Path to this page:
Subject: CVS commit: [pkgsrc-2017Q1] pkgsrc/multimedia/vlc
From: Benny Siegert
Date: 2017-06-05 11:11:04
Message id: 20170605091104.A2403FBEE@cvs.NetBSD.org
Log Message:
Pullup ticket #5467 - requested by sevan
multimedia/vlc: security fix
Revisions pulled up:
- multimedia/vlc/Makefile 1.202-1.203
- multimedia/vlc/PLIST 1.60
- multimedia/vlc/distinfo 1.73-1.74
- multimedia/vlc/patches/patch-compat_Makefile.in 1.3
- multimedia/vlc/patches/patch-configure 1.8
- multimedia/vlc/patches/patch-include_vlc_atomic.h 1.3
- multimedia/vlc/patches/patch-modules_gui_qt4_qt4.hpp deleted
---
Module Name: pkgsrc
Committed By: jperkin
Date: Mon May 15 11:10:00 UTC 2017
Modified Files:
pkgsrc/multimedia/vlc: Makefile PLIST
Log Message:
Add a cdrom PLIST var and unset it on SunOS as the native cdio interface
is unsupported.
---
Module Name: pkgsrc
Committed By: jperkin
Date: Mon May 15 11:11:35 UTC 2017
Modified Files:
pkgsrc/multimedia/vlc: distinfo
Added Files:
pkgsrc/multimedia/vlc/patches: patch-configure
Log Message:
Remove bogus exclusion of SunOS MMX/SSE2 support.
---
Module Name: pkgsrc
Committed By: maya
Date: Fri May 26 13:26:37 UTC 2017
Modified Files:
pkgsrc/multimedia/vlc: Makefile distinfo
pkgsrc/multimedia/vlc/patches: patch-compat_Makefile.in
patch-include_vlc_atomic.h
Removed Files:
pkgsrc/multimedia/vlc/patches: patch-modules_gui_qt4_qt4.hpp
Log Message:
vlc: update to 2.2.6.
Includes significant security fixes allowing code execution via
a crafted subtitles file (fixes CVE-2017-8310, CVE-2017-8311,
CVE-2017-8312, CVE-2017-8313)
pkgsrc changes:
pull in <atomic> in a C++11 case rather than clang case,
it's a C++11 header. however I couldn't build with -std=c++11 for
other reasons.
it builds and runs clang 4.0, but the mkv plugin dies on an
undefined reference.
Changes between 2.2.5.1 and 2.2.6:
----------------------------------
Video output:
* Fix systematic green line on nvidia
* Fix direct3d SPU texture offsets handling
Demuxer:
* Fix heap buffer overflows
Changes between 2.2.5 and 2.2.5.1:
----------------------------------
Security hardening for DLL hijacking environments
Translations updates
Misc:
* Update for Soundcloud, liveleak and Youtube scripts
* Fix potential out-of-band dereference in flac decoder
* Fix potential out-of-band reads in mpeg packetizers
* Fix infinite loop in subtitles demuxer
* Fix incorrect memory free in ogg demuxer
* Fix potential out-of-band reads in subtitle decoders and demuxers
* Fix green line on Windows with odd sizes
Changes between 2.2.4 and 2.2.5:
--------------------------------
Decoder:
* Fix mp3 playback quality regression in libmad
* Fix video scaling in VDPAU
* Fix playback of palettized codecs
* Fix ADPCM heap corruption (FG-VD-16-067)
* Fix AES3 16bps decoding
* Fix DVD/LPCM heap corruption (FG-VD-16-090)
* Fix SCTE-27 colors
Demuxer:
* Fix possible ASF integer overflow
* Fix MP4, VOC, XA, SMF divide-by-zero errors
* Fix MP4 heap buffer overflows
* Fix Flac metadata integer overflow
* Fix NSVf and AIFF infinite loops
* Fix flac null-pointer dereference
* Fix vorbis and opus comments integer overflows and leaks
Video output:
* Fix green line on Windows with AMD drivers
* Fix screenshots size
Access:
* Fix crash in screen recording on Windows
* Fix FTP scan string injection
* Fix HTTP size handling
Mux:
* Fix mp4 drift
Lua:
* Fix vimeo, youtube, dailymotion, cli, appletrailers, http,
soundcloud scripts
Audio filter:
* Fix heap write in stereo_widen audio filter
Windows:
* The plugins loading will not load external DLLs by default.
Plugins will need to LoadLibrary explicitely.
* Fix uninstaller path handling
* Fix taskbar buttons behavior
MacOS:
* Fix scrolling sensitivity on Sierra
* Resume points are deleted now if the user clears the list of
recent items
Files: