-		void TransportConnected();
-		void TransportDisconnected();
 		bool IsPaused() const
 		{
 			return this->paused;
@@ -91,7 +89,6 @@ namespace RTC
 		}
 		void DataProducerPaused();
 		void DataProducerResumed();
-		void SctpAssociationConnected();
 		void SctpAssociationClosed();
 		void SctpBufferedAmountLow(uint32_t bufferedAmount) const;
 		void SctpSendBufferFull() const;
@@ -116,14 +113,14 @@ namespace RTC
 		SharedInterface* shared{ nullptr };
 		RTC::DataConsumer::Listener* listener{ nullptr };
 		size_t maxMessageSize{ 0u };
+		bool pipe{ false };
 		// Others.
 		Type type;
 		RTC::SctpStreamParameters sctpStreamParameters;
 		std::string label;
 		std::string protocol;
 		ankerl::unordered_dense::set<uint16_t> subchannels;
-		bool transportConnected{ false };
-		bool sctpAssociationConnected{ false };
+		bool sctpAssociationClosed{ false };
 		bool paused{ false };
 		bool dataProducerPaused{ false };
 		bool dataProducerClosed{ false };

package/worker/include/RTC/PipeTransport.hpp

@@ -41,6 +41,10 @@ namespace RTC
 
 	private:
 		bool IsConnected() const override;
+		bool IsPipe() const override
+		{
+			return true;
+		}
 		bool HasSrtp() const;
 		void SendRtpPacket(
 		  RTC::Consumer* consumer,

package/worker/include/RTC/SCTP/public/Message.hpp

@@ -68,6 +68,22 @@ namespace RTC
 				return this->payload.size();
 			}
 
+			/**
+			 * Replace the whole payload of the message.
+			 */
+			void SetPayload(std::vector<uint8_t> payload)
+			{
+				this->payload = std::move(payload);
+			}
+
+			/**
+			 * Remove the first `len` bytes from the beginning of the payload.
+			 */
+			void RemovePayloadFront(size_t len)
+			{
+				this->payload.erase(this->payload.begin(), this->payload.begin() + len);
+			}
+
 			/**
 			 * Useful to extract the payload and its ownership when destructing the
 			 * message.

package/worker/include/RTC/SCTP/public/SctpOptions.hpp

@@ -83,6 +83,13 @@ namespace RTC
 			 */
 			size_t maxReceiverWindowBufferSize{ 5 * 1024 * 1024 };
 
+			/**
+			 * The default threshold that, when the amount of data in a stream send
+			 * buffer goes below this value, will trigger
+			 * `Association::OnAssociationStreamBufferedAmountLow()`.
+			 */
+			size_t defaultStreamBufferedAmountLowThreshold{ 0 };
+
 			/**
 			 * A threshold that, when the amount of data in the send buffer goes below
 			 * this value, will trigger `Association::OnAssociationTotalBufferedAmountLow()`.

package/worker/include/RTC/SCTP/tx/RoundRobinSendQueue.hpp

@@ -275,6 +275,7 @@ namespace RTC
 			  AssociationListenerInterface& associationListener,
 			  size_t mtu,
 			  uint16_t defaultPriority,
+			  size_t defaultStreamBufferedAmountLowThreshold,
 			  size_t totalBufferedAmountLowThreshold);
 
 			~RoundRobinSendQueue() override;
@@ -343,6 +344,7 @@ namespace RTC
 		private:
 			AssociationListenerInterface& associationListener;
 			const uint16_t defaultPriority;
+			const size_t defaultStreamBufferedAmountLowThreshold;
 			StreamScheduler scheduler;
 			// The total amount of buffer data, for all streams.
 			ThresholdWatcher totalBufferedAmountThresholdWatcher;

