Page MenuHomeSolus

Update mpg123 to 1.25.1 - fix CVE-2017-10683
ClosedPublic

Authored by kyrios123 on Jul 3 2017, 2:15 PM.

Details

Summary
  • Avoid memset(NULL, 0, 0) to calm down the paranoid.
  • Fix bug 252, invalid read of size 1 in ID3v2 parser due to forgotten offset from the frame flag bytes (unnoticed in practice for a long time). Fuzzers are in the house again. This one got CVE-2017-10683.
  • Avoid a mostly harmless conditional jump depending on uninitialised fr->lay in compute_bpf() (mpg123_position()) when track is not ready yet.
  • Fix undefined shifts on signed long mask in layer3.c (worked in practice, never right in theory). Code might be a bit faster now, even. Thanks to Agostino Sarubbo for reporting.

Signed-off-by: Pierre-Yves <pyu@riseup.net>

Test Plan
  • successfully build cantata against this library

Diff Detail

Repository
R2106 mpg123
Lint
Lint Not Applicable
Unit
Tests Not Applicable