From 8a9cbf99a5c74f3330440cee97241e15ad054005 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Cl=C3=A9ment=20P=C3=A9ron?= Date: Sat, 7 Jun 2025 10:06:19 +0200 Subject: [PATCH] libavformat/rtpdec: Fix RTP timestamp wraparound in Producer Reference Time MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The rtp_set_prft() function incorrectly calculates the timestamp delta when RTP timestamps wrap around the 32-bit boundary. The current code: delta_timestamp = (int64_t)timestamp - (int64_t)s->last_rtcp_timestamp; treats both timestamps as large positive values, causing wraparound to produce a large negative delta instead of the correct small positive delta. For example, with a 90kHz video clock: - last_rtcp_timestamp = 0xFFFFFF00 (near wraparound) - timestamp = 0x00000100 (after wraparound) - Current result: delta ≈ -4.3 billion ticks ≈ -47,721 seconds - Expected result: delta ≈ +512 ticks ≈ +0.006 seconds This causes prft->wallclock to jump backward by approximately: - 90kHz video: ~47,721 seconds (~13.25 hours) - 48kHz audio: ~89,478 seconds (~24.9 hours) - 8kHz audio: ~536,871 seconds (~6.2 days) Fix by casting the subtraction result to int32_t, which correctly handles wraparound through modular arithmetic: delta_timestamp = (int32_t)(timestamp - s->last_rtcp_timestamp); This ensures the delta is always in the range [-2^31, 2^31-1], making wraparound produce the correct small positive values. Fixes timing jumps in applications that rely on Producer Reference Time for media synchronization. Signed-off-by: Clément Péron Signed-off-by: Michael Niedermayer --- libavformat/rtpdec.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/libavformat/rtpdec.c b/libavformat/rtpdec.c index ebd5402bce..2e2cbf5477 100644 --- a/libavformat/rtpdec.c +++ b/libavformat/rtpdec.c @@ -587,7 +587,8 @@ void ff_rtp_parse_set_crypto(RTPDemuxContext *s, const char *suite, } static int rtp_set_prft(RTPDemuxContext *s, AVPacket *pkt, uint32_t timestamp) { - int64_t rtcp_time, delta_timestamp, delta_time; + int64_t rtcp_time, delta_time; + int32_t delta_timestamp; AVProducerReferenceTime *prft = (AVProducerReferenceTime *) av_packet_new_side_data( @@ -596,7 +597,7 @@ static int rtp_set_prft(RTPDemuxContext *s, AVPacket *pkt, uint32_t timestamp) { return AVERROR(ENOMEM); rtcp_time = ff_parse_ntp_time(s->last_rtcp_ntp_time) - NTP_OFFSET_US; - delta_timestamp = (int64_t)timestamp - (int64_t)s->last_rtcp_timestamp; + delta_timestamp = (int32_t)(timestamp - s->last_rtcp_timestamp); delta_time = av_rescale_q(delta_timestamp, s->st->time_base, AV_TIME_BASE_Q); prft->wallclock = rtcp_time + delta_time;