Opened 3 days ago

#11388 new defect

Overflow in start_time_realtime calculation in rtsp.c

Reported by: IncrediBlame Owned by:
Priority: normal Component: ffmpeg
Version: git-master Keywords: start_time_realtime RTSP RTCP
Cc: Blocked By:
Blocking: Reproduced by developer: no
Analyzed by developer: no

Description

Summary of the bug:
start_time_realtime calculation was changed in realease/7.1 branch: https://github.com/FFmpeg/FFmpeg/blob/bb85423142103d694d97bad1967bd3dc55440e71/libavformat/rtsp.c#L2323
This is causing overflow, as av_rescale treats its args as int64_t, but rtpctx->first_rtcp_ntp_time used in calculation is uint64_t.
Previous version worked, because the arg was shifted by an offset before used by av_rescale, but now shift is done after calculation.

How to reproduce:

1. Add pprintf after calculation above.
2. Build ffmpeg.
2. Run
% ffmpeg -i some_rtsp_source -c copy abc.mp4
3. If rtsp source sends RTCP SR the code will eventually be hit, but sets the timestamp to some negative number.

Potential fix:

s->start_time_realtime = av_rescale (rtpctx->first_rtcp_ntp_time >> 2, 1000000, 1LL << 30) - NTP_OFFSET_US;

should stop the overflow.

Change History (0)

Note: See TracTickets for help on using tickets.