Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package mpg123 for openSUSE:Factory checked in at 2026-08-04 21:28:07 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/mpg123 (Old) and /work/SRC/openSUSE:Factory/.mpg123.new.16738 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "mpg123" Tue Aug 4 21:28:07 2026 rev:52 rq:1369234 version:1.33.7 Changes: -------- --- /work/SRC/openSUSE:Factory/mpg123/mpg123.changes 2026-06-09 14:11:59.951946074 +0200 +++ /work/SRC/openSUSE:Factory/.mpg123.new.16738/mpg123.changes 2026-08-04 21:28:43.260237686 +0200 @@ -1,0 +2,79 @@ +Mon Aug 3 11:05:06 UTC 2026 - Luigi Baldoni <[email protected]> + +- Update to version 1.33.7 + mpg123: + * Fix information disclosure of uninitialied memory for + --auth-file without line endings. + * Fix out-of-bounds read/write when combining --continue + --random --listentry <n> where n is larger than the playlist + size. + * Fix a harmless valgrind memory leak report by not nulling + playlist name. + * Fix a mostly harmless OOB read of 1 byte when printing USLT + lyrics. + * Fix leaking file descriptor on read error from --equalizer + file. + * Hardening of loading HTTP(S) via curl or wget against funky + URLs by including the -- separator. No actual vulnerability, + tough, just extra care. + out123: + * Fix heap overrun on --endian conversion with differing input + and output channel counts. + * Fix parsing of filter specs with whitespace before commas, + which resulted in out-of-bounds writes before. + libmpg123, mpg123: Harden memory realloc calls against + multiplication overflow of size_t in arguments. + Specifically, this addresses part of bug 389 with possible + application abuse of mpg123_set_index64(). + libmpg123: + * Fix possible use of uninitialized values in layer III + dequantization. + III_dequantize_sample() for consistent output also for + strange input. The new code seems to be slightly faster + after some rearrangements. + * Fix a double free when deleting a handle after failed + mpg123_decoder() call + (possibly among others). + * More strong wording in API that ID3 text convenience links + are short-lived, but safeguard against ignorant use by + nulling them early. + * Prevent double free in mpg123_set_index() 32 bit wrapper + being called with index size 0. + * Harden against an application wielding a foot gun by handing + in an undersized decoding buffer betwee seek and read + (return error before trying to decode and discard frames in + that case). + * Do properly terminate ID3v2 texts coming in UTF16 encoding + when they overwrite previous frames, like with other + encodings. The symptom was a shorter second frame resulting + in a combined text with the earlier longer frame. + * Check and properly handle null source buffer and zero size + in mpg123_store_utf8() instead of reading past (before) + buffers. + * Ensure clients get ID3v1 data with (unmotivated) + mpg123_id3_raw() only if the parser decided that it is there, + not possibly the last 128 bytes of a seekable stream without + ID3v1 tag. + * Prevent impossible NtoM resampling with too low target rate + (like 1 Hz) which would trgger endless looping. + libout123: + * Fix deadlock in buffer mode when combined with (stereo) 24 + bit output. Now also mpg123 --buffer 4096 -e s24 shall + actuallly work. Sorry. + * Abort early on zero/negative rate and channel count in + out123_start(). + * Fix divide by zero in WAV writing by catching channel counts + that go zero in the 16 bit WAV header field. + libsyn123: + * Explictly reject mismatched format for appending filters with + syn123_setup_filter(), preventing memory errors from that + API-violating use. + * Harden the dirty resampling interpolator against extreme + rates (around 1e18 Hz) + by fixing a sample offset check to not do the exact + overflowing addition that it is supposed to guard against. + The fine resampler was… fine. + * Error out on trying to create a filter of order 0 instead of + dividing by zero later. + +------------------------------------------------------------------- Old: ---- mpg123-1.33.6.tar.bz2 mpg123-1.33.6.tar.bz2.sig New: ---- mpg123-1.33.7.tar.bz2 mpg123-1.33.7.tar.bz2.sig ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ mpg123.spec ++++++ --- /var/tmp/diff_new_pack.ba0I84/_old 2026-08-04 21:28:44.256272156 +0200 +++ /var/tmp/diff_new_pack.ba0I84/_new 2026-08-04 21:28:44.260272295 +0200 @@ -18,7 +18,7 @@ %define sover 0 Name: mpg123 -Version: 1.33.6 +Version: 1.33.7 Release: 0 Summary: Console MPEG audio player and decoder library License: LGPL-2.1-only ++++++ mpg123-1.33.6.tar.bz2 -> mpg123-1.33.7.tar.bz2 ++++++ diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/mpg123-1.33.6/Makefile.in new/mpg123-1.33.7/Makefile.in --- old/mpg123-1.33.6/Makefile.in 2026-06-06 10:43:12.000000000 +0200 +++ new/mpg123-1.33.7/Makefile.in 2026-08-02 23:08:34.000000000 +0200 @@ -2255,6 +2255,7 @@ src_tests_sweeper_LDADD = \ src/compat/libcompat.la \ + @LIBM@ \ $(LIBSYN123) \ $(LIBOUT123) diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/mpg123-1.33.6/NEWS new/mpg123-1.33.7/NEWS --- old/mpg123-1.33.6/NEWS 2026-06-06 10:41:01.000000000 +0200 +++ new/mpg123-1.33.7/NEWS 2026-08-02 23:07:42.000000000 +0200 @@ -1,3 +1,73 @@ +1.33.7 +------ +- mpg123: +-- Fix heap buffer overflows in unicode path conversion on Windows (bug 388, + thanks to Alejandro Ramos). +-- Fix information disclosure of uninitialied memory for --auth-file without + line endings. (bug 390, thanks to Alejandro Ramos) +-- Fix out-of-bounds read/write when combining --continue --random --listentry <n> + where n is larger than the playlist size. (bug 391, thanks to Alejandro Ramos) +-- Fix a harmless valgrind memory leak report by not