Added limit to elapsed time in paced sender.

Added sanity checks to interval budget to protect against integer
overflow. To avoid tests failing due to initializing paced sender
in another time domain, the elapsed time that is input into the
interval budget is limited to max 2 seconds.

Bug: webrtc:8942
Change-Id: I9ed32f059e65df7898c37bb34a008189ce79dc60
Reviewed-on: https://webrtc-review.googlesource.com/58087
Reviewed-by: Tommi <tommi@webrtc.org>
Commit-Queue: Sebastian Jansson <srte@webrtc.org>
Cr-Commit-Position: refs/heads/master@{#22220}

modules/pacing/paced_sender.cc

@@ -35,6 +35,7 @@ namespace {
 // Time limit in milliseconds between packet bursts.
 const int64_t kMinPacketLimitMs = 5;
 const int64_t kPausedPacketIntervalMs = 500;
+const int64_t kMaxElapsedTimeMs = 2000;
 
 // Upper cap on process interval, in case process has not been called in a long
 // time.
@@ -260,7 +261,12 @@ void PacedSender::Process() {
   rtc::CritScope cs(&critsect_);
   time_last_process_us_ = now_us;
   int64_t elapsed_time_ms = (now_us - last_send_time_us_ + 500) / 1000;
-
+  if (elapsed_time_ms > kMaxElapsedTimeMs) {
+    RTC_LOG(LS_WARNING) << "Elapsed time (" << elapsed_time_ms
+                        << " ms) longer than expected, limiting to "
+                        << kMaxElapsedTimeMs << " ms";
+    elapsed_time_ms = kMaxElapsedTimeMs;
+  }
   // When paused we send a padding packet every 500 ms to ensure we won't get
   // stuck in the paused state due to no feedback being received.
   if (paused_) {