Subject: CVS commit: [pkgsrc-2017Q1] pkgsrc/multimedia/vlc
From: Benny Siegert
Date: 2017-06-05 11:11:04
Message id: 20170605091104.A2403FBEE@cvs.NetBSD.org

Log Message:
Pullup ticket #5467 - requested by sevan
multimedia/vlc: security fix

Revisions pulled up:
- multimedia/vlc/Makefile                                       1.202-1.203
- multimedia/vlc/PLIST                                          1.60
- multimedia/vlc/distinfo                                       1.73-1.74
- multimedia/vlc/patches/patch-compat_Makefile.in               1.3
- multimedia/vlc/patches/patch-configure                        1.8
- multimedia/vlc/patches/patch-include_vlc_atomic.h             1.3
- multimedia/vlc/patches/patch-modules_gui_qt4_qt4.hpp          deleted

---
   Module Name:    pkgsrc
   Committed By:   jperkin
   Date:           Mon May 15 11:10:00 UTC 2017

   Modified Files:
           pkgsrc/multimedia/vlc: Makefile PLIST

   Log Message:
   Add a cdrom PLIST var and unset it on SunOS as the native cdio interface
   is unsupported.

---
   Module Name:    pkgsrc
   Committed By:   jperkin
   Date:           Mon May 15 11:11:35 UTC 2017

   Modified Files:
           pkgsrc/multimedia/vlc: distinfo
   Added Files:
           pkgsrc/multimedia/vlc/patches: patch-configure

   Log Message:
   Remove bogus exclusion of SunOS MMX/SSE2 support.

---
   Module Name:    pkgsrc
   Committed By:   maya
   Date:           Fri May 26 13:26:37 UTC 2017

   Modified Files:
           pkgsrc/multimedia/vlc: Makefile distinfo
           pkgsrc/multimedia/vlc/patches: patch-compat_Makefile.in
               patch-include_vlc_atomic.h
   Removed Files:
           pkgsrc/multimedia/vlc/patches: patch-modules_gui_qt4_qt4.hpp

   Log Message:
   vlc: update to 2.2.6.

   Includes significant security fixes allowing code execution via
   a crafted subtitles file (fixes CVE-2017-8310, CVE-2017-8311,
   CVE-2017-8312, CVE-2017-8313)

   pkgsrc changes:
   pull in <atomic> in a C++11 case rather than clang case,
   it's a C++11 header. however I couldn't build with -std=c++11 for
   other reasons.

   it builds and runs clang 4.0, but the mkv plugin dies on an
   undefined reference.

   Changes between 2.2.5.1 and 2.2.6:
   ----------------------------------

   Video output:
    * Fix systematic green line on nvidia
    * Fix direct3d SPU texture offsets handling

   Demuxer:
    * Fix heap buffer overflows

   Changes between 2.2.5 and 2.2.5.1:
   ----------------------------------

   Security hardening for DLL hijacking environments

   Translations updates

   Misc:
    * Update for Soundcloud, liveleak and Youtube scripts
    * Fix potential out-of-band dereference in flac decoder
    * Fix potential out-of-band reads in mpeg packetizers
    * Fix infinite loop in subtitles demuxer
    * Fix incorrect memory free in ogg demuxer
    * Fix potential out-of-band reads in subtitle decoders and demuxers
    * Fix green line on Windows with odd sizes

   Changes between 2.2.4 and 2.2.5:
   --------------------------------

   Decoder:
    * Fix mp3 playback quality regression in libmad
    * Fix video scaling in VDPAU
    * Fix playback of palettized codecs
    * Fix ADPCM heap corruption (FG-VD-16-067)
    * Fix AES3 16bps decoding
    * Fix DVD/LPCM heap corruption (FG-VD-16-090)
    * Fix SCTE-27 colors

   Demuxer:
    * Fix possible ASF integer overflow
    * Fix MP4, VOC, XA, SMF divide-by-zero errors
    * Fix MP4 heap buffer overflows
    * Fix Flac metadata integer overflow
    * Fix NSVf and AIFF infinite loops
    * Fix flac null-pointer dereference
    * Fix vorbis and opus comments integer overflows and leaks

   Video output:
    * Fix green line on Windows with AMD drivers
    * Fix screenshots size

   Access:
    * Fix crash in screen recording on Windows
    * Fix FTP scan string injection
    * Fix HTTP size handling

   Mux:
    * Fix mp4 drift

   Lua:
    * Fix vimeo, youtube, dailymotion, cli, appletrailers, http,
      soundcloud scripts

   Audio filter:
    * Fix heap write in stereo_widen audio filter

   Windows:
    * The plugins loading will not load external DLLs by default.
      Plugins will need to LoadLibrary explicitely.
    * Fix uninstaller path handling
    * Fix taskbar buttons behavior

   MacOS:
    * Fix scrolling sensitivity on Sierra
    * Resume points are deleted now if the user clears the list of
      recent items

Files:
RevisionActionfile
1.201.2.1modifypkgsrc/multimedia/vlc/Makefile
1.59.2.1modifypkgsrc/multimedia/vlc/PLIST
1.71.6.2modifypkgsrc/multimedia/vlc/distinfo
1.2.6.1modifypkgsrc/multimedia/vlc/patches/patch-compat_Makefile.in
1.1.12.2modifypkgsrc/multimedia/vlc/patches/patch-include_vlc_atomic.h
1.8.2.2addpkgsrc/multimedia/vlc/patches/patch-configure
1.1removepkgsrc/multimedia/vlc/patches/patch-modules_gui_qt4_qt4.hpp