From f29816fe50939ad520ee8666d1641ce4ca913006 Mon Sep 17 00:00:00 2001
From: Alessandro Ros <aler9.dev@gmail.com>
Date: Sat, 15 Aug 2026 18:56:35 +0200
Subject: [PATCH] moq: do not accept empty payloads (#6085)

---
 internal/protocols/moq/subgroup/object.go                 | 7 +++++--
 internal/protocols/moq/subgroup/subgroup.go               | 5 +++++
 internal/protocols/moq/subgroup/subgroup_test.go          | 8 +++++++-
 .../subgroup/testdata/fuzz/FuzzUnmarshal/f023ecce237d452d | 2 ++
 4 files changed, 19 insertions(+), 3 deletions(-)
 create mode 100644 internal/protocols/moq/subgroup/testdata/fuzz/FuzzUnmarshal/f023ecce237d452d

diff --git a/internal/protocols/moq/subgroup/object.go b/internal/protocols/moq/subgroup/object.go
index 1c6d5f61..9766e989 100644
--- a/internal/protocols/moq/subgroup/object.go
+++ b/internal/protocols/moq/subgroup/object.go
@@ -11,6 +11,9 @@ import (
 const (
 	maxPropsLen    = 128 * 1024
 	maxPayloadSize = 10 * 1024 * 1024
+
+	objectStatusEndOfGroup = 0x03
+	objectStatusEndOfTrack = 0x04
 )
 
 // Object is an object of a subgroup stream.
@@ -68,7 +71,7 @@ func (o *Object) read(r io.Reader, header *Header) error {
 			return err
 		}
 
-		if status != 0x03 && status != 0x04 {
+		if status != objectStatusEndOfGroup && status != objectStatusEndOfTrack {
 			return fmt.Errorf("unexpected status: 0x%x", status)
 		}
 
@@ -117,7 +120,7 @@ func (o Object) marshalTo(buf []byte, header *Header) int {
 	if len(o.Payload) == 0 {
 		buf[n] = 0x00
 		n++
-		buf[n] = 0x03
+		buf[n] = objectStatusEndOfGroup
 		n++
 		return n
 	}
diff --git a/internal/protocols/moq/subgroup/subgroup.go b/internal/protocols/moq/subgroup/subgroup.go
index 5681ad95..f209e702 100644
--- a/internal/protocols/moq/subgroup/subgroup.go
+++ b/internal/protocols/moq/subgroup/subgroup.go
@@ -26,11 +26,16 @@ func (s *SubGroup) Read(r io.Reader) error {
 	}
 	s.Objects = []Object{o1}
 
+	if len(o1.Payload) == 0 {
+		return fmt.Errorf("unexpected empty object")
+	}
+
 	var o2 Object
 	err = o2.read(r, &s.Header)
 	if err != nil {
 		return err
 	}
+
 	if len(o2.Payload) != 0 {
 		return fmt.Errorf("unexpected second object")
 	}
diff --git a/internal/protocols/moq/subgroup/subgroup_test.go b/internal/protocols/moq/subgroup/subgroup_test.go
index d0241681..00539d77 100644
--- a/internal/protocols/moq/subgroup/subgroup_test.go
+++ b/internal/protocols/moq/subgroup/subgroup_test.go
@@ -98,13 +98,19 @@ func FuzzUnmarshal(f *testing.F) {
 		f.Add(ca.enc)
 	}
 
-	f.Fuzz(func(_ *testing.T, buf []byte) {
+	f.Fuzz(func(t *testing.T, buf []byte) {
 		var s subgroup.SubGroup
 		err := s.Read(bytes.NewReader(buf))
 		if err != nil {
 			return
 		}
 
+		require.NotEmpty(t, s.Objects)
+
+		for _, obj := range s.Objects {
+			require.NotEmpty(t, obj.Payload)
+		}
+
 		s.Marshal()
 	})
 }
diff --git a/internal/protocols/moq/subgroup/testdata/fuzz/FuzzUnmarshal/f023ecce237d452d b/internal/protocols/moq/subgroup/testdata/fuzz/FuzzUnmarshal/f023ecce237d452d
new file mode 100644
index 00000000..8574e07d
--- /dev/null
+++ b/internal/protocols/moq/subgroup/testdata/fuzz/FuzzUnmarshal/f023ecce237d452d
@@ -0,0 +1,2 @@
+go test fuzz v1
+[]byte("0000\x00\x03")