package/worker/include/RTC/SubchannelsCodec.hpp

@@ -0,0 +1,76 @@
+#ifndef MS_RTC_SUBCHANNELS_CODEC_HPP
+#define MS_RTC_SUBCHANNELS_CODEC_HPP
+
+#include "common.hpp"
+#include "RTC/SCTP/public/Message.hpp"
+#include <vector>
+
+namespace RTC
+{
+	/**
+	 * Helper to (optionally) encode/decode subchannels and required subchannel at
+	 * the beginning of an SCTP message payload so that this information travels
+	 * within the SCTP message itself.
+	 */
+	class SubchannelsCodec
+	{
+		/**
+		 * Wire layout of the encoded header prepended to the message payload (all
+		 * fields in network byte order). `R` is the `requiredSubchannelFlag`, i.e.
+		 * the least significant bit of the Magic Token. The `requiredSubchannel`
+		 * field is only present when `R` is 1.
+		 *
+		 *  0                   1                   2                   3
+		 *  0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+		 * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+		 * |                       Magic Token (1/2)                       |
+		 * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+		 * |                      Magic Token (2/2)                      |R|
+		 * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+		 * |        subchannelsCount       |          Subchannel 0         |
+		 * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+		 * |                              ...                              |
+		 * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+		 * |         Subchannel N-1        |  requiredSubchannel (if R=1)  |
+		 * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+		 */
+
+	public:
+		/**
+		 * 8-byte Magic Token that prefixes an encoded payload. It is intentionally
+		 * made of non-printable high bytes and starts with a byte that is not a valid
+		 * UTF-8 leading byte (0x80-0xBF), so a real string message (valid UTF-8) can
+		 * never begin with it and the chance of colliding with a binary message is
+		 * negligible. Its least significant bit is reserved as the
+		 * `requiredSubchannelFlag`, so it is always 0 in the token constant itself.
+		 */
+		static constexpr uint64_t MagicToken{ 0xA5F09CB3D6E1F28C };
+		static constexpr uint64_t RequiredSubchannelFlagMask{ 0x1 };
+
+	public:
+		/**
+		 * If `subchannels` is not empty or `requiredSubchannel` has value, encodes
+		 * them at the beginning of the given message payload.
+		 *
+		 * @returns true if the message was encoded, false otherwise.
+		 */
+		static bool EncodeSubchannels(
+		  RTC::SCTP::Message& message,
+		  const std::vector<uint16_t>& subchannels,
+		  std::optional<uint16_t> requiredSubchannel);
+
+		/**
+		 * If the given message payload starts with the Magic Token, extracts the
+		 * encoded subchannels and (optionally) the required subchannel, fills the
+		 * given arguments and removes the encoded header from the message payload.
+		 *
+		 * @returns true if the message was successfully decoded, false otherwise.
+		 */
+		static bool DecodeSubchannels(
+		  RTC::SCTP::Message& message,
+		  std::vector<uint16_t>& subchannels,
+		  std::optional<uint16_t>& requiredSubchannel);
+	};
+} // namespace RTC
+
+#endif

package/worker/include/RTC/Transport.hpp

@@ -219,6 +219,10 @@ namespace RTC
 		  const std::string& dataConsumerId, const std::string& method) const final;
 		virtual void CheckNoSctpDataConsumer(uint16_t streamId, const std::string& method) const final;
 		virtual bool IsConnected() const = 0;
+		virtual bool IsPipe() const
+		{
+			return false;
+		}
 		virtual void SendRtpPacket(
 		  RTC::Consumer* consumer, RTC::RTP::Packet* packet, const onSendCallback* cb = nullptr) = 0;
 		virtual void HandleRtcpPacket(RTC::RTCP::Packet* packet) final;
@@ -390,11 +394,6 @@ namespace RTC
 		// For SCTP capable transports and for direct transport.
 		size_t maxSendMessageSize{ 0u };
 		size_t maxReceiveMessageSize{ 0u };
-		// For SCTP capable transports.
-		size_t sctpSendBufferSize{ 0u };
-		size_t sctpPerStreamSendQueueLimit{ 0u };
-		size_t sctpMaxReceiverWindowBufferSize{ 0u };
-
 		struct TraceEventTypes traceEventTypes;
 	};
 } // namespace RTC

package/worker/meson.build

@@ -136,6 +136,7 @@ common_sources = [
   'src/RTC/SimpleProducerStreamManager.cpp',
   'src/RTC/SimulcastProducerStreamManager.cpp',
   'src/RTC/SrtpSession.cpp',
+  'src/RTC/SubchannelsCodec.cpp',
   'src/RTC/SvcProducerStreamManager.cpp',
   'src/RTC/TcpConnection.cpp',
   'src/RTC/TcpServer.cpp',
@@ -430,6 +431,7 @@ test_sources = [
   'test/src/RTC/TestRateCalculator.cpp',
   'test/src/RTC/TestRtpEncodingParameters.cpp',
   'test/src/RTC/TestSeqManager.cpp',
+  'test/src/RTC/TestSubchannelsCodec.cpp',
   'test/src/RTC/TestTransportCongestionControlServer.cpp',
   'test/src/RTC/TestTransportTuple.cpp',
   'test/src/RTC/TestTrendCalculator.cpp',

