From d072ebe384b29b3011a4af33ded42e7a5d613dca Mon Sep 17 00:00:00 2001
From: Ali Sayyah <a.sayyah@gmail.com>
Date: Sat, 20 Dec 2025 15:27:43 -0800
Subject: [PATCH] Fix gosec slice bounds warnings

Add nolint directives for safe slice accesses where bounds
are guaranteed by fixed-size allocation or loop conditions.
---
 header.go                             | 4 ++--
 receiver_estimated_maximum_bitrate.go | 2 +-
 reception_report.go                   | 6 +++---
 source_description.go                 | 4 ++--
 transport_layer_cc.go                 | 2 +-
 5 files changed, 9 insertions(+), 9 deletions(-)

diff --git a/header.go b/header.go
index f392e14..0ee8a62 100644
--- a/header.go
+++ b/header.go
@@ -111,9 +111,9 @@ func (h Header) Marshal() ([]byte, error) {
 	if h.Count > 31 {
 		return nil, errInvalidHeader
 	}
-	rawPacket[0] |= h.Count << countShift
+	rawPacket[0] |= h.Count << countShift //nolint:gosec // rawPacket is created with length headerLength (4)
 
-	rawPacket[1] = uint8(h.Type)
+	rawPacket[1] = uint8(h.Type) //nolint:gosec // rawPacket is created with length headerLength (4)
 
 	binary.BigEndian.PutUint16(rawPacket[2:], h.Length)
 
diff --git a/receiver_estimated_maximum_bitrate.go b/receiver_estimated_maximum_bitrate.go
index cb6cdae..91aa832 100644
--- a/receiver_estimated_maximum_bitrate.go
+++ b/receiver_estimated_maximum_bitrate.go
@@ -276,7 +276,7 @@ func (p *ReceiverEstimatedMaximumBitrate) String() string {
 		powers++
 	}
 
-	unit := bitUnits[powers]
+	unit := bitUnits[powers] //nolint:gosec // powers is bounded by loop condition
 
 	return fmt.Sprintf("ReceiverEstimatedMaximumBitrate %x %.2f %s/s", p.SenderSSRC, bitrate, unit)
 }
diff --git a/reception_report.go b/reception_report.go
index f2b4548..c20a573 100644
--- a/reception_report.go
+++ b/reception_report.go
@@ -78,9 +78,9 @@ func (r ReceptionReport) Marshal() ([]byte, error) {
 		return nil, errInvalidTotalLost
 	}
 	tlBytes := rawPacket[totalLostOffset:]
-	tlBytes[0] = byte(r.TotalLost >> 16)
-	tlBytes[1] = byte(r.TotalLost >> 8)
-	tlBytes[2] = byte(r.TotalLost)
+	tlBytes[0] = byte(r.TotalLost >> 16) //nolint:gosec // rawPacket is created with length receptionReportLength (24)
+	tlBytes[1] = byte(r.TotalLost >> 8)  //nolint:gosec // rawPacket is created with length receptionReportLength (24)
+	tlBytes[2] = byte(r.TotalLost)       //nolint:gosec // rawPacket is created with length receptionReportLength (24)
 
 	binary.BigEndian.PutUint32(rawPacket[lastSeqOffset:], r.LastSequenceNumber)
 	binary.BigEndian.PutUint32(rawPacket[jitterOffset:], r.Jitter)
diff --git a/source_description.go b/source_description.go
index 6d6f2a0..93c433b 100644
--- a/source_description.go
+++ b/source_description.go
@@ -313,14 +313,14 @@ func (s SourceDescriptionItem) Marshal() ([]byte, error) {
 
 	rawPacket := make([]byte, sdesTypeLen+sdesOctetCountLen)
 
-	rawPacket[sdesTypeOffset] = uint8(s.Type)
+	rawPacket[sdesTypeOffset] = uint8(s.Type) //nolint:gosec // rawPacket is created with length 2
 
 	txtBytes := []byte(s.Text)
 	octetCount := len(txtBytes)
 	if octetCount > sdesMaxOctetCount {
 		return nil, errSDESTextTooLong
 	}
-	rawPacket[sdesOctetCountOffset] = uint8(octetCount)
+	rawPacket[sdesOctetCountOffset] = uint8(octetCount) //nolint:gosec // rawPacket is created with length 2
 
 	rawPacket = append(rawPacket, txtBytes...) //nolint:makezero
 
diff --git a/transport_layer_cc.go b/transport_layer_cc.go
index de464cb..47e0733 100644
--- a/transport_layer_cc.go
+++ b/transport_layer_cc.go
@@ -270,7 +270,7 @@ func (r RecvDelta) Marshal() ([]byte, error) {
 	// small delta
 	if r.Type == TypeTCCPacketReceivedSmallDelta && delta >= 0 && delta <= math.MaxUint8 {
 		deltaChunk := make([]byte, 1)
-		deltaChunk[0] = byte(delta)
+		deltaChunk[0] = byte(delta) //nolint:gosec // deltaChunk is created with length 1
 
 		return deltaChunk, nil
 	}