1.25.2
------
- libmpg123:
-- Extend pow tables for layer III to properly handle files with i-stereo and
5-bit scalefactors. Never observed them for real, just as fuzzed input to
trigger the read overflow. Note: This one goes on record as CVE-2017-11126,
calling remote denial of service. While the accesses are out of bounds for
the pow tables, they still are safely within libmpg123's memory (other
static tables). Just wrong values are used for computation, no actual crash
unless you use something like GCC's AddressSanitizer, nor any information
disclosure.
-- Avoid left-shifts of negative integers in layer I decoding.
1.25.1: Hot Fuzz
-------
- libmpg123:
-- Avoid memset(NULL, 0, 0) to calm down the paranoid.
-- Fix bug 252, invalid read of size 1 in ID3v2 parser due to forgotten
offset from the frame flag bytes (unnoticed in practice for a long
time). Fuzzers are in the house again. This one got CVE-2017-10683.
-- Avoid a mostly harmless conditional jump depending on uninitialised
fr->lay in compute_bpf() (mpg123_position()) when track is not ready yet.
-- Fix undefined shifts on signed long mask in layer3.c (worked in practice,
never right in theory). Code might be a bit faster now, even.
Thanks to Agostino Sarubbo for reporting.
1.25.0: MP3 now patent-free worldwide!
-------
- Silence test for artsc-config if it is not there.
- Make sure -static-libgcc from LDFLAGS gets through libtool,
fixing 32 bit Windows builds (depend on libgcc DLL otherwise).
- Fix build with non-GNU make by using plain rm -f instead of silly $(RM)
in libout123/modules makefile fragment.
- Make build work on iOS, including coreaudio backend.
- libmpg123:
-- Finally provide position-independent code for x86 with assembly
optimisations.The textrels are gone thanks to Won Kyu Park and Taihei Momma.
-- Clarify some license language in files descending from the original MMX
optimisation.
-- Fix return value overflow check for MPG123_BUFFERFILL.
-- Introduced mpg123_getformat2() to enable the FORMAT command
for the generic control not stealing MPG123_NEW_FORMAT from the main
playback loop. The sequence LOADPAUSED-FORMAT-PAUSE (play) is supposed
to work now.
-- Enable aarch64 optimisations on *BSD by default, too. You can always
override that stupid OS whitelist using --with-optimization, anyway.
-- Use of the i486 decoder is now discouraged more prominently, in configure
output.
- out123: Fix stupid crash with verbose mode and tone generation (print
the string if the pointer is non-null, not if it is null).
- libout123: More consistent error messages for dynamic and legacy
(built-in) modules. Namely, you get a hint how if you choose a different
module than the built-in ones for a static libout123.
3644cd8e76