[FFmpeg-devel] [PATCH] rtpdec: Fix RTP timestamp wraparound in Producer Reference Time

[FFmpeg-devel] [PATCH] rtpdec: Fix RTP timestamp wraparound in Producer Reference Time

[Clément Péron]

The rtp_set_prft() function incorrectly calculates the timestamp delta
when RTP timestamps wrap around the 32-bit boundary. The current code:

    delta_timestamp = (int64_t)timestamp - (int64_t)s->last_rtcp_timestamp;

treats both timestamps as large positive values, causing wraparound to
produce a large negative delta instead of the correct small positive delta.

For example, with a 90kHz video clock:
- last_rtcp_timestamp = 0xFFFFFF00 (near wraparound)
- timestamp = 0x00000100 (after wraparound)
- Current result: delta ≈ -4.3 billion ticks ≈ -47,721 seconds
- Expected result: delta ≈ +512 ticks ≈ +0.006 seconds

This causes prft->wallclock to jump backward by approximately:
- 90kHz video: ~47,721 seconds (~13.25 hours)
- 48kHz audio: ~89,478 seconds (~24.9 hours)
- 8kHz audio: ~536,871 seconds (~6.2 days)

Fix by casting the subtraction result to int32_t, which correctly
handles wraparound through modular arithmetic:

    delta_timestamp = (int32_t)(timestamp - s->last_rtcp_timestamp);

This ensures the delta is always in the range [-2^31, 2^31-1], making
wraparound produce the correct small positive values.

Fixes timing jumps in applications that rely on Producer Reference Time
for media synchronization.
---
 libavformat/rtpdec.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/libavformat/rtpdec.c b/libavformat/rtpdec.c
index 729bf83685..7a658ad698 100644
--- a/libavformat/rtpdec.c
+++ b/libavformat/rtpdec.c
@@ -642,7 +642,7 @@ static int rtp_set_prft(RTPDemuxContext *s, AVPacket *pkt, uint32_t timestamp) {
         return AVERROR(ENOMEM);
 
     rtcp_time = ff_parse_ntp_time(s->last_rtcp_ntp_time) - NTP_OFFSET_US;
-    delta_timestamp = (int64_t)timestamp - (int64_t)s->last_rtcp_timestamp;
+    delta_timestamp = (int32_t)(timestamp - s->last_rtcp_timestamp);
     delta_time = av_rescale_q(delta_timestamp, s->st->time_base, AV_TIME_BASE_Q);
 
     prft->wallclock = rtcp_time + delta_time;
-- 
2.48.1

_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel

To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".

Re: [FFmpeg-devel] [PATCH] rtpdec: Fix RTP timestamp wraparound in Producer Reference Time

[Clément Péron]

On Fri, 6 Jun 2025 at 10:54, Clément Péron <peron.clem@gmail.com> wrote:
>
> The rtp_set_prft() function incorrectly calculates the timestamp delta
> when RTP timestamps wrap around the 32-bit boundary. The current code:
>
>     delta_timestamp = (int64_t)timestamp - (int64_t)s->last_rtcp_timestamp;
>
> treats both timestamps as large positive values, causing wraparound to
> produce a large negative delta instead of the correct small positive delta.
>
> For example, with a 90kHz video clock:
> - last_rtcp_timestamp = 0xFFFFFF00 (near wraparound)
> - timestamp = 0x00000100 (after wraparound)
> - Current result: delta ≈ -4.3 billion ticks ≈ -47,721 seconds
> - Expected result: delta ≈ +512 ticks ≈ +0.006 seconds
>
> This causes prft->wallclock to jump backward by approximately:
> - 90kHz video: ~47,721 seconds (~13.25 hours)
> - 48kHz audio: ~89,478 seconds (~24.9 hours)
> - 8kHz audio: ~536,871 seconds (~6.2 days)
>
> Fix by casting the subtraction result to int32_t, which correctly
> handles wraparound through modular arithmetic:
>
>     delta_timestamp = (int32_t)(timestamp - s->last_rtcp_timestamp);
>
> This ensures the delta is always in the range [-2^31, 2^31-1], making
> wraparound produce the correct small positive values.
>
> Fixes timing jumps in applications that rely on Producer Reference Time
> for media synchronization.

