[Ccrtp-devel] Overflow bug in outqueue.cpp

[Hattori Kenta]

Hello

When I was debugging for our VoIP system, which is using ccRTP
library, I found a bug that causes stopping to send RTP packets.

The following code to calculate 'overflow.tv_usec' field easily causes
overflow problem.

####
   overflow.tv_usec = (~static_cast<uint32>(0)) % rate *
           1000000ul / rate;

#### in OutgoingDataQueue::getSchedulingTimeout(void)

For example, when 'rate' is 8000, we first get 

0xffffffff % 8000 = 7295

then

7295 * 10000000 = 7295000000 > 4294967295 (overflow!!!)

This error is accumulated every time when a timestamp goes round.
Finally it causes packet expiration and streaming will stop.

The easiest way to fix this problem might be to use unsigned long
long as follows:

   overflow.tv_usec = (~static_cast<uint32>(0)) % rate *
           1000000ull / rate;
                 ^^^^^^

I originally found this problem in ccRTP-1.2.2, but it still remains
in the newest version.

---
Kenta Hattori(address@hidden)
Resarch Institute of Systems Planning, Inc./ISP