search

cisco / libsrtp

Library for SRTP (Secure Realtime Transport Protocol)
Other
1.23k stars 476 forks source link

Use of Potentially Dangerous Function #418

Closed RootUp closed 6 years ago

RootUp commented 6 years ago

Hi Team,

The file, /master/test/rtpw.c#L561

usleep(USEC_RATE);

The usleep() function suspends execution of the calling thread for (at least) usec microseconds. The parameter you pass is a minimum time for sleeping. There's no guarantee that the thread will wake up after exactly the time specified. Given the specific dynamics of the scheduler, it may result in longer than expected delays.

Use nanosleep() instead.

Reported via: libsrtp-security@lists.packetizer.com

However Paul suggested, I do not believe there are any security-related issues with this function, but merely a desire to move users to more granular timing functions. Further, this particular module in libsrtp is just for testing, not deployment.

pabuhler commented 6 years ago

After looking at this again I am not sure why we would need to change, as stated it has no obvious security benefits and appears to only improve sub milli second timing of a test that uses the timing only to pace out sending of packets. If I am wrong then please explain otherwise I suggest just ignoring this.