package/worker/scripts/package-lock.json

@@ -21,14 +21,15 @@
 			}
 		},
 		"node_modules/brace-expansion": {
-			"version": "5.0.6",
-			"resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.6.tgz",
-			"integrity": "sha512-kLpxurY4Z4r9sgMsyG0Z9uzsBlgiU/EFKhj/h91/8yHu0edo7XuixOIH3VcJ8kkxs6/jPzoI6U9Vj3WqbMQ94g==",
+			"version": "5.0.8",
+			"resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.8.tgz",
+			"integrity": "sha512-JZyDyq3D4AUifKTPOB7DELf6XsB3WdPuNxCtob1vFXPsSXhdAiHBWJ/tJ8HAc9aH84BK+5JFZLNkJKx3G9kzQg==",
+			"license": "MIT",
 			"dependencies": {
 				"balanced-match": "^4.0.2"
 			},
 			"engines": {
-				"node": "18 || 20 || >=22"
+				"node": "20 || >=22"
 			}
 		},
 		"node_modules/glob": {
@@ -104,9 +105,9 @@
 			"integrity": "sha512-BLrgEcRTwX2o6gGxGOCNyMvGSp35YofuYzw9h1IMTRmKqttAZZVU67bdb9Pr2vUHA8+j3i2tJfjO6C6+4myGTA=="
 		},
 		"brace-expansion": {
-			"version": "5.0.6",
-			"resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.6.tgz",
-			"integrity": "sha512-kLpxurY4Z4r9sgMsyG0Z9uzsBlgiU/EFKhj/h91/8yHu0edo7XuixOIH3VcJ8kkxs6/jPzoI6U9Vj3WqbMQ94g==",
+			"version": "5.0.8",
+			"resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.8.tgz",
+			"integrity": "sha512-JZyDyq3D4AUifKTPOB7DELf6XsB3WdPuNxCtob1vFXPsSXhdAiHBWJ/tJ8HAc9aH84BK+5JFZLNkJKx3G9kzQg==",
 			"requires": {
 				"balanced-match": "^4.0.2"
 			}

package/worker/src/RTC/DataConsumer.cpp

@@ -4,6 +4,7 @@
 #include "RTC/DataConsumer.hpp"
 #include "Logger.hpp"
 #include "MediaSoupErrors.hpp"
+#include "RTC/SubchannelsCodec.hpp"
 
 namespace RTC
 {
@@ -15,12 +16,14 @@ namespace RTC
 	  const std::string& dataProducerId,
 	  RTC::DataConsumer::Listener* listener,
 	  const FBS::Transport::ConsumeDataRequest* data,
-	  size_t maxMessageSize)
+	  size_t maxMessageSize,
+	  bool pipe)
 	  : id(id),
 	    dataProducerId(dataProducerId),
 	    shared(shared),
 	    listener(listener),
-	    maxMessageSize(maxMessageSize)
+	    maxMessageSize(maxMessageSize),
+	    pipe(pipe)
 	{
 		MS_TRACE();
 
@@ -398,24 +401,6 @@ namespace RTC
 		}
 	}
 
-	void DataConsumer::TransportConnected()
-	{
-		MS_TRACE();
-
-		this->transportConnected = true;
-
-		MS_DEBUG_DEV("Transport connected [dataConsumerId:%s]", this->id.c_str());
-	}
-
-	void DataConsumer::TransportDisconnected()
-	{
-		MS_TRACE();
-
-		this->transportConnected = false;
-
-		MS_DEBUG_DEV("Transport disconnected [dataConsumerId:%s]", this->id.c_str());
-	}
-
 	void DataConsumer::DataProducerPaused()
 	{
 		MS_TRACE();
@@ -450,22 +435,11 @@ namespace RTC
 		  this->id, FBS::Notification::Event::DATACONSUMER_DATAPRODUCER_RESUME);
 	}
 
-	void DataConsumer::SctpAssociationConnected()
-	{
-		MS_TRACE();
-
-		this->sctpAssociationConnected = true;
-
-		MS_DEBUG_DEV("SctpAssociation connected [dataConsumerId:%s]", this->id.c_str());
-	}
-
 	void DataConsumer::SctpAssociationClosed()
 	{
 		MS_TRACE();
 
