CVS commit: pkgsrc

["Dr. Thomas Orgis" <thor%netbsd.org@localhost>]

Module Name:    pkgsrc
Committed By:   thor
Date:           Sun Aug  2 22:11:11 UTC 2026

Modified Files:
        pkgsrc/audio/mpg123: Makefile.common distinfo
        pkgsrc/doc: CHANGES-2026

Log Message:
audio/mpg123: udpate to 1.33.7

Lots of issues fixed.

1.33.7
------
- mpg123:
-- Fix heap buffer overflows in unicode path conversion on Windows (bug 388,
   thanks to Alejandro Ramos).
-- Fix information disclosure of uninitialied memory for --auth-file without
   line endings. (bug 390, thanks to Alejandro Ramos)
-- Fix out-of-bounds read/write when combining --continue --random --listentry <n>
   where n is larger than the playlist size. (bug 391, thanks to Alejandro Ramos)
-- Fix a harmless valgrind memory leak report by not nulling playlist name.
-- Fix error handling of win32_net_writestring() (Windows only) by actually using
   a signed type, also preventing a OOB read on failure.
   (bug 392 by Alejandro Ramos)
-- Fix a mostly harmless OOB read of 1 byte when printing USLT lyrics.
   (bug 392)
-- Fix leaking file descriptor on read error from --equalizer file. (bug 392)
-- Hardening of loading HTTP(S) via curl or wget against funky URLs by including
   the -- separator. No actual vulnerability, tough, just extra care. (bug 392)
- out123:
-- Fix heap overrun on --endian conversion with differing input and output
   channel counts. (bug 391)
-- Fix parsing of filter specs with whitespace before commas, which resulted
   in out-of-bounds writes before. (bug 391)
- libmpg123, mpg123: Harden memory realloc calls against multiplication overflow
  of size_t in arguments. Specifically, this addresses part of bug 389 with possible
  application abuse of mpg123_set_index64(). (bug 389 by Alejandro Ramos)
- libmpg123:
-- Fix possible use of uninitialized values in layer III dequantization.
   III_dequantize_sample() for consistent output also for strange input. The new
   code seems to be slightly faster after some rearrangements.
   (thanks to He Huang, Swinburne University of Technology (discovered using
   NexusSan))
-- Fix a double free when deleting a handle after failed mpg123_decoder() call
   (possibly among others). (bug 389)
-- More strong wording in API that ID3 text convenience links are short-lived,
   but safeguard against ignorant use by nulling them early.
   (bug 389)
-- Prevent double free in mpg123_set_index() 32 bit wrapper being called with
   index size 0. (bug 392)
-- Harden against an application wielding a foot gun by handing in an undersized
   decoding buffer betwee seek and read (return error before trying to decode
   and discard frames in that case). (bug 392)
-- Do properly terminate ID3v2 texts coming in UTF16 encoding when they overwrite
   previous frames, like with other encodings. The symptom was a shorter second
   frame resulting in a combined text with the earlier longer frame.
   (bug 392)
-- Check and properly handle null source buffer and zero size in mpg123_store_utf8()
   instead of reading past (before) buffers. (bug 392)
-- Ensure clients get ID3v1 data with (unmotivated) mpg123_id3_raw()
   only if the parser decided that it is there, not possibly the last 128 bytes of
   a seekable stream without ID3v1 tag. (bug 392)
-- Prevent impossible NtoM resampling with too low target rate (like 1 Hz) which
   would trgger endless looping. (bug 392)
- libout123:
-- Fix deadlock in buffer mode when combined with (stereo) 24 bit output. Now
   also mpg123 --buffer 4096 -e s24 shall actuallly work. Sorry. (bug 392)
-- Abort early on zero/negative rate and channel count in out123_start().
   (bug 392)
-- Fix divide by zero in WAV writing by catching channel counts that go zero in the
   16 bit WAV header field. (bug 392)
- libsyn123:
-- Explictly reject mismatched format for appending filters with
   syn123_setup_filter(), preventing memory errors from that API-violating use.
   (bug 392)
-- Harden the dirty resampling interpolator against extreme rates (around 1e18 Hz)
   by fixing a sample offset check to not do the exact overflowing addition
   that it is supposed to guard against. The fine resampler was … fine. (bug 392)
-- Error out on trying to create a filter of order 0 instead of dividing by zero
   later. (bug 392)


To generate a diff of this commit:
cvs rdiff -u -r1.86 -r1.87 pkgsrc/audio/mpg123/Makefile.common \
    pkgsrc/audio/mpg123/distinfo
cvs rdiff -u -r1.4906 -r1.4907 pkgsrc/doc/CHANGES-2026

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.

