Decompression failure with simultaneous TS_STRIDE changes and packet loss

[Didier Barvaux]

A RTP stream with a TS_STRIDE change and a lost packet at the very same time may fail to be decompressed correctly.

RTP stream pattern that cause the bug:
 * packet #N:
      - SN = A
      - TS = B
 * packet #(N+1):
      - SN = A + 1
      - TS = B + TS_STRIDE
 * packet #(N+2):
      - SN = A + 2
      - TS = B + TS_STRIDE # TS is unchanged wrt packet #(N+1)

If packet #(N+1) is lost while in SO state, then #(N+2) packet will not be correctly decompressed.

[Didier Barvaux (didier-barvaux)]

Attach a PCAP file that contains a RTP stream that causes the bug. It was generated with scapy:

>>> packets = []
>>> for i in range(1, 9):
... packets.append(Ether()/IP(id=i)/UDP(dport=1234)/RTP(sequence=i, timestamp=(i+1)*160))
...
>>> for i in range(0, 8):
... packets[i][RTP].timestamp = 160*(i+1)
...
>>> len(packets)
8
>>> packets[6][RTP].timestamp = packets[5][RTP].timestamp + 160*2
>>> packets[7][RTP].timestamp = packets[6][RTP].timestamp + 160
>>> wrpcap("non_sequential_rtp_ts.pcap", packets)

[Didier Barvaux (didier-barvaux)]

The problem is fixed by detecting RTP TS behaviour:
   - if TS delta = TS_STRIDE, keep current behaviour
   - if TS delta != TS_STRIDE:
      - if TS delta is not a multiple of TS_STRIDE, a clock resync was probably
        performed at source, so change TS_STRIDE and transmit TS_STRIDE and TS
        in the next several packets
      - if TS delta is a multiple of TS_STRIDE, check if the TS jump is OK wrt
        to SN jump:
         - if TS delta follows SN jump, a packet was probably lost, so do nothing
         - if TS delta does not follow SN jump, a TS jump was probably done by
           the source, so do not change TS_STRIDE now but retransmit TS_STRIDE
           and TS in the next several packets for robustness.

The problem was detected and fixed by Viveris Technologies.

[Didier Barvaux (didier-barvaux)]

Fixed on main branch. See http://bazaar.launchpad.net/~didier-barvaux/rohc/main/revision/571

[Didier Barvaux (didier-barvaux)]

Fixed on 1.5.x branch. See http://bazaar.launchpad.net/~didier-barvaux/rohc/1.5.x/revision/538

[Didier Barvaux (didier-barvaux)]

Fixed on 1.4.x branch. See http://bazaar.launchpad.net/~didier-barvaux/rohc/1.4.x/revision/354

[Didier Barvaux (didier-barvaux)]

Update the README file to note that the bug will not be fixed in the 1.3.x releases. See http://bazaar.launchpad.net/~didier-barvaux/rohc/1.3.x/revision/207