-		this->sctpAssociationConnected = false;
-
-		MS_DEBUG_DEV("SctpAssociation closed [dataConsumerId:%s]", this->id.c_str());
+		this->sctpAssociationClosed = true;
 	}
 
 	void DataConsumer::SctpBufferedAmountLow(uint32_t bufferedAmount) const
@@ -526,48 +500,57 @@ namespace RTC
 			return false;
 		}
 
-		// If a required subchannel is given, verify that this data consumer is
-		// subscribed to it.
-		if (
-		  requiredSubchannel.has_value() &&
-		  this->subchannels.find(requiredSubchannel.value()) == this->subchannels.end())
+		if (!this->pipe)
 		{
-			if (cb)
+			// If a required subchannel is given, verify that this data consumer is
+			// subscribed to it.
+			if (requiredSubchannel.has_value() && !this->subchannels.contains(requiredSubchannel.value()))
 			{
-				(*cb)(false, false);
-				delete cb;
-			}
-
-			return false;
-		}
+				if (cb)
+				{
+					(*cb)(false, false);
+					delete cb;
+				}
 
-		// If subchannels are given, verify that this data consumer is subscribed
-		// to at least one of them.
-		if (!subchannels.empty())
-		{
-			bool subchannelMatched{ false };
+				return false;
+			}
 
-			for (const auto subchannel : subchannels)
+			// If subchannels are given, verify that this data consumer is subscribed
+			// to at least one of them.
+			if (!subchannels.empty())
 			{
-				if (this->subchannels.find(subchannel) != this->subchannels.end())
+				bool subchannelMatched{ false };
+
+				for (const auto subchannel : subchannels)
 				{
-					subchannelMatched = true;
+					if (this->subchannels.contains(subchannel))
+					{
+						subchannelMatched = true;
 
-					break;
+						break;
+					}
 				}
-			}
 
-			if (!subchannelMatched)
-			{
-				if (cb)
+				if (!subchannelMatched)
 				{
-					(*cb)(false, false);
-					delete cb;
-				}
+					if (cb)
+					{
+						(*cb)(false, false);
+						delete cb;
+					}
 
-				return false;
+					return false;
+				}
 			}
 		}
+		// This is a piped DataConsumer, so instead of verifying subchannels locally,
+		// encode the subchannels and required subchannel at the beginning of the
+		// message payload so the receiving PipeTransport can decode them and apply
+		// them to its own DataConsumers.
+		else
+		{
+			RTC::SubchannelsCodec::EncodeSubchannels(message, subchannels, requiredSubchannel);
+		}
 
 		const size_t messageLen = message.GetPayloadLength();
 
@@ -575,7 +558,7 @@ namespace RTC
 		{
 			MS_WARN_TAG(
 			  message,
-			  "given message exceeds maxMessageSize value [maxMessageSize:%zu, len:%zu]",
+			  "message exceeds maxMessageSize value [maxMessageSize:%zu, len:%zu]",
 			  messageLen,
 			  this->maxMessageSize);
 

package/worker/src/RTC/ICE/StunPacket.cpp

@@ -4,8 +4,9 @@
 #include "RTC/ICE/StunPacket.hpp"
 #include "Logger.hpp"
 #include "MediaSoupErrors.hpp"
+#include <openssl/crypto.h>
 #include <cstdio>  // std::snprintf()
-#include <cstring> // std::memcmp(), std::memcpy(), std::memset()
+#include <cstring> // std::memcpy(), std::memset()
 #include <string>
 
 namespace RTC
@@ -744,7 +745,10 @@ namespace RTC
 
 			// Compare the computed HMAC-SHA1 with the MESSAGE-INTEGRITY in the STUN
 			// packet.
-			if (std::memcmp(messageIntegrity, computedMessageIntegrity, StunPacket::FixedHeaderLength) == 0)
+			//
+			// NOTE: Use `CRYPTO_memcmp()` to have constant time memory comparison.
+			// See https://github.com/versatica/mediasoup/security/advisories/GHSA-xvjj-6cm4-ppgq
+			if (CRYPTO_memcmp(messageIntegrity, computedMessageIntegrity, StunPacket::FixedHeaderLength) == 0)
 			{
 				result = StunPacket::AuthenticationResult::OK;
 			}

package/worker/src/RTC/RTP/Packet.cpp

@@ -1083,6 +1083,17 @@ namespace RTC
 				return false;
 			}
 
+			if (len > extenLen)
+			{
+				MS_WARN_TAG(
+				  rtp,
+				  "no enough space for updated dependency descriptor [needed:%zu, available:%" PRIu8 "]",
+				  len,
+				  extenLen);
+
+				return false;
+			}
+
 			std::memcpy(extenValue, data, len);
 
