Your message dated Tue, 04 Aug 2026 19:21:24 +0000
with message-id <[email protected]>
and subject line Bug#1143495: fixed in mpg123 1.33.7-1
has caused the Debian Bug report #1143495,
regarding [mpg123-devel] mpg123 1.33.7 released (with lots of security
fixes/improvements)
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email protected]
immediately.)
--
1143495: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1143495
Debian Bug Tracking System
Contact [email protected] with problems
--- Begin Message ---
Package: libmpg123-0t64
Package: libmpg123-dev
Dear all,
the mpg123 code to some scrutiny applied and several issues popped up.
There is a mix of serious blunder and embarrasing little oversights.
You really should consider updating. There is 1.34.0 in the making with some
feature changes, things waiting in the pipeline since quite some time now, but
the load of fixes demands timely release without any other fluff. There might
be CVEs.
If you are stuck on something pre-1.33, you probably can prioritize some
commits or might be lucky with the diff. Lots of the bugs are in older code.
Most severe is the fix for unicode path handling on Windows platforms, and that
is why I took the pain to also update the binaries via cross build. The whole
list:
1.33.7
------
- mpg123:
-- Fix heap buffer overflows in unicode path conversion on Windows (bug 388,
thanks to Alejandro Ramos).
-- Fix information disclosure of uninitialied memory for --auth-file without
line endings. (bug 390, thanks to Alejandro Ramos)
-- Fix out-of-bounds read/write when combining --continue --random --listentry
<n>
where n is larger than the playlist size. (bug 391, thanks to Alejandro
Ramos)
-- Fix a harmless valgrind memory leak report by not nulling playlist name.
-- Fix error handling of win32_net_writestring() (Windows only) by actually
using
a signed type, also preventing a OOB read on failure.
(bug 392 by Alejandro Ramos)
-- Fix a mostly harmless OOB read of 1 byte when printing USLT lyrics.
(bug 392)
-- Fix leaking file descriptor on read error from --equalizer file. (bug 392)
-- Hardening of loading HTTP(S) via curl or wget against funky URLs by including
the -- separator. No actual vulnerability, tough, just extra care. (bug 392)
- out123:
-- Fix heap overrun on --endian conversion with differing input and output
channel counts. (bug 391)
-- Fix parsing of filter specs with whitespace before commas, which resulted
in out-of-bounds writes before. (bug 391)
- libmpg123, mpg123: Harden memory realloc calls against multiplication overflow
of size_t in arguments. Specifically, this addresses part of bug 389 with
possible
application abuse of mpg123_set_index64(). (bug 389 by Alejandro Ramos)
- libmpg123:
-- Fix possible use of uninitialized values in layer III dequantization.
III_dequantize_sample() for consistent output also for strange input. The new
code seems to be slightly faster after some rearrangements.
(thanks to He Huang, Swinburne University of Technology (discovered using
NexusSan))
-- Fix a double free when deleting a handle after failed mpg123_decoder() call
(possibly among others). (bug 389)
-- More strong wording in API that ID3 text convenience links are short-lived,
but safeguard against ignorant use by nulling them early.
(bug 389)
-- Prevent double free in mpg123_set_index() 32 bit wrapper being called with
index size 0. (bug 392)
-- Harden against an application wielding a foot gun by handing in an undersized
decoding buffer betwee seek and read (return error before trying to decode
and discard frames in that case). (bug 392)
-- Do properly terminate ID3v2 texts coming in UTF16 encoding when they
overwrite
previous frames, like with other encodings. The symptom was a shorter second
frame resulting in a combined text with the earlier longer frame.
(bug 392)
-- Check and properly handle null source buffer and zero size in
mpg123_store_utf8()
instead of reading past (before) buffers. (bug 392)
-- Ensure clients get ID3v1 data with (unmotivated) mpg123_id3_raw()
only if the parser decided that it is there, not possibly the last 128 bytes
of
a seekable stream without ID3v1 tag. (bug 392)
-- Prevent impossible NtoM resampling with too low target rate (like 1 Hz) which
would trgger endless looping. (bug 392)
- libout123:
-- Fix deadlock in buffer mode when combined with (stereo) 24 bit output. Now
also mpg123 --buffer 4096 -e s24 shall actuallly work. Sorry. (bug 392)
-- Abort early on zero/negative rate and channel count in out123_start().
(bug 392)
-- Fix divide by zero in WAV writing by catching channel counts that go zero in
the
16 bit WAV header field. (bug 392)
- libsyn123:
-- Explictly reject mismatched format for appending filters with
syn123_setup_filter(), preventing memory errors from that API-violating use.
