moq: do not accept empty payloads (#6085)

internal/protocols/moq/subgroup/object.go

@@ -11,6 +11,9 @@ import (
 const (
 	maxPropsLen    = 128 * 1024
 	maxPayloadSize = 10 * 1024 * 1024
+
+	objectStatusEndOfGroup = 0x03
+	objectStatusEndOfTrack = 0x04
 )
 
 // Object is an object of a subgroup stream.
@@ -68,7 +71,7 @@ func (o *Object) read(r io.Reader, header *Header) error {
 			return err
 		}
 
-		if status != 0x03 && status != 0x04 {
+		if status != objectStatusEndOfGroup && status != objectStatusEndOfTrack {
 			return fmt.Errorf("unexpected status: 0x%x", status)
 		}
 
@@ -117,7 +120,7 @@ func (o Object) marshalTo(buf []byte, header *Header) int {
 	if len(o.Payload) == 0 {
 		buf[n] = 0x00
 		n++
-		buf[n] = 0x03
+		buf[n] = objectStatusEndOfGroup
 		n++
 		return n
 	}

internal/protocols/moq/subgroup/subgroup.go

@@ -26,11 +26,16 @@ func (s *SubGroup) Read(r io.Reader) error {
 	}
 	s.Objects = []Object{o1}
 
+	if len(o1.Payload) == 0 {
+		return fmt.Errorf("unexpected empty object")
+	}
+
 	var o2 Object
 	err = o2.read(r, &s.Header)
 	if err != nil {
 		return err
 	}
+
 	if len(o2.Payload) != 0 {
 		return fmt.Errorf("unexpected second object")
 	}

internal/protocols/moq/subgroup/subgroup_test.go

@@ -98,13 +98,19 @@ func FuzzUnmarshal(f *testing.F) {
 		f.Add(ca.enc)
 	}
 
-	f.Fuzz(func(_ *testing.T, buf []byte) {
+	f.Fuzz(func(t *testing.T, buf []byte) {
 		var s subgroup.SubGroup
 		err := s.Read(bytes.NewReader(buf))
 		if err != nil {
 			return
 		}
 
+		require.NotEmpty(t, s.Objects)
+
+		for _, obj := range s.Objects {
+			require.NotEmpty(t, obj.Payload)
+		}
+
 		s.Marshal()
 	})
 }

internal/protocols/moq/subgroup/testdata/fuzz/FuzzUnmarshal/f023ecce237d452d

@@ -0,0 +1,2 @@
+go test fuzz v1
+[]byte("0000\x00\x03")