Hello, this email is a notification from the Auto Upgrade Helper that the automatic attempt to upgrade the recipe(s) *mpg123* to *1.33.7* has Succeeded.
Next steps:
- apply the patch: git am 0001-mpg123-upgrade-1.33.6-1.33.7.patch
- check the changes to upstream patches and summarize them in the commit
message,
- compile an image that contains the package
- perform some basic sanity tests
- amend the patch and sign it off: git commit -s --reset-author --amend
- send it to the appropriate mailing list
Alternatively, if you believe the recipe should not be upgraded at this time,
you can fill RECIPE_NO_UPDATE_REASON in respective recipe file so that
automatic upgrades would no longer be attempted.
Please review the attached files for further information and build/update
failures.
Any problem please file a bug at
https://bugzilla.yoctoproject.org/enter_bug.cgi?product=Automated%20Update%20Handler
Regards,
The Upgrade Helper
-- >8 --
>From e70aa335817809b70b7b6291090e6135630af55b Mon Sep 17 00:00:00 2001
From: Upgrade Helper <[email protected]>
Date: Mon, 3 Aug 2026 05:10:34 +0000
Subject: [PATCH] mpg123: upgrade 1.33.6 -> 1.33.7
Source: NEWS
1.33.7
------
- mpg123:
-- Fix heap buffer overflows in unicode path conversion on Windows (bug 388,
thanks to Alejandro Ramos).
-- Fix information disclosure of uninitialied memory for --auth-file without
line endings. (bug 390, thanks to Alejandro Ramos)
-- Fix out-of-bounds read/write when combining --continue --random --listentry
<n>
where n is larger than the playlist size. (bug 391, thanks to Alejandro
Ramos)
-- Fix a harmless valgrind memory leak report by not nulling playlist name.
-- Fix error handling of win32_net_writestring() (Windows only) by actually
using
a signed type, also preventing a OOB read on failure.
(bug 392 by Alejandro Ramos)
-- Fix a mostly harmless OOB read of 1 byte when printing USLT lyrics.
(bug 392)
-- Fix leaking file descriptor on read error from --equalizer file. (bug 392)
-- Hardening of loading HTTP(S) via curl or wget against funky URLs by including
the -- separator. No actual vulnerability, tough, just extra care. (bug 392)
- out123:
-- Fix heap overrun on --endian conversion with differing input and output
channel counts. (bug 391)
-- Fix parsing of filter specs with whitespace before commas, which resulted
in out-of-bounds writes before. (bug 391)
- libmpg123, mpg123: Harden memory realloc calls against multiplication overflow
of size_t in arguments. Specifically, this addresses part of bug 389 with
possible
application abuse of mpg123_set_index64(). (bug 389 by Alejandro Ramos)
- libmpg123:
-- Fix possible use of uninitialized values in layer III dequantization.
III_dequantize_sample() for consistent output also for strange input. The new
code seems to be slightly faster after some rearrangements.
(thanks to He Huang, Swinburne University of Technology (discovered using
NexusSan))
-- Fix a double free when deleting a handle after failed mpg123_decoder() call
(possibly among others). (bug 389)
-- More strong wording in API that ID3 text convenience links are short-lived,
but safeguard against ignorant use by nulling them early.
(bug 389)
-- Prevent double free in mpg123_set_index() 32 bit wrapper being called with
index size 0. (bug 392)
-- Harden against an application wielding a foot gun by handing in an undersized
decoding buffer betwee seek and read (return error before trying to decode
and discard frames in that case). (bug 392)
-- Do properly terminate ID3v2 texts coming in UTF16 encoding when they
overwrite
previous frames, like with other encodings. The symptom was a shorter second
frame resulting in a combined text with the earlier longer frame.
