buildroot/package/mpg123, branch 2017.11

mpg123: security bump to version 1.25.2

2017-07-11T19:31:07+00:00

>From the release notes: - Extend pow tables for layer III to properly handle files with i-stereo and 5-bit scalefactors. Never observed them for real, just as fuzzed input to trigger the read overflow. Note: This one goes on record as CVE-2017-11126, calling remote denial of service. While the accesses are out of bounds for the pow tables, they still are safely within libmpg123's memory (other static tables). Just wrong values are used for computation, no actual crash unless you use something like GCC's AddressSanitizer, nor any information disclosure. - Avoid left-shifts of negative integers in layer I decoding. While we're at it, add a hash for the license file. Signed-off-by: Peter Korsgaard

mpg123: security bump to version 1.25.1

2017-07-03T19:59:51+00:00

>From the release notes: - Avoid memset(NULL, 0, 0) to calm down the paranoid. - Fix bug 252, invalid read of size 1 in ID3v2 parser due to forgotten offset from the frame flag bytes (unnoticed in practice for a long time). Fuzzers are in the house again. This one got CVE-2017-10683. https://sourceforge.net/p/mpg123/bugs/252/ - Avoid a mostly harmless conditional jump depending on uninitialised fr->lay in compute_bpf() (mpg123_position()) when track is not ready yet. - Fix undefined shifts on signed long mask in layer3.c (worked in practice, never right in theory). Code might be a bit faster now, even. Thanks to Agostino Sarubbo for reporting. dlopen() is now directly used to load output modules (and the --with-modules-suffix option has been removed), so adjust the modules logic to match. Signed-off-by: Peter Korsgaard

boot, package: use SPDX short identifier for LGPLv2.1/LGPLv2.1+

2017-04-01T13:18:10+00:00

We want to use SPDX identifier for license string as much as possible. SPDX short identifier for LGPLv2.1/LGPLv2.1+ is LGPL-2.1/LGPL-2.1+. This change is done using following command. find . -name "*.mk" | xargs sed -ri '/LICENSE( )?[\+:]?=/s/LGPLv2.1(\+)?/LGPL-2.1\1/g' Signed-off-by: Rahul Bedarkar Signed-off-by: Thomas Petazzoni

mpg123: security bump to version 1.23.8

2016-09-27T14:59:40+00:00

Fixes an out-of-bounds memory read in the ID3v2 parser for tags that claim an unrealistically small length. This crashes mpg123 or any application using libmpg123 with activated ID3v2 parsing. Signed-off-by: Gustavo Zacarias Signed-off-by: Peter Korsgaard

mpg123: bump to version 1.23.7

2016-09-25T21:13:30+00:00

Signed-off-by: Gustavo Zacarias Signed-off-by: Thomas Petazzoni

mpg123: bump to version 1.23.6

2016-06-30T22:01:34+00:00

Signed-off-by: Gustavo Zacarias Signed-off-by: Thomas Petazzoni

mpg123: bump to version 1.23.5

2016-06-26T20:25:02+00:00

Drop upstreamed patch and related autoreconf. Signed-off-by: Gustavo Zacarias Signed-off-by: Thomas Petazzoni

Merge branch 'next'

2016-06-01T15:55:16+00:00

Signed-off-by: Peter Korsgaard

mpg123: unbreak static linking with alsa/portaudio

2016-05-25T05:44:46+00:00

Fixes: http://autobuild.buildroot.org/results/b2b/b2bc143fbd0b34e75a44af41ab6899dd9fa3c21a/ http://autobuild.buildroot.org/results/60d/60d56b0a75d209f2cfeff0727c2f900abc89d263/ http://autobuild.buildroot.org/results/6a8/6a8729ce69055821fdf0b91adcea2ea201d40189/ And many more. A recent upstream build system change caused LIBS to be ignored at build time (but still used a configure time), causing our static linking workarounds to no longer work. Fix it by adding a patch to cause it to no longer ignore LIBS. Signed-off-by: Peter Korsgaard

mpg123: bump to version 1.23.4

2016-05-15T19:39:22+00:00

Signed-off-by: Gustavo Zacarias Signed-off-by: Thomas Petazzoni