nulling playlist name. +-- Fix error handling of win32_net_writestring() (Windows only) by actually using + a signed type, also preventing a OOB read on failure. + (bug 392 by Alejandro Ramos) +-- Fix a mostly harmless OOB read of 1 byte when printing USLT lyrics. + (bug 392) +-- Fix leaking file descriptor on read error from --equalizer file. (bug 392) +-- Hardening of loading HTTP(S) via curl or wget against funky URLs by including + the -- separator. No actual vulnerability, tough, just extra care. (bug 392) +- out123: +-- Fix heap overrun on --endian conversion with differing input and output + channel counts. (bug 391) +-- Fix parsing of filter specs with whitespace before commas, which resulted + in out-of-bounds writes before. (bug 391) +- libmpg123, mpg123: Harden memory realloc calls against multiplication overflow + of size_t in arguments. Specifically, this addresses part of bug 389 with possible + application abuse of mpg123_set_index64(). (bug 389 by Alejandro Ramos) +- libmpg123: +-- Fix possible use of uninitialized values in layer III dequantization. + III_dequantize_sample() for consistent output also for strange input. The new + code seems to be slightly faster after some rearrangements. + (thanks to He Huang, Swinburne University of Technology (discovered using + NexusSan)) +-- Fix a double free when deleting a handle after failed mpg123_decoder() call + (possibly among others). (bug 389) +-- More strong wording in API that ID3 text convenience links are short-lived, + but safeguard against ignorant use by nulling them early. + (bug 389) +-- Prevent double free in mpg123_set_index() 32 bit wrapper being called with + index size 0. (bug 392) +-- Harden against an application wielding a foot gun by handing in an undersized + decoding buffer betwee seek and read (return error before trying to decode + and discard frames in that case). (bug 392) +-- Do properly terminate ID3v2 texts coming in UTF16 encoding when they overwrite + previous frames, like with other encodings. The symptom was a shorter second + frame resulting in a combined text with the earlier longer frame. + (bug 392) +-- Check and properly handle null source buffer and zero size in mpg123_store_utf8() + instead of reading past (before) buffers. (bug 392) +-- Ensure clients get ID3v1 data with (unmotivated) mpg123_id3_raw() + only if the parser decided that it is there, not possibly the last 128 bytes of + a seekable stream without ID3v1 tag. (bug 392) +-- Prevent impossible NtoM resampling with too low target rate (like 1 Hz) which + would trgger endless looping. (bug 392) +- libout123: +-- Fix deadlock in buffer mode when combined with (stereo) 24 bit output. Now + also mpg123 --buffer 4096 -e s24 shall actuallly work. Sorry. (bug 392) +-- Abort early on zero/negative rate and channel count in out123_start(). + (bug 392) +-- Fix divide by zero in WAV writing by catching channel counts that go zero in the + 16 bit WAV header field. (bug 392) +- libsyn123: +-- Explictly reject mismatched format for appending filters with + syn123_setup_filter(), preventing memory errors from that API-violating use. + (bug 392) +-- Harden the dirty resampling interpolator against extreme rates (around 1e18 Hz) + by fixing a sample offset check to not do the exact overflowing addition + that it is supposed to guard against. The fine resampler was … fine. (bug 392) +-- Error out on trying to create a filter of order 0 instead of dividing by zero + later. (bug 392) + 1.33.6 ------ - mpg123 diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/mpg123-1.33.6/configure new/mpg123-1.33.7/configure --- old/mpg123-1.33.6/configure 2026-06-06 10:43:10.000000000 +0200 +++ new/mpg123-1.33.7/configure 2026-08-02 23:08:31.000000000 +0200 @@ -1,6 +1,6 @@ #! /bin/sh # Guess values for system-dependent variables and create Makefiles. -# Generated by GNU Autoconf 2.71 for mpg123 1.33.6. +# Generated by GNU Autoconf 2.71 for mpg123 1.33.7. # # Report bugs to <[email protected]>. # @@ -621,8 +621,8 @@ # Identity of this package. PACKAGE_NAME='mpg123' PACKAGE_TARNAME='mpg123' -PACKAGE_VERSION='1.33.6' -PACKAGE_STRING='mpg123 1.33.6' +PACKAGE_VERSION='1.33.7' +PACKAGE_STRING='mpg123 1.33.7' PACKAGE_BUGREPORT='[email protected]' PACKAGE_URL='' @@ -1727,7 +1727,7 @@ # Omit some internal or obsolete options to make the list less imposing. # This message is too long to be a string in the A/UX 3.1 sh. cat <<_ACEOF -\`configure' configures mpg123 1.33.6 to adapt to many kinds of systems. +\`configure' configures mpg123 1.33.7 to adapt to many kinds of systems. Usage: $0 [OPTION]... [VAR=VALUE]... @@ -1798,7 +1798,7 @@ if test -n "$ac_init_help"; then case $ac_init_help in - short | recursive ) echo "Configuration of mpg123 1.33.6:";; + short | recursive ) echo "Configuration of mpg123 1.33.7:";; esac cat <<\_ACEOF @@ -2077,7 +2077,7 @@ test -n "$ac_init_help" && exit $ac_status if $ac_init_version; then cat <<\_ACEOF -mpg123 configure 1.33.6 +mpg123 configure 1.33.7 generated by GNU Autoconf 2.71 Copyright (C) 2021 Free Software Foundation, Inc. @@ -2622,7 +2622,7 @@ This file contains any messages produced by compilers while running configure, to aid debugging if configure makes a mistake. -It was created by mpg123 $as_me 1.33.6, which was +It was created by mpg123 $as_me 1.33.7, which was generated by GNU Autoconf 2.71. Invocation command line was $ $0$ac_configure_args_raw @@ -3992,7 +3992,7 @@ # Define the identity of the package. PACKAGE='mpg123' - VERSION='1.33.6' + VERSION='1.33.7' printf "%s\n" "#define PACKAGE \"$PACKAGE\"" >>confdefs.h @@ -22468,7 +22468,7 @@ # report actual input values of CONFIG_FILES etc. instead of their # values after options handling. ac_log=" -This file was