Sorry for missing my sign-off :(

Signed-off-by: Clément Péron <peron.clem@gmail.com>

> ---
>  libavformat/rtpdec.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/libavformat/rtpdec.c b/libavformat/rtpdec.c
> index 729bf83685..7a658ad698 100644
> --- a/libavformat/rtpdec.c
> +++ b/libavformat/rtpdec.c
> @@ -642,7 +642,7 @@ static int rtp_set_prft(RTPDemuxContext *s, AVPacket *pkt, uint32_t timestamp) {
>          return AVERROR(ENOMEM);
>
>      rtcp_time = ff_parse_ntp_time(s->last_rtcp_ntp_time) - NTP_OFFSET_US;
> -    delta_timestamp = (int64_t)timestamp - (int64_t)s->last_rtcp_timestamp;
> +    delta_timestamp = (int32_t)(timestamp - s->last_rtcp_timestamp);
>      delta_time = av_rescale_q(delta_timestamp, s->st->time_base, AV_TIME_BASE_Q);
>
>      prft->wallclock = rtcp_time + delta_time;
> --
> 2.48.1
>
_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel

To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".

Re: [FFmpeg-devel] [PATCH] rtpdec: Fix RTP timestamp wraparound in Producer Reference Time

[Michael Niedermayer]

[-- Attachment #1.1: Type: text/plain, Size: 2498 bytes --]

On Fri, Jun 06, 2025 at 10:54:14AM +0200, Clément Péron wrote:
> The rtp_set_prft() function incorrectly calculates the timestamp delta
> when RTP timestamps wrap around the 32-bit boundary. The current code:
> 
>     delta_timestamp = (int64_t)timestamp - (int64_t)s->last_rtcp_timestamp;
> 
> treats both timestamps as large positive values, causing wraparound to
> produce a large negative delta instead of the correct small positive delta.
> 
> For example, with a 90kHz video clock:
> - last_rtcp_timestamp = 0xFFFFFF00 (near wraparound)
> - timestamp = 0x00000100 (after wraparound)
> - Current result: delta ≈ -4.3 billion ticks ≈ -47,721 seconds
> - Expected result: delta ≈ +512 ticks ≈ +0.006 seconds
> 
> This causes prft->wallclock to jump backward by approximately:
> - 90kHz video: ~47,721 seconds (~13.25 hours)
> - 48kHz audio: ~89,478 seconds (~24.9 hours)
> - 8kHz audio: ~536,871 seconds (~6.2 days)
> 
> Fix by casting the subtraction result to int32_t, which correctly
> handles wraparound through modular arithmetic:
> 
>     delta_timestamp = (int32_t)(timestamp - s->last_rtcp_timestamp);
> 
> This ensures the delta is always in the range [-2^31, 2^31-1], making
> wraparound produce the correct small positive values.
> 
> Fixes timing jumps in applications that rely on Producer Reference Time
> for media synchronization.
> ---
>  libavformat/rtpdec.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/libavformat/rtpdec.c b/libavformat/rtpdec.c
> index 729bf83685..7a658ad698 100644
> --- a/libavformat/rtpdec.c
> +++ b/libavformat/rtpdec.c
> @@ -642,7 +642,7 @@ static int rtp_set_prft(RTPDemuxContext *s, AVPacket *pkt, uint32_t timestamp) {
>          return AVERROR(ENOMEM);
>  
>      rtcp_time = ff_parse_ntp_time(s->last_rtcp_ntp_time) - NTP_OFFSET_US;
> -    delta_timestamp = (int64_t)timestamp - (int64_t)s->last_rtcp_timestamp;
> +    delta_timestamp = (int32_t)(timestamp - s->last_rtcp_timestamp);
>      delta_time = av_rescale_q(delta_timestamp, s->st->time_base, AV_TIME_BASE_Q);

assuming the change is correct, the type of delta_timestamp can be
changed to int32_t

thx

[...]

-- 
Michael     GnuPG fingerprint: 9FF2128B147EF6730BADF133611EC787040B0FAB

If you fake or manipulate statistics in a paper in physics you will never
get a job again.
If you fake or manipulate statistics in a paper in medicin you will get
a job for life at the pharma industry.

[-- Attachment #1.2: signature.asc --]
[-- Type: application/pgp-signature, Size: 195 bytes --]

[-- Attachment #2: Type: text/plain, Size: 251 bytes --]

_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel

To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".