similarity index 96%
rename from meta/recipes-multimedia/mpg123/mpg123_1.33.6.bb
rename to meta/recipes-multimedia/mpg123/mpg123_1.33.7.bb
@@ -10,7 +10,7 @@ LICENSE = "LGPL-2.1-only"
LIC_FILES_CHKSUM = "file://COPYING;md5=e7b9c15fcfb986abb4cc5e8400a24169"
SRC_URI = "https://www.mpg123.de/download/${BP}.tar.bz2"
-SRC_URI[sha256sum] = "929a7c18ba662b8927aed4de229ad9ae8ab2b4806dd0f30b90113eb1b4e2195a"
+SRC_URI[sha256sum] = "31d0e35a4ca567ec9b5ebda6c3062bb4435d6d3eacd6ef0d95cadd7854dc03ee"
UPSTREAM_CHECK_REGEX = "mpg123-(?P<pver>\d+(\.\d+)+)\.tar"
1.33.7 ------ - mpg123: -- Fix heap buffer overflows in unicode path conversion on Windows (bug 388, thanks to Alejandro Ramos). -- Fix information disclosure of uninitialied memory for --auth-file without line endings. (bug 390, thanks to Alejandro Ramos) -- Fix out-of-bounds read/write when combining --continue --random --listentry <n> where n is larger than the playlist size. (bug 391, thanks to Alejandro Ramos) -- Fix a harmless valgrind memory leak report by not nulling playlist name. -- Fix error handling of win32_net_writestring() (Windows only) by actually using a signed type, also preventing a OOB read on failure. (bug 392 by Alejandro Ramos) -- Fix a mostly harmless OOB read of 1 byte when printing USLT lyrics. (bug 392) -- Fix leaking file descriptor on read error from --equalizer file. (bug 392) -- Hardening of loading HTTP(S) via curl or wget against funky URLs by including the -- separator. No actual vulnerability, tough, just extra care. (bug 392) - out123: -- Fix heap overrun on --endian conversion with differing input and output channel counts. (bug 391) -- Fix parsing of filter specs with whitespace before commas, which resulted in out-of-bounds writes before. (bug 391) - libmpg123, mpg123: Harden memory realloc calls against multiplication overflow of size_t in arguments. Specifically, this addresses part of bug 389 with possible application abuse of mpg123_set_index64(). (bug 389 by Alejandro Ramos) - libmpg123: -- Fix possible use of uninitialized values in layer III dequantization. III_dequantize_sample() for consistent output also for strange input. The new code seems to be slightly faster after some rearrangements. (thanks to He Huang, Swinburne University of Technology (discovered using NexusSan)) -- Fix a double free when deleting a handle after failed mpg123_decoder() call (possibly among others). (bug 389) -- More strong wording in API that ID3 text convenience links are short-lived, but safeguard against ignorant use by nulling them early. (bug 389) -- Prevent double free in mpg123_set_index() 32 bit wrapper being called with index size 0. (bug 392) -- Harden against an application wielding a foot gun by handing in an undersized decoding buffer betwee seek and read (return error before trying to decode and discard frames in that case). (bug 392) -- Do properly terminate ID3v2 texts coming in UTF16 encoding when they overwrite previous frames, like with other encodings. The symptom was a shorter second frame resulting in a combined text with the earlier longer frame. (bug 392) -- Check and properly handle null source buffer and zero size in mpg123_store_utf8() instead of reading past (before) buffers. (bug 392) -- Ensure clients get ID3v1 data with (unmotivated) mpg123_id3_raw() only if the parser decided that it is there, not possibly the last 128 bytes of a seekable stream without ID3v1 tag. (bug 392) -- Prevent impossible NtoM resampling with too low target rate (like 1 Hz) which would trgger endless looping. (bug 392) - libout123: -- Fix deadlock in buffer mode when combined with (stereo) 24 bit output. Now also mpg123 --buffer 4096 -e s24 shall actuallly work. Sorry. (bug 392) -- Abort early on zero/negative rate and channel count in out123_start(). (bug 392) -- Fix divide by zero in WAV writing by catching channel counts that go zero in the 16 bit WAV header field. (bug 392) - libsyn123: -- Explictly reject mismatched format for appending filters with syn123_setup_filter(), preventing memory errors from that API-violating use. (bug 392) -- Harden the dirty resampling interpolator against extreme rates (around 1e18 Hz) by fixing a sample offset check to not do the exact overflowing addition that it is supposed to guard against. The fine resampler was … fine. (bug 392) -- Error out on trying to create a filter of order 0 instead of dividing by zero later. (bug 392) Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> --- .../mpg123/{mpg123_1.33.6.bb => mpg123_1.33.7.bb} | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) rename meta/recipes-multimedia/mpg123/{mpg123_1.33.6.bb => mpg123_1.33.7.bb} (96%)