extended by mpg123 $as_me 1.33.6, which was +This file was extended by mpg123 $as_me 1.33.7, which was generated by GNU Autoconf 2.71. Invocation command line was CONFIG_FILES = $CONFIG_FILES @@ -22536,7 +22536,7 @@ cat >>$CONFIG_STATUS <<_ACEOF || ac_write_fail=1 ac_cs_config='$ac_cs_config_escaped' ac_cs_version="\\ -mpg123 config.status 1.33.6 +mpg123 config.status 1.33.7 configured by $0, generated by GNU Autoconf 2.71, with options \\"\$ac_cs_config\\" diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/mpg123-1.33.6/mpg123.spec new/mpg123-1.33.7/mpg123.spec --- old/mpg123-1.33.6/mpg123.spec 2026-06-06 10:43:57.000000000 +0200 +++ new/mpg123-1.33.7/mpg123.spec 2026-08-02 23:08:47.000000000 +0200 @@ -3,7 +3,7 @@ # - devel packages for alsa, sdl, etc... to build the respective output modules. Summary: The fast console mpeg audio decoder/player. Name: mpg123 -Version: 1.33.6 +Version: 1.33.7 Release: 1 URL: http://www.mpg123.org/ License: GPL diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/mpg123-1.33.6/src/compat/compat.h new/mpg123-1.33.7/src/compat/compat.h --- old/mpg123-1.33.6/src/compat/compat.h 2026-06-06 10:39:41.000000000 +0200 +++ new/mpg123-1.33.7/src/compat/compat.h 2026-08-02 23:07:42.000000000 +0200 @@ -166,6 +166,8 @@ /* A safe realloc also for very old systems where realloc(NULL, size) returns NULL. */ void *INT123_safe_realloc(void *ptr, size_t size); +// Use this instead of realloc(ptr, size*sizeof(member)) to check for size_t overflow. +void *INT123_safe_reallocn(void *ptr, size_t size_factor1, size_t size_factor2); // Also freeing ptr if result is NULL. You can do // ptr = INT123_safer_realloc(ptr, size) // Also, ptr = INT123_safer_realloc(ptr, 0) will do free(ptr); ptr=NULL;. diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/mpg123-1.33.6/src/compat/compat_str.c new/mpg123-1.33.7/src/compat/compat_str.c --- old/mpg123-1.33.6/src/compat/compat_str.c 2026-06-06 10:39:41.000000000 +0200 +++ new/mpg123-1.33.7/src/compat/compat_str.c 2026-08-02 23:07:42.000000000 +0200 @@ -35,6 +35,16 @@ else return realloc(ptr, size); } +/* A variant that checks for multiplication overflow. */ +void *INT123_safe_reallocn(void *ptr, size_t size_factor1, size_t size_factor2) +{ + if(size_factor2 && size_factor1 > SIZE_MAX/size_factor2) + return NULL; + size_t size = size_factor1 * size_factor2; + if(ptr == NULL) return malloc(size); + else return realloc(ptr, size); +} + // A more sensible variant of realloc: It deallocates the original memory if // realloc fails or if size zero was requested. void *INT123_safer_realloc(void *ptr, size_t size) @@ -92,7 +102,7 @@ if(!buf) len = 0; else { if (len != 0) ret = WideCharToMultiByte(cp, 0, wptr, -1, buf, len, NULL, NULL); /*Do actual conversion*/ - buf[len] = '0'; /* Must terminate */ + buf[len] = 0; /* Must terminate */ } *mbptr = buf; /* Set string pointer to allocated buffer */ if(buflen != NULL) *buflen = (len) * sizeof (char); /* Give length of allocated memory if needed. */ @@ -121,7 +131,7 @@ if(!buf) len = 0; else { if (len != 0) ret = MultiByteToWideChar (CP_UTF8, MB_ERR_INVALID_CHARS, mbptr, -1, buf, len); /* Do conversion */ - buf[len] = L'0'; /* Must terminate */ + buf[len] = 0; /* Must terminate */ } *wptr = buf; /* Set string pointer to allocated buffer */ if (buflen != NULL) *buflen = len * sizeof (wchar_t); /* Give length of allocated memory if needed. */ diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/mpg123-1.33.6/src/compat/wpathconv.h new/mpg123-1.33.7/src/compat/wpathconv.h --- old/mpg123-1.33.6/src/compat/wpathconv.h 2026-06-06 10:39:41.000000000 +0200 +++ new/mpg123-1.33.7/src/compat/wpathconv.h 2026-08-02 23:07:42.000000000 +0200 @@ -77,7 +77,7 @@ } plen = wcslen(prefix); len = plen + wcslen(wpath); - wlpath = malloc(len+1*sizeof(wchar_t)); + wlpath = malloc((len+1)*sizeof(wchar_t)); if(wlpath) { /* Brute force memory copying, swprintf is too dandy. */ diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/mpg123-1.33.6/src/equalizer.c new/mpg123-1.33.7/src/equalizer.c --- old/mpg123-1.33.6/src/equalizer.c 2026-06-06 10:39:42.000000000 +0200 +++ new/mpg123-1.33.7/src/equalizer.c 2026-08-02 23:07:43.000000000 +0200 @@ -31,6 +31,7 @@ if(!fgets(line,255,fe)) { error("equalizer file read error"); + fclose(fe); return -1; } } diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/mpg123-1.33.6/src/filters.c new/mpg123-1.33.7/src/filters.c --- old/mpg123-1.33.6/src/filters.c 2026-06-06 10:39:42.000000000 +0200 +++ new/mpg123-1.33.7/src/filters.c 2026-08-02 23:07:43.000000000 +0200 @@ -84,10 +84,10 @@ fl->coeff[ci+fcoeffs] = strtod(spec, &nspec); fcoeffs++; spec += nspec-spec; - if(*spec == ',') - ++spec; while(isspace(*spec)) ++spec; + if(*spec == ',') + ++spec; } if(errno) { diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/mpg123-1.33.6/src/include/mpg123.h new/mpg123-1.33.7/src/include/mpg123.h --- old/mpg123-1.33.6/src/include/mpg123.h 2026-06-06 10:39:41.000000000 +0200 +++ new/mpg123-1.33.7/src/include/mpg123.h 2026-08-02 23:07:43.000000000 +0200 @@ -325,7 +325,14 @@ ,MPG123_SEEKBUFFER = 0x100 /**< 000100000000 Enable small buffer on non-seekable streams to allow some peek-ahead (for better MPEG sync). */ ,MPG123_FUZZY = 0x200 /**< 001000000000 Enable fuzzy seeks (guessing byte offsets or using approximate seek points from Xing TOC) */ ,MPG123_FORCE_FLOAT = 0x400 /**< 010000000000 Force floating point output (32 or 64 bits depends on mpg123 internal precision). */ - ,MPG123_PLAIN_ID3TEXT = 0x800 /**< 100000000000 Do not translate ID3 text data to UTF-8. ID3 strings will contain the raw text data, with the first byte containing the ID3 encoding code. */ + ,MPG123_PLAIN_ID3TEXT = 0x800 /**< 100000000000 Do not convert ID3 text