(bug 392)
-- Harden the dirty resampling interpolator against extreme rates (around 1e18
Hz)
by fixing a sample offset check to not do the exact overflowing addition
that it is supposed to guard against. The fine resampler was … fine. (bug
392)
-- Error out on trying to create a filter of order 0 instead of dividing by zero
later. (bug 392)
Get it while it is hot … and before the next round of bugs discoveries arrive.
Alrighty then (or not),
Thomas
_______________________________________________
mpg123-devel mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/mpg123-devel
--- End Message ---
--- Begin Message ---
Source: mpg123
Source-Version: 1.33.7-1
Done: Sebastian Ramacher <[email protected]>
We believe that the bug you reported is fixed in the latest version of
mpg123, which is due to be installed in the Debian FTP archive.
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to [email protected],
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
Sebastian Ramacher <[email protected]> (supplier of updated mpg123 package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing [email protected])
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
Format: 1.8
Date: Tue, 04 Aug 2026 21:10:48 +0200
Source: mpg123
Architecture: source
Version: 1.33.7-1
Distribution: unstable
Urgency: medium
Maintainer: Debian Multimedia Maintainers <[email protected]>
Changed-By: Sebastian Ramacher <[email protected]>
Closes: 1143495
Changes:
mpg123 (1.33.7-1) unstable; urgency=medium
.
* New upstream version 1.33.7 (Closes: #1143495)
* debian/: Refactor alternatives handling
Checksums-Sha1:
f1320dec66d8c5e905c4f260dfe117f0adf2354e 2094 mpg123_1.33.7-1.dsc
2922a9bb86f36c5d9082fad9baa3903aaeef7918 1126376 mpg123_1.33.7.orig.tar.bz2
7a3238a09348749d0633d7beac8f9ba23fae80e4 833 mpg123_1.33.7.orig.tar.bz2.asc
100aee99743bc9333f113cec654739ff56762ad0 25400 mpg123_1.33.7-1.debian.tar.xz
34378d0115e64db8981a90b8d455f9f56ec33938 9655 mpg123_1.33.7-1_amd64.buildinfo
Checksums-Sha256:
e877f96b94eca32d8f14dfa971bfb87f503710ce7292b807110bef355f1797b1 2094
mpg123_1.33.7-1.dsc
31d0e35a4ca567ec9b5ebda6c3062bb4435d6d3eacd6ef0d95cadd7854dc03ee 1126376
mpg123_1.33.7.orig.tar.bz2
7f22572ea8a212b7d16a6a158371a74b73201c891bb0c12d692cc814ef6694ff 833
mpg123_1.33.7.orig.tar.bz2.asc
d60f57873f7efd74e05ce1630382ca531656bd56144e6139f36c674f5a0ecb5a 25400
mpg123_1.33.7-1.debian.tar.xz
373e5ec2ac6c107028650fb7a42d69e67d5ff43803822bbca05b0034e21d7663 9655
mpg123_1.33.7-1_amd64.buildinfo
Files:
54016832d51d05cc220575078347c7cc 2094 sound optional mpg123_1.33.7-1.dsc
46ceab9bfb0f04e739f010b88de5943d 1126376 sound optional
mpg123_1.33.7.orig.tar.bz2
90ab6648bd2f88f380c4e4b46414133f 833 sound optional
mpg123_1.33.7.orig.tar.bz2.asc
207eb8195d61b39de4866b466b3bec21 25400 sound optional
mpg123_1.33.7-1.debian.tar.xz
38baeced2ad02e6cacc5dc1f4a830e15 9655 sound optional
mpg123_1.33.7-1_amd64.buildinfo
-----BEGIN PGP SIGNATURE-----
wr0EARYKAG8FgmpyOdYJECGTazZgD82JRxQAAAAAAB4AIHNhbHRAbm90YXRpb25z
LnNlcXVvaWEtcGdwLm9yZ1nz3RDiks3KYIBbM57CR4AneBk1DHWS9wYVYKxgHs3O
FiEEQmJ+hB2ZZ9qD4fqQIZNrNmAPzYkAAICkAP4mFE7QLTPYv3sFXT05BxRCp+MP
zSTh4C5e4IjwDls4DQD+KDldNcShyzwNl+kPFzIux6BbaNEVpGWZchYE4qQT4A8=
=IV2P
-----END PGP SIGNATURE-----
pgpYl976wclaH.pgp
Description: PGP signature
--- End Message ---