Modified files:

Index: pkgsrc/audio/mpg123/Makefile.common
diff -u pkgsrc/audio/mpg123/Makefile.common:1.86 pkgsrc/audio/mpg123/Makefile.common:1.87
--- pkgsrc/audio/mpg123/Makefile.common:1.86    Sun Jun  7 06:15:38 2026
+++ pkgsrc/audio/mpg123/Makefile.common Sun Aug  2 22:11:10 2026
@@ -1,11 +1,11 @@
-# $NetBSD: Makefile.common,v 1.86 2026/06/07 06:15:38 adam Exp $
+# $NetBSD: Makefile.common,v 1.87 2026/08/02 22:11:10 thor Exp $
 #
 # used by audio/mpg123-jack/Makefile
 # used by audio/mpg123-nas/Makefile
 # used by audio/mpg123-pulse/Makefile
 # used by audio/mpg123-sndio/Makefile
 
-DISTNAME=      mpg123-1.33.6
+DISTNAME=      mpg123-1.33.7
 PKGNAME?=      ${DISTNAME:C/[[:alnum:]]*/&-${MPG123_MODULE}/}
 CATEGORIES=    audio
 MASTER_SITES=  ${MASTER_SITE_SOURCEFORGE:=mpg123/}
Index: pkgsrc/audio/mpg123/distinfo
diff -u pkgsrc/audio/mpg123/distinfo:1.86 pkgsrc/audio/mpg123/distinfo:1.87
--- pkgsrc/audio/mpg123/distinfo:1.86   Sun Jun  7 06:15:38 2026
+++ pkgsrc/audio/mpg123/distinfo        Sun Aug  2 22:11:10 2026
@@ -1,7 +1,7 @@
-$NetBSD: distinfo,v 1.86 2026/06/07 06:15:38 adam Exp $
+$NetBSD: distinfo,v 1.87 2026/08/02 22:11:10 thor Exp $
 
-BLAKE2s (mpg123-1.33.6.tar.bz2) = 9fa8fdec3763dc15bef4f5ccc772bda12015f7bd00919257e286447dd51d76b3
-SHA512 (mpg123-1.33.6.tar.bz2) = 83d8fca128b1fd39e336e6052837b16951360d6f1a47919e00d4b7285717ee7cd4dd56c24bd873316ba6969081fe619cda93ebb20771aed052c6e9d07657f2ab
-Size (mpg123-1.33.6.tar.bz2) = 1123797 bytes
+BLAKE2s (mpg123-1.33.7.tar.bz2) = c5e43d8e315bd945f54dd3b121b068ae3b81c2cd5af8692d6df642ee0172a77b
+SHA512 (mpg123-1.33.7.tar.bz2) = 694743802bb7be0f4a39bf62e681ae0bfed769cb87dc6c5b6fb5f9245966631efb5c5b9bd58588f7af55ced5d020f97c8a54993e71b5295bc45ebd152473f40e
+Size (mpg123-1.33.7.tar.bz2) = 1126376 bytes
 SHA1 (patch-ad) = f07b637c3fc1d3ea0426013fc25bca8e3aecba56
 SHA1 (patch-src_libout123_modules_sun.c) = aa11e1420fd07f2e1c4a0d911d1642f0fd50b916

Index: pkgsrc/doc/CHANGES-2026
diff -u pkgsrc/doc/CHANGES-2026:1.4906 pkgsrc/doc/CHANGES-2026:1.4907
--- pkgsrc/doc/CHANGES-2026:1.4906      Sun Aug  2 20:26:48 2026
+++ pkgsrc/doc/CHANGES-2026     Sun Aug  2 22:11:10 2026
@@ -1,4 +1,4 @@
-$NetBSD: CHANGES-2026,v 1.4906 2026/08/02 20:26:48 js Exp $
+$NetBSD: CHANGES-2026,v 1.4907 2026/08/02 22:11:10 thor Exp $
 
 Changes to the packages collection and infrastructure in 2026:
 
@@ -7272,3 +7272,4 @@ Changes to the packages collection and i
        Updated news/newsraft to 0.37 [ktnb 2026-08-02]
        Updated databases/objsqlite3 to 1.1.3 [js 2026-08-02]
        Updated textproc/gemtext2html to 1.2 [js 2026-08-02]
+       Updated audio/mpg123 to 1.33.7 [thor 2026-08-02]