data. + * ID3 strings will contain the raw text data, with the first byte + * containing the ID3 encoding code. The bytes appear as in the ID3 tag. + * This means that there is no zero termination, no sanitation. + * You need to explicitly process the data with the given buffer fill + * and encoding value before handing it over to library routins expecting + * zero-terminated byte strings, for example. + */ ,MPG123_IGNORE_STREAMLENGTH = 0x1000 /**< 1000000000000 Ignore any stream length information contained in the stream, which can be contained in a 'TLEN' frame of an ID3v2 tag or a Xing tag */ ,MPG123_SKIP_ID3V2 = 0x2000 /**< 10 0000 0000 0000 Do not parse ID3v2 tags, just skip them. */ ,MPG123_IGNORE_INFOFRAME = 0x4000 /**< 100 0000 0000 0000 Do not parse the LAME/Xing info frame, treat it as normal MPEG data. */ @@ -2067,6 +2074,8 @@ /** Point v1 and v2 to existing data structures wich may change on any next read/decode function call. * v1 and/or v2 can be set to NULL when there is no corresponding data. + * I repeat: Access of these pointed-to structures is only valid between mpg123_id3() and + * any other API call. Make copies if you want to keep things. * \return MPG123_OK on success */ MPG123_EXPORT int mpg123_id3( mpg123_handle *mh diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/mpg123-1.33.6/src/libmpg123/frame.c new/mpg123-1.33.7/src/libmpg123/frame.c --- old/mpg123-1.33.6/src/libmpg123/frame.c 2026-06-06 10:39:41.000000000 +0200 +++ new/mpg123-1.33.7/src/libmpg123/frame.c 2026-08-02 23:07:44.000000000 +0200 @@ -588,6 +588,7 @@ fr->conv16to8_buf = NULL; #endif if(fr->layerscratch != NULL) free(fr->layerscratch); + fr->layerscratch = NULL; } void INT123_frame_exit(mpg123_handle *fr) diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/mpg123-1.33.6/src/libmpg123/id3.c new/mpg123-1.33.7/src/libmpg123/id3.c --- old/mpg123-1.33.6/src/libmpg123/id3.c 2026-06-06 10:39:41.000000000 +0200 +++ new/mpg123-1.33.7/src/libmpg123/id3.c 2026-08-02 23:07:44.000000000 +0200 @@ -241,7 +241,9 @@ } mdebug("add_id3_text: append to list of %zu", *size); // Nothing found, add new one. - mpg123_text *x = INT123_safe_realloc(*list, sizeof(mpg123_text)*(*size+1)); + mpg123_text *x = (*size < SIZE_MAX) + ? INT123_safe_reallocn(*list, sizeof(mpg123_text), (*size+1)) + : NULL; if(x == NULL) return NULL; /* bad */ *list = x; @@ -269,7 +271,9 @@ return entry; } // Append a new one. - mpg123_picture *x = INT123_safe_realloc(*list, sizeof(mpg123_picture)*(*size+1)); + mpg123_picture *x = (*size < SIZE_MAX) + ? INT123_safe_reallocn(*list, sizeof(mpg123_picture), (*size+1)) + : NULL; if(x == NULL) return NULL; /* bad */ *list = x; @@ -978,6 +982,7 @@ } else { + null_id3_links(fr); // Could be invalidated on frame update, null for hygiene. unsigned char* tagdata = fr->id3v2_raw+10; /* try to interpret that beast */ debug("ID3v2: analysing frames..."); @@ -1457,8 +1462,8 @@ *p++ = (unsigned char) (0x80 | (codepoint & 0x3f)); } /* ignore bigger ones (that are not possible here anyway) */ } - sb->p[sb->size-1] = 0; /* paranoia... */ - sb->fill = sb->size; + sb->p[length] = 0; + sb->fill = length+1; } #undef UTF8LEN #undef FULLPOINT diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/mpg123-1.33.6/src/libmpg123/index.c new/mpg123-1.33.7/src/libmpg123/index.c --- old/mpg123-1.33.6/src/libmpg123/index.c 2026-06-06 10:39:41.000000000 +0200 +++ new/mpg123-1.33.7/src/libmpg123/index.c 2026-08-02 23:07:44.000000000 +0200 @@ -63,7 +63,7 @@ while(fi->fill > newsize){ fi_shrink(fi); } } - newdata = INT123_safe_realloc(fi->data, newsize*sizeof(int64_t)); + newdata = INT123_safe_reallocn(fi->data, newsize, sizeof(int64_t)); if(newsize == 0 || newdata != NULL) { fi->data = newdata; diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/mpg123-1.33.6/src/libmpg123/layer3.c new/mpg123-1.33.7/src/libmpg123/layer3.c --- old/mpg123-1.33.6/src/libmpg123/layer3.c 2026-06-06 10:39:41.000000000 +0200 +++ new/mpg123-1.33.7/src/libmpg123/layer3.c 2026-08-02 23:07:44.000000000 +0200 @@ -518,6 +518,18 @@ int gainpow2_scale_idx = 378; #endif + // Writes to xr jump around wildly with corrupted files. It is not guaranteed + // that all values are correctly written to. Zero all values beforehand + // to have a clean slate, instead of trying to do that afterwards. + // All branches that zero a value can also be dropped, then. + // After some micro optimization here and there, the resulting code seems + // to be up to 3 % faster than before with AVX decoder, but this depends a + // lot on the target CPU, could give a small hit on some. + // This loop here also seems to be a bit faster than calling memset(0). + for(int i=0; i<SBLIMIT; ++i) + for(int j=0; j<SSLIMIT; ++j) + xr[i][j] = DOUBLE_TO_REAL(0.0); + /* Assumption: If there is some part2_3_length at all, there should be enough of it to work with properly. In case of zero length we silently zero things. */ @@ -563,12 +575,26 @@ } } -#define CHECK_XRPNT if(xrpnt >= xrpntlimit) \ +// About 2/3 of checks when checking on use. +//#define CHECK_XRPNT_ON_SET 1 + +#ifdef CHECK_XRPNT_ON_SET +#define CHECK_XRPNT_SET do { if(xrpnt >= xrpntlimit) \ +{ \ + if(NOQUIET) \ + error2("attempted xrpnt overflow (%p !< %p)", (void*) xrpnt, (void*) xrpntlimit); \ + return 1; \ +} } while(0) +#define CHECK_XRPNT_USE +#else +#define CHECK_XRPNT_SET +#define CHECK_XRPNT_USE do { if(xrpnt >= xrpntlimit) \ { \ if(NOQUIET) \ error2("attempted xrpnt overflow (%p !