[FFmpeg-cvslog] avformat/rtpenc: Fix integer overflow in NTP_TO_RTP_FORMAT
Boris Nagels
git at videolan.org
Sat Apr 30 03:36:39 CEST 2016
ffmpeg | branch: release/2.6 | Boris Nagels <develop at focusware.nl> | Sun Mar 6 16:31:36 2016 +0100| [d33cc39eb8d989a3add397f3b8490c827831db83] | committer: Michael Niedermayer
avformat/rtpenc: Fix integer overflow in NTP_TO_RTP_FORMAT
RTCP synchronization packet was broken since commit in ffmpeg version > 2.8.3
(commit: e04b039b1528f4c7df5c2b93865651bfea168a19) Since this commit (2e814d0329aded98c811d0502839618f08642685)
"rtpenc: Simplify code by introducing a macro for rescaling NTP timestamps", NTP_TO_RTP_FORMAT
uses av_rescale_rnd() function to add the data to the packet.
This causes an overflow in the av_rescale_rnd() function and it will return INT64_MIN.
Causing the NTP stamp in the RTCP packet to have an invalid value.
Github: Closes #182
Reverting commit '2e814d0329aded98c811d0502839618f08642685' solves the problem.
(cherry picked from commit 1109ed7973c7fd1e7001898adc4976590d862122)
Signed-off-by: Michael Niedermayer <michael at niedermayer.cc>
> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=d33cc39eb8d989a3add397f3b8490c827831db83
---
libavformat/rtpenc.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/libavformat/rtpenc.c b/libavformat/rtpenc.c
index fea3368..aa419ca 100644
--- a/libavformat/rtpenc.c
+++ b/libavformat/rtpenc.c
@@ -271,7 +271,8 @@ static void rtcp_send_sr(AVFormatContext *s1, int64_t ntp_time, int bye)
avio_w8(s1->pb, RTCP_SR);
avio_wb16(s1->pb, 6); /* length in words - 1 */
avio_wb32(s1->pb, s->ssrc);
- avio_wb64(s1->pb, NTP_TO_RTP_FORMAT(ntp_time));
+ avio_wb32(s1->pb, ntp_time / 1000000);
+ avio_wb32(s1->pb, ((ntp_time % 1000000) << 32) / 1000000);
avio_wb32(s1->pb, rtp_ts);
avio_wb32(s1->pb, s->packet_count);
avio_wb32(s1->pb, s->octet_count);
More information about the ffmpeg-cvslog
mailing list