 			SetExtensionLength(this->headerExtensionIds.dependencyDescriptor, len);

package/worker/src/RTC/SCTP/association/Association.cpp

@@ -54,6 +54,7 @@ namespace RTC
 		      this->associationListenerDeferrer,
 		      sctpOptions.mtu,
 		      sctpOptions.defaultStreamPriority,
+		      sctpOptions.defaultStreamBufferedAmountLowThreshold,
 		      sctpOptions.totalBufferedAmountLowThreshold),
 		    t1InitTimer(this->shared->CreateBackoffTimer(
 		      BackoffTimerHandleInterface::BackoffTimerHandleOptions{

package/worker/src/RTC/SCTP/association/StateCookie.cpp

@@ -4,7 +4,8 @@
 #include "RTC/SCTP/association/StateCookie.hpp"
 #include "Logger.hpp"
 #include "MediaSoupErrors.hpp"
-#include <cstring> // std::memcpy(), std::memcmp()
+#include <openssl/crypto.h>
+#include <cstring> // std::memcpy()
 #include <string_view>
 
 namespace RTC
@@ -179,7 +180,9 @@ namespace RTC
 			const uint8_t* expectedMac = Utils::Crypto::GetHmacSha1(
 			  reinterpret_cast<const char*>(macKey), macKeyLength, buffer, StateCookie::MacOffset);
 
-			return std::memcmp(buffer + StateCookie::MacOffset, expectedMac, StateCookie::MacLength) == 0;
+			// NOTE: Use `CRYPTO_memcmp()` to have constant time memory comparison.
+			// See https://github.com/versatica/mediasoup/security/advisories/GHSA-xvjj-6cm4-ppgq
+			return CRYPTO_memcmp(buffer + StateCookie::MacOffset, expectedMac, StateCookie::MacLength) == 0;
 		}
 
 		Types::SctpImplementation StateCookie::DetermineSctpImplementation(

package/worker/src/RTC/SCTP/packet/errorCauses/MissingMandatoryParameterErrorCause.cpp

@@ -81,8 +81,11 @@ namespace RTC
 			  new MissingMandatoryParameterErrorCause(const_cast<uint8_t*>(buffer), bufferLength);
 
 			// In this chunk we must validate that some fields have correct values.
+			//
+			// NOTE: Must cast result to uint64_t to avoid integer overflow.
+			// See https://github.com/versatica/mediasoup/security/advisories/GHSA-p9cq-fqxc-987w
 			if (
-			  (errorCause->GetNumberOfMissingParameters() * 2) !=
+			  (static_cast<uint64_t>(errorCause->GetNumberOfMissingParameters()) * 2) !=
 			  causeLength -
 			    MissingMandatoryParameterErrorCause::MissingMandatoryParameterErrorCauseHeaderLength)
 			{

package/worker/src/RTC/SCTP/tx/RoundRobinSendQueue.cpp

@@ -20,9 +20,11 @@ namespace RTC
 		  AssociationListenerInterface& associationListener,
 		  size_t mtu,
 		  uint16_t defaultPriority,
+		  size_t defaultStreamBufferedAmountLowThreshold,
 		  size_t totalBufferedAmountLowThreshold)
 		  : associationListener(associationListener),
 		    defaultPriority(defaultPriority),
+		    defaultStreamBufferedAmountLowThreshold(defaultStreamBufferedAmountLowThreshold),
 		    scheduler(mtu),
 		    totalBufferedAmountThresholdWatcher(
 		      [this]()
@@ -256,7 +258,9 @@ namespace RTC
 
 			if (it == this->streams.end())
 			{
-				return 0;
+				// The stream is created lazily (on first send or when its threshold is
+				// explicitly set), so report the default that it will be created with.
+				return this->defaultStreamBufferedAmountLowThreshold;
 			}
 
 			const auto& stream = it->second;
@@ -297,7 +301,11 @@ namespace RTC
 				    this->associationListener.OnAssociationStreamBufferedAmountLow(streamId);
 			    }));
 
-			return it2->second;
+			auto& stream = it2->second;
+
+			stream.GetBufferedAmount().SetLowThreshold(this->defaultStreamBufferedAmountLowThreshold);
+
+			return stream;
 		}
 
 		void RoundRobinSendQueue::AssertIsConsistent() const