< %p)", (void*) xrpnt, (void*) xrpntlimit); \ return 1; \ -} +} } while(0) +#endif if(gr_info->block_type == 2) { @@ -605,8 +631,8 @@ if( (!mc) ) { mc = *m++; -//fprintf(stderr, "%i setting xrpnt = xr + %i (%ld)\n", __LINE__, *m, xrpnt-(real*)xr); xrpnt = ((real *) xr) + (*m++); + CHECK_XRPNT_SET; lwin = *m++; cb = *m++; if(lwin == 3) @@ -652,7 +678,6 @@ y &= 0xf; #endif } - CHECK_XRPNT; if(x == 15 && h->linbits) { max[lwin] = cb; @@ -660,6 +685,7 @@ x += ((MASK_UTYPE) mask) >> (BITSHIFT+8-h->linbits); num -= h->linbits+1; mask <<= h->linbits; + CHECK_XRPNT_USE; if(MSB_MASK) *xrpnt = REAL_MUL_SCALE_LAYER3(-ispow[x], v, gainpow2_scale_idx); else *xrpnt = REAL_MUL_SCALE_LAYER3( ispow[x], v, gainpow2_scale_idx); @@ -668,16 +694,16 @@ else if(x) { max[lwin] = cb; + CHECK_XRPNT_USE; if(MSB_MASK) *xrpnt = REAL_MUL_SCALE_LAYER3(-ispow[x], v, gainpow2_scale_idx); else *xrpnt = REAL_MUL_SCALE_LAYER3( ispow[x], v, gainpow2_scale_idx); num--; mask <<= 1; } - else *xrpnt = DOUBLE_TO_REAL(0.0); xrpnt += step; - CHECK_XRPNT; + CHECK_XRPNT_SET; if(y == 15 && h->linbits) { max[lwin] = cb; @@ -685,6 +711,7 @@ y += ((MASK_UTYPE) mask) >> (BITSHIFT+8-h->linbits); num -= h->linbits+1; mask <<= h->linbits; + CHECK_XRPNT_USE; if(MSB_MASK) *xrpnt = REAL_MUL_SCALE_LAYER3(-ispow[y], v, gainpow2_scale_idx); else *xrpnt = REAL_MUL_SCALE_LAYER3( ispow[y], v, gainpow2_scale_idx); @@ -693,15 +720,16 @@ else if(y) { max[lwin] = cb; + CHECK_XRPNT_USE; if(MSB_MASK) *xrpnt = REAL_MUL_SCALE_LAYER3(-ispow[y], v, gainpow2_scale_idx); else *xrpnt = REAL_MUL_SCALE_LAYER3( ispow[y], v, gainpow2_scale_idx); num--; mask <<= 1; } - else *xrpnt = DOUBLE_TO_REAL(0.0); xrpnt += step; + CHECK_XRPNT_SET; } } @@ -735,8 +763,8 @@ if(!mc) { mc = *m++; -//fprintf(stderr, "%i setting xrpnt = xr + %i (%ld)\n", __LINE__, *m, xrpnt-(real*)xr); xrpnt = ((real *) xr) + (*m++); + CHECK_XRPNT_SET; lwin = *m++; cb = *m++; if(lwin == 3) @@ -758,22 +786,22 @@ } mc--; } - CHECK_XRPNT; if( (a & (0x8>>i)) ) { max[lwin] = cb; if(part2remain+num <= 0) break; + CHECK_XRPNT_USE; if(MSB_MASK) *xrpnt = -REAL_SCALE_LAYER3(v, gainpow2_scale_idx); else *xrpnt = REAL_SCALE_LAYER3(v, gainpow2_scale_idx); num--; mask <<= 1; } - else *xrpnt = DOUBLE_TO_REAL(0.0); xrpnt += step; + CHECK_XRPNT_SET; } } @@ -781,19 +809,24 @@ { /* short band? */ while(1) { - for(;mc > 0;mc--) + if(m >= me) { - CHECK_XRPNT; - *xrpnt = DOUBLE_TO_REAL(0.0); xrpnt += 3; /* short band -> step=3 */ - *xrpnt = DOUBLE_TO_REAL(0.0); xrpnt += 3; + if(mc > 0) + { + // No actual writes here because xr has been zeroed before. + // short band -> step=3, two steps per mc round + xrpnt += 6*mc; + mc = 0; + CHECK_XRPNT_SET; + } + break; } - if(m >= me) - break; mc = *m++; xrpnt = ((real *) xr) + *m++; + CHECK_XRPNT_SET; if(*m++ == 0) - break; /* optimize: field will be set to zero at the end of the function */ + break; /* optimized: zero fields zero-initialized */ m++; /* cb */ } @@ -873,7 +906,6 @@ #endif } - CHECK_XRPNT; if(x == 15 && h->linbits) { max = cb; @@ -881,6 +913,7 @@ x += ((MASK_UTYPE) mask) >> (BITSHIFT+8-h->linbits); num -= h->linbits+1; mask <<= h->linbits; + CHECK_XRPNT_USE; if(MSB_MASK) *xrpnt++ = REAL_MUL_SCALE_LAYER3(-ispow[x], v, gainpow2_scale_idx); else *xrpnt++ = REAL_MUL_SCALE_LAYER3( ispow[x], v, gainpow2_scale_idx); @@ -889,15 +922,16 @@ else if(x) { max = cb; + CHECK_XRPNT_USE; if(MSB_MASK) *xrpnt++ = REAL_MUL_SCALE_LAYER3(-ispow[x], v, gainpow2_scale_idx); else *xrpnt++ = REAL_MUL_SCALE_LAYER3( ispow[x], v, gainpow2_scale_idx); num--; mask <<= 1; } - else *xrpnt++ = DOUBLE_TO_REAL(0.0); + else xrpnt++; + CHECK_XRPNT_SET; - CHECK_XRPNT; if(y == 15 && h->linbits) { max = cb; @@ -905,6 +939,7 @@ y += ((MASK_UTYPE) mask) >> (BITSHIFT+8-h->linbits); num -= h->linbits+1; mask <<= h->linbits; + CHECK_XRPNT_USE; if(MSB_MASK) *xrpnt++ = REAL_MUL_SCALE_LAYER3(-ispow[y], v, gainpow2_scale_idx); else *xrpnt++ = REAL_MUL_SCALE_LAYER3( ispow[y], v, gainpow2_scale_idx); @@ -913,13 +948,15 @@ else if(y) { max = cb; + CHECK_XRPNT_USE; if(MSB_MASK) *xrpnt++ = REAL_MUL_SCALE_LAYER3(-ispow[y], v, gainpow2_scale_idx); else *xrpnt++ = REAL_MUL_SCALE_LAYER3( ispow[y], v, gainpow2_scale_idx); num--; mask <<= 1; } - else *xrpnt++ = DOUBLE_TO_REAL(0.0); + else xrpnt++; + CHECK_XRPNT_SET; } } @@ -966,20 +1003,21 @@ } mc--; } - CHECK_XRPNT; if( (a & (0x8>>i)) ) { max = cb; if(part2remain+num <= 0) break; + CHECK_XRPNT_USE; if(MSB_MASK) *xrpnt++ = -REAL_SCALE_LAYER3(v, gainpow2_scale_idx); else *xrpnt++ = REAL_SCALE_LAYER3(v, gainpow2_scale_idx); num--; mask <<= 1; } - else *xrpnt++ = DOUBLE_TO_REAL(0.0); + else xrpnt++; + CHECK_XRPNT_SET; } } @@ -1003,8 +1041,7 @@ gr_info->maxb = 1; } - while(xrpnt < xrpntlimit) - *xrpnt++ = DOUBLE_TO_REAL(0.0); + // Relying on initial zeroing if xr has not been written to fully. while( part2remain > 16 ) { diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/mpg123-1.33.6/src/libmpg123/lfs_wrap.c new/mpg123-1.33.7/src/libmpg123/lfs_wrap.c --- old/mpg123-1.33.6/src/libmpg123/lfs_wrap.c 2026-06-06 10:39:41.000000000 +0200 +++ new/mpg123-1.33.7/src/libmpg123/lfs_wrap.c 2026-08-02 23:07:44.000000000 +0200 @@ -340,7 +340,7 @@ if(*fill == 0) return MPG123_OK; /* Construct a copy of the index to hand over to the small-minded client. */ - *offsets = INT123_safe_realloc(whd->indextable, (*fill)*sizeof(int32_t)); + *offsets = INT123_safe_reallocn(whd->indextable, (*fill), sizeof(int32_t)); if(*offsets == NULL) return INT123_set_err(mh, MPG123_OUT_OF_MEM); whd->indextable = *offsets; @@ -370,8 +370,8 @@ else { /* Expensive temporary storage... for staying outside at the API layer. */ - indextmp = INT123_safe_realloc(whd->set_indextable, fill*sizeof(int64_t)); - if(indextmp == NULL) + indextmp = INT123_safe_reallocn(whd->set_indextable, fill, sizeof(int64_t)); + if(fill && indextmp == NULL) return INT123_set_err(mh, MPG123_OUT_OF_MEM); whd->set_indextable = indextmp; /* Fill the large-file copy of the provided index, then feed it to mpg123. */ diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/mpg123-1.33.6/src/libmpg123/libmpg123.c new/mpg123-1.33.7/src/libmpg123/libmpg123.c --- old/mpg123-1.33.6/src/libmpg123/libmpg123.c 2026-06-06 10:39:41.000000000 +0200 +++ new/mpg123-1.33.7/src/libmpg123/libmpg123.c 2026-08-02 23:07:44.000000000 +0200 @@ -848,6 +848,7 @@ if(mh->to_ignore && mh->num < mh->firstframe && mh->num >= mh->ignoreframe) { debug1("ignoring frame %li", (long)mh->num); + if(mh->buffer.size < mh->outblock) return MPG123_NO_SPACE; /* Decoder structure must be current! INT123_decode_update has been called before... */ (mh->do_layer)(mh); mh->buffer.fill = 0; #ifndef NO_NTOM @@ -1741,9 +1742,9 @@ if(!mh) return MPG123_ERR; if(v1 != NULL) - *v1 = mh->id3buf[0] ? mh->id3buf : NULL; + *v1 = (mh->rdat.flags & READER_ID3TAG) ? mh->id3buf : NULL; if(v1_size != NULL) - *v1_size = mh->id3buf[0] ? 128 : 0; + *v1_size =(mh->rdat.flags & READER_ID3TAG) ? 128 : 0; if(v2 != NULL) *v2 = mh->id3v2_raw; if(v2_size != NULL) @@ -1805,7 +1806,10 @@ #ifndef NO_STRING int attribute_align_arg mpg123_store_utf8(mpg123_string *sb, enum mpg123_text_encoding enc, const unsigned char *source, size_t source_size) { - switch(enc) + if(!sb) + return 0; + sb->fill = 0; + if(source) switch(enc) { #ifndef NO_ID3V2 /* The encodings we get from ID3v2 tags. */ @@ -1831,7 +1835,7 @@ { mpg123_free_string(sb); /* Paranoia: Make sure that the string ends inside the buffer... */ - if(source[source_size-1] == 0) + if(source_size && source[source_size-1] == 0) { /* Convert from ICY encoding... with force applied or not. */ char *tmpstring = INT123_icy2utf8((const char*)source, enc == mpg123_text_cp1252 ? 1 : 0); diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/mpg123-1.33.6/src/libmpg123/ntom.c new/mpg123-1.33.7/src/libmpg123/ntom.c --- old/mpg123-1.33.6/src/libmpg123/ntom.c 2026-06-06 10:39:41.000000000 +0200 +++ new/mpg123-1.33.7/src/libmpg123/ntom.c 2026-08-02 23:07:44.000000000 +0200 @@ -32,6 +32,13 @@ fr->err = MPG123_BAD_RATE; return -1; } + if(fr->ntom_step < 1) + { + if(NOQUIET) + merror("too small target rate for NtoM resampling, limit would be around %ld", m/NTOM_MUL+(m%NTOM_MUL ? 1 : 0)); + fr->err = MPG123_BAD_RATE; + return -1; + } fr->INT123_ntom_val[0] = fr->INT123_ntom_val[1] = INT123_ntom_val(fr, fr->num); return 0; diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/mpg123-1.33.6/src/libmpg123/readers.c new/mpg123-1.33.7/src/libmpg123/readers.c --- old/mpg123-1.33.6/src/libmpg123/readers.c 2026-06-06 10:39:41.000000000 +0200 +++ new/mpg123-1.33.7/src/libmpg123/readers.c 2026-08-02 23:07:44.000000000 +0200 @@ -428,6 +428,7 @@ return -1; } if(!strncmp((char*)fr->id3buf,"TAG",3)) len -= 128; + else{ memset(fr->id3buf, 0, 128); } } else { debug("stream too short for ID3"); diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/mpg123-1.33.6/src/libmpg123/stringbuf.c new/mpg123-1.33.7/src/libmpg123/stringbuf.c --- old/mpg123-1.33.6/src/libmpg123/stringbuf.c 2026-06-06 10:39:41.000000000 +0200 +++ new/mpg123-1.33.7/src/libmpg123/stringbuf.c 2026-08-02 23:07:44.000000000 +0200 @@ -71,7 +71,7 @@ { char* t; debug("really!"); - t = (char*) INT123_safe_realloc(sb->p, new*sizeof(char)); + t = (char*) INT123_safe_reallocn(sb->p, new, sizeof(char)); debug1("INT123_safe_realloc returned %p", (void*) t); if(t != NULL) { diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/mpg123-1.33.6/src/libout123/buffer.c new/mpg123-1.33.7/src/libout123/buffer.c --- old/mpg123-1.33.6/src/libout123/buffer.c 2026-06-06 10:39:41.000000000 +0200 +++ new/mpg123-1.33.7/src/libout123/buffer.c 2026-08-02 23:07:45.000000000 +0200 @@ -365,6 +365,7 @@ int INT123_buffer_start(out123_handle *ao) { int writerfd = ao->buffermem->fd[XF_WRITER]; + INT123_xfermem_usesize(ao->buffermem, ao->framesize); if(INT123_xfermem_putcmd(writerfd, BUF_CMD_START) != 1) { ao->errcode = OUT123_BUFFER_ERROR; @@ -447,7 +448,11 @@ */ size_t written = 0; size_t max_piece = ao->buffermem->size / 2; - while(bytes) + // We always write whole frames only. The reader expects that and + // deadlock could occur otherwise. + max_piece -= max_piece % ao->framesize; + bytes -= bytes % ao->framesize; + while(bytes && max_piece) { size_t count_piece = bytes > max_piece ? max_piece @@ -892,6 +897,7 @@ return 2; if(!out123_start(ao, ao->rate, ao->channels, ao->format)) { + INT123_xfermem_usesize(ao->buffermem, ao->framesize); out123_pause(ao); /* Be nice, start only on buffer_play(). */ mystate = play_live; preloading = TRUE; diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/mpg123-1.33.6/src/libout123/libout123.c new/mpg123-1.33.7/src/libout123/libout123.c --- old/mpg123-1.33.6/src/libout123/libout123.c 2026-06-06 10:39:41.000000000 +0200 +++ new/mpg123-1.33.7/src/libout123/libout123.c 2026-08-02 23:07:45.000000000 +0200 @@ -546,6 +546,9 @@ debug("out123_start() continuing"); if(ao->state != play_stopped) return out123_seterr(ao, OUT123_NO_DRIVER); + // Stop stupid parameters early. + if(rate < 1 || channels < 1) + return out123_seterr(ao, OUT123_DEV_OPEN); /* Stored right away as parameters for ao->open() and also for reference. framesize needed for out123_play(). */ diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/mpg123-1.33.6/src/libout123/stringlists.c new/mpg123-1.33.7/src/libout123/stringlists.c --- old/mpg123-1.33.6/src/libout123/stringlists.c 2026-06-06 10:39:41.000000000 +0200 +++ new/mpg123-1.33.7/src/libout123/stringlists.c 2026-08-02 23:07:45.000000000 +0200 @@ -32,12 +32,14 @@ char **morealist = NULL; char **moreblist = NULL; + if(*count < 0 || *count > SIZE_MAX-1) + return -1; /* If one of these succeeded, the old memory is gone, so always overwrite the old pointer, worst case is wasted but not leaked memory in an out-of-memory situation. */ - if((morealist = INT123_safe_realloc(*alist, sizeof(char*)*(*count+1)))) + if((morealist = INT123_safe_reallocn(*alist, sizeof(char*), (*count+1)))) *alist = morealist; - if((moreblist = INT123_safe_realloc(*blist, sizeof(char*)*(*count+1)))) + if((moreblist = INT123_safe_reallocn(*blist, sizeof(char*), (*count+1)))) *blist = moreblist; if(!morealist || !moreblist) return -1; diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/mpg123-1.33.6/src/libout123/wav.c new/mpg123-1.33.7/src/libout123/wav.c --- old/mpg123-1.33.6/src/libout123/wav.c 2026-06-06 10:39:41.000000000 +0200 +++ new/mpg123-1.33.7/src/libout123/wav.c 2026-08-02 23:07:45.000000000 +0200 @@ -488,6 +488,10 @@ long2littleendian( (int)(ao->channels * bps)>>3 , floathead->WAVE.fmt.BlockAlign , sizeof(floathead->WAVE.fmt.BlockAlign) ); + // Sanity check of stored values, could be truncated/overflown. + if(from_little(floathead->WAVE.fmt.Channels,sizeof(floathead->WAVE.fmt.Channels)) < 1 + || from_little(floathead->WAVE.fmt.BitsPerSample,sizeof(floathead->WAVE.fmt.BitsPerSample))/8 < 1) + goto wav_open_bad; } else { @@ -501,6 +505,10 @@ long2littleendian( (int)(ao->channels * bps)>>3 , inthead->WAVE.fmt.BlockAlign , sizeof(inthead->WAVE.fmt.BlockAlign) ); + // Sanity check of stored values, could be truncated/overflown. + if(from_little(inthead->WAVE.fmt.Channels,sizeof(inthead->WAVE.fmt.Channels)) < 1 + || from_little(inthead->WAVE.fmt.BitsPerSample,sizeof(inthead->WAVE.fmt.BitsPerSample))/8 < 1) + goto wav_open_bad; } if(open_file(wdat, ao->device) < 0) diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/mpg123-1.33.6/src/libout123/xfermem.c new/mpg123-1.33.7/src/libout123/xfermem.c --- old/mpg123-1.33.6/src/libout123/xfermem.c 2026-06-06 10:39:41.000000000 +0200 +++ new/mpg123-1.33.7/src/libout123/xfermem.c 2026-08-02 23:07:45.000000000 +0200 @@ -80,7 +80,8 @@ (*xf)->freeindex = (*xf)->readindex = 0; (*xf)->data = ((char *) *xf) + sizeof(txfermem) + msize; (*xf)->metadata = ((char *) *xf) + sizeof(txfermem); - (*xf)->size = bufsize; + (*xf)->fullsize = bufsize; + (*xf)->size = bufsize; // Unless overridden for certain frame size. (*xf)->metasize = msize + skipbuf; } @@ -147,6 +148,13 @@ return (xf->size - (readindex - freeindex)); } +void INT123_xfermem_usesize(txfermem *xf, int framesize) +{ + if(!xf || framesize < 1) + return; // Just ignore stupid. + xf->size = xf->fullsize - (xf->fullsize % framesize); +} + static int xfermem_getcmd_raw (int fd, int block, byte *cmds, int count) { fd_set selfds; diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/mpg123-1.33.6/src/libout123/xfermem.h new/mpg123-1.33.7/src/libout123/xfermem.h --- old/mpg123-1.33.6/src/libout123/xfermem.h 2026-06-06 10:39:41.000000000 +0200 +++ new/mpg123-1.33.7/src/libout123/xfermem.h 2026-08-02 23:07:45.000000000 +0200 @@ -28,6 +28,9 @@ int fd[2]; char *data; char *metadata; + size_t fullsize; + // Usable size can be less than the above since we need to + // strictly work on audio frame boundaries. size_t size; size_t metasize; } txfermem; @@ -40,6 +43,8 @@ void INT123_xfermem_init (txfermem **xf, size_t bufsize, size_t msize, size_t skipbuf); void INT123_xfermem_init_writer (txfermem *xf); void INT123_xfermem_init_reader (txfermem *xf); +// Set up usesize as a multiple of framesize to be able to work in audio frames. +void INT123_xfermem_usesize(txfermem *xf, int framesize); size_t INT123_xfermem_get_freespace (txfermem *xf); size_t INT123_xfermem_get_usedspace (txfermem *xf); diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/mpg123-1.33.6/src/libsyn123/filter.c new/mpg123-1.33.7/src/libsyn123/filter.c --- old/mpg123-1.33.6/src/libsyn123/filter.c 2026-06-06 10:39:41.000000000 +0200 +++ new/mpg123-1.33.7/src/libsyn123/filter.c 2026-08-02 23:07:45.000000000 +0200 @@ -40,7 +40,7 @@ // Theoretical limit on maximum order: data block must fit into size_t. // Checking overflow of order*order*2 + order*channels, in that order. -#define ORDER_TOO_BIG(order, channels) \ +#define ORDER_TOO_BIG(order, channels) ( \ ((order) == 0 || (channels) == 0) \ ? 0 \ : ( (order) > SIZE_MAX/2/(order) \ @@ -49,7 +49,7 @@ ? 1 \ : 0 \ )\ - ) + ) ) // size of filter data block #define F_DATABLOCK(f, channels) ((f).order*(2*(f).order+channels)) @@ -128,6 +128,8 @@ mixenc = sh->fc.mixenc; if(!channels) channels = sh->fc.channels; + if(mixenc != sh->fc.mixenc || channels != sh->fc.channels) + return SYN123_BAD_FMT; } if(channels < 1) return SYN123_BAD_FMT; @@ -135,7 +137,7 @@ return SYN123_BAD_ENC; if(!b) return SYN123_NO_DATA; - if(a && a[0] != 1.) + if((a && a[0] != 1.) || order < 1) return SYN123_BAD_DATA; if(ORDER_TOO_BIG(order, channels) || sh->fc.count == SIZE_MAX) return SYN123_OVERFLOW; diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/mpg123-1.33.6/src/libsyn123/resample.c new/mpg123-1.33.7/src/libsyn123/resample.c --- old/mpg123-1.33.6/src/libsyn123/resample.c 2026-06-06 10:39:41.000000000 +0200 +++ new/mpg123-1.33.7/src/libsyn123/resample.c 2026-08-02 23:07:45.000000000 +0200 @@ -1246,7 +1246,7 @@ #define OPT4P4O_INTERPOL(in, out, outs, channels) \ { \ long sampleoff = rd->offset; \ - if(sampleoff+rd->vinrate < rd->voutrate) \ + if(sampleoff < rd->voutrate-rd->vinrate) \ { \ for(unsigned int c=0; c<channels; ++c) \ { \ @@ -1278,7 +1278,7 @@ )*z + rd->ch[c].c[0]; \ outs++; \ out += channels; \ - } while(sampleoff+rd->vinrate < rd->voutrate); \ + } while(sampleoff < rd->voutrate-rd->vinrate); \ } \ for(unsigned int c=0; c<channels; ++c) \ { \ diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/mpg123-1.33.6/src/metaprint.c new/mpg123-1.33.7/src/metaprint.c --- old/mpg123-1.33.6/src/metaprint.c 2026-06-06 10:39:42.000000000 +0200 +++ new/mpg123-1.33.7/src/metaprint.c 2026-08-02 23:07:45.000000000 +0200 @@ -1,4 +1,4 @@ -/* + /* metaprint: display routines for ID3 tags (including filtering of UTF8 to ASCII) copyright 2006-2020 by the mpg123 project @@ -371,7 +371,7 @@ mpg_utf8outstr(&outline, &innline, is_term); fprintf(out, " %s\n", outline.p); - if(uslt->p[b] == uslt->fill) break; /* nothing more */ + if(b == uslt->fill) break; /* nothing more */ /* Swallow CRLF */ if(uslt->fill-b > 1 && uslt->p[b] == '\r' && uslt->p[b+1] == '\n') ++b; diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/mpg123-1.33.6/src/mpg123.c new/mpg123-1.33.7/src/mpg123.c --- old/mpg123-1.33.6/src/mpg123.c 2026-06-06 10:39:41.000000000 +0200 +++ new/mpg123-1.33.7/src/mpg123.c 2026-08-02 23:07:45.000000000 +0200 @@ -503,7 +503,7 @@ // realistic limits for aith are 255:255. if(rdb > 0 && rdb < sizeof(buf)) { - buf[sizeof(buf)-1] = 0; + buf[rdb] = 0; // terminate string in case of missing EOL for(size_t i=0; i<sizeof(buf); ++i) { if(buf[i] == '\r' || buf[i] == '\n' || buf[i] == 0) diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/mpg123-1.33.6/src/net123_exec.c new/mpg123-1.33.7/src/net123_exec.c --- old/mpg123-1.33.6/src/net123_exec.c 2026-06-06 10:39:42.000000000 +0200 +++ new/mpg123-1.33.7/src/net123_exec.c 2026-08-02 23:07:45.000000000 +0200 @@ -184,6 +184,7 @@ argv[an++] = catstr("--user=", user); if(password) argv[an++] = catstr("--password=", password); + argv[an++] = INT123_compat_strdup("--"); argv[an++] = INT123_compat_strdup(url); argv[an++] = NULL; return argv; @@ -236,6 +237,7 @@ argv[an++] = INT123_compat_strdup("--user"); argv[an++] = httpauth; } + argv[an++] = INT123_compat_strdup("--"); argv[an++] = INT123_compat_strdup(url); argv[an++] = NULL; return argv; diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/mpg123-1.33.6/src/out123.c new/mpg123-1.33.7/src/out123.c --- old/mpg123-1.33.6/src/out123.c 2026-06-06 10:39:41.000000000 +0200 +++ new/mpg123-1.33.7/src/out123.c 2026-08-02 23:07:45.000000000 +0200 @@ -1143,9 +1143,9 @@ return 0; if(byte_in_flags & byte_big) - syn123_be2host(inaudio, pcminframe/channels, got_samples*inputch); + syn123_be2host(inaudio, pcminframe/inputch, got_samples*inputch); if(byte_in_flags & byte_little) - syn123_le2host(inaudio, pcminframe/channels, got_samples*inputch); + syn123_le2host(inaudio, pcminframe/inputch, got_samples*inputch); if(mixaudio) { diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/mpg123-1.33.6/src/playlist.c new/mpg123-1.33.7/src/playlist.c --- old/mpg123-1.33.6/src/playlist.c 2026-06-06 10:39:42.000000000 +0200 +++ new/mpg123-1.33.7/src/playlist.c 2026-08-02 23:07:45.000000000 +0200 @@ -160,9 +160,16 @@ pl.loop = param.loop; } - newitem = &pl.list[pl.pos]; - pl.num = pl.pos+1; - pl.flags &= ~PL_NO_RANDOM; // The random blocking works only once. + if(pl.pos < pl.fill) + { + newitem = &pl.list[pl.pos]; + pl.num = pl.pos+1; + pl.flags &= ~PL_NO_RANDOM; // The random blocking works only once. + } else + { + merror("Playlist position %zu beyond end of list fill %zu!", pl.pos+1, pl.fill); + newitem = NULL; + } } /* "-" is STDIN, "" is dumb, NULL is nothing */ @@ -355,6 +362,7 @@ pl.flags &= ~PL_IS_UTF8; // Playlist files in env encoding (HTTP lists should be ASCII-clean). if(!pl.file) { + char *eff_listname = param.listname; pl.file = stream_open(param.listname); if(pl.file) { @@ -362,7 +370,7 @@ if(pl.file->fd == STDIN_FILENO) { pl.flags |= PL_STDIN_USED; - param.listname = NULL; + eff_listname = NULL; } } pl.entry = 0; @@ -415,13 +423,12 @@ #endif if(!pl.file) { - param.listname = NULL; // why? error("failed to open playlist file"); return 0; } else if(param.verbose) { fprintf(stderr, "Using playlist from "); - print_outstr( stderr, param.listname ? param.listname : "standard input" + print_outstr( stderr, eff_listname ? eff_listname : "standard input" , args_utf8, stderr_is_term ); fprintf(stderr, " ...\n"); } @@ -663,7 +670,9 @@ { struct listitem* tmp = NULL; /* enlarge the list */ - tmp = (struct listitem*) INT123_safe_realloc(pl.list, (pl.size + pl.alloc_step) * sizeof(struct listitem)); + tmp = (pl.size <= (SIZE_MAX-pl.alloc_step)) + ? INT123_safe_reallocn(pl.list, (pl.size + pl.alloc_step), sizeof(struct listitem)) + : NULL; if(!tmp) { error("unable to allocate more memory for playlist"); diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/mpg123-1.33.6/src/tests/Makemodule.am new/mpg123-1.33.7/src/tests/Makemodule.am --- old/mpg123-1.33.6/src/tests/Makemodule.am 2026-06-06 10:39:42.000000000 +0200 +++ new/mpg123-1.33.7/src/tests/Makemodule.am 2026-08-02 23:07:45.000000000 +0200 @@ -89,6 +89,7 @@ src/tests/sweeper.c src_tests_sweeper_LDADD = \ src/compat/libcompat.la \ + @LIBM@ \ $(LIBSYN123) \ $(LIBOUT123) diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/mpg123-1.33.6/src/version.h new/mpg123-1.33.7/src/version.h --- old/mpg123-1.33.6/src/version.h 2026-06-06 10:42:49.000000000 +0200 +++ new/mpg123-1.33.7/src/version.h 2026-08-02 23:07:45.000000000 +0200 @@ -16,7 +16,7 @@ // only single spaces as separator to ease parsing by build scripts #define MPG123_MAJOR 1 #define MPG123_MINOR 33 -#define MPG123_PATCH 6 +#define MPG123_PATCH 7 // Don't get too wild with that to avoid confusing m4. No brackets. // Also, it should fit well into a sane file name for the tarball. #define MPG123_SUFFIX "" diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/mpg123-1.33.6/src/win32_net.c new/mpg123-1.33.7/src/win32_net.c --- old/mpg123-1.33.6/src/win32_net.c 2026-06-06 10:39:42.000000000 +0200 +++ new/mpg123-1.33.7/src/win32_net.c 2026-08-02 23:29:26.000000000 +0200 @@ -260,7 +260,8 @@ int win32_net_writestring (int fd, mpg123_string *string) { - size_t result, bytes; + mpg123_ssize_t result; + size_t bytes; char *ptr = string->p; bytes = string->fill ? string->fill-1 : 0;