(bug 392)
-- Check and properly handle null source buffer and zero size in
mpg123_store_utf8()
instead of reading past (before) buffers. (bug 392)
-- Ensure clients get ID3v1 data with (unmotivated) mpg123_id3_raw()
only if the parser decided that it is there, not possibly the last 128 bytes
of
a seekable stream without ID3v1 tag. (bug 392)
-- Prevent impossible N
[Changelog truncated as it exceeds 3000 characters;
the full changelog can be found in an attachment to the AUH email]
---
.../mpg123/{mpg123_1.33.6.bb => mpg123_1.33.7.bb} | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
rename meta/recipes-multimedia/mpg123/{mpg123_1.33.6.bb => mpg123_1.33.7.bb}
(96%)
diff --git a/meta/recipes-multimedia/mpg123/mpg123_1.33.6.bb
b/meta/recipes-multimedia/mpg123/mpg123_1.33.7.bb
similarity index 96%
rename from meta/recipes-multimedia/mpg123/mpg123_1.33.6.bb
rename to meta/recipes-multimedia/mpg123/mpg123_1.33.7.bb
index 7fa048c9fc..002c4f1cc6 100644
--- a/meta/recipes-multimedia/mpg123/mpg123_1.33.6.bb
+++ b/meta/recipes-multimedia/mpg123/mpg123_1.33.7.bb
@@ -10,7 +10,7 @@ LICENSE = "LGPL-2.1-only"
LIC_FILES_CHKSUM = "file://COPYING;md5=e7b9c15fcfb986abb4cc5e8400a24169"
SRC_URI = "https://www.mpg123.de/download/${BP}.tar.bz2";
-SRC_URI[sha256sum] =
"929a7c18ba662b8927aed4de229ad9ae8ab2b4806dd0f30b90113eb1b4e2195a"
+SRC_URI[sha256sum] =
"31d0e35a4ca567ec9b5ebda6c3062bb4435d6d3eacd6ef0d95cadd7854dc03ee"
UPSTREAM_CHECK_REGEX = "mpg123-(?P<pver>\d+(\.\d+)+)\.tar"
--
2.47.1
Changelog for mpg123: 1.33.6 -> 1.33.7 Source: NEWS 1.33.7 ------ - mpg123: -- Fix heap buffer overflows in unicode path conversion on Windows (bug 388, thanks to Alejandro Ramos). -- Fix information disclosure of uninitialied memory for --auth-file without line endings. (bug 390, thanks to Alejandro Ramos) -- Fix out-of-bounds read/write when combining --continue --random --listentry <n> where n is larger than the playlist size. (bug 391, thanks to Alejandro Ramos) -- Fix a harmless valgrind memory leak report by not nulling playlist name. -- Fix error handling of win32_net_writestring() (Windows only) by actually using a signed type, also preventing a OOB read on failure. (bug 392 by Alejandro Ramos) -- Fix a mostly harmless OOB read of 1 byte when printing USLT lyrics. (bug 392) -- Fix leaking file descriptor on read error from --equalizer file. (bug 392) -- Hardening of loading HTTP(S) via curl or wget against funky URLs by including the -- separator. No actual vulnerability, tough, just extra care. (bug 392) - out123: -- Fix heap overrun on --endian conversion with differing input and output channel counts. (bug 391) -- Fix parsing of filter specs with whitespace before commas, which resulted in out-of-bounds writes before. (bug 391) - libmpg123, mpg123: Harden memory realloc calls against multiplication overflow of size_t in arguments. Specifically, this addresses part of bug 389 with possible application abuse of mpg123_set_index64(). (bug 389 by Alejandro Ramos) - libmpg123: -- Fix possible use of uninitialized values in layer III dequantization. III_dequantize_sample() for consistent output also for strange input. The new code seems to be slightly faster after some rearrangements. (thanks to He Huang, Swinburne University of Technology (discovered using NexusSan)) -- Fix a double free when deleting a handle after failed mpg123_decoder() call (possibly among others). (bug 389) -- More strong wording in API that ID3 text convenience links are short-lived, but safeguard against ignorant use by nulling them early. (bug 389) -- Prevent double free in mpg123_set_index() 32 bit wrapper being called with index size 0. (bug 392) -- Harden against an application wielding a foot gun by handing in an undersized decoding buffer betwee seek and read (return error before trying to decode and discard frames in that case). (bug 392) -- Do properly terminate ID3v2 texts coming in UTF16 encoding when they overwrite previous frames, like with other encodings. The symptom was a shorter second frame resulting in a combined text with the earlier longer frame. (bug 392) -- Check and properly handle null source buffer and zero size in mpg123_store_utf8() instead of reading past (before) buffers. (bug 392) -- Ensure clients get ID3v1 data with (unmotivated) mpg123_id3_raw() only if the parser decided that it is there, not possibly the last 128 bytes of a seekable stream without ID3v1 tag. (bug 392) -- Prevent impossible NtoM resampling with too low target rate (like 1 Hz) which would trgger endless looping. (bug 392) - libout123: -- Fix deadlock in buffer mode when combined with (stereo) 24 bit output. Now also mpg123 --buffer 4096 -e s24 shall actuallly work. Sorry. (bug 392) -- Abort early on zero/negative rate and channel count in out123_start(). (bug 392) -- Fix divide by zero in WAV writing by catching channel counts that go zero in the 16 bit WAV header field. (bug 392) - libsyn123: -- Explictly reject mismatched format for appending filters with syn123_setup_filter(), preventing memory errors from that API-violating use. (bug 392) -- Harden the dirty resampling interpolator against extreme rates (around 1e18 Hz) by fixing a sample offset check to not do the exact overflowing addition that it is supposed to guard against. The fine resampler was … fine. (bug 392) -- Error out on trying to create a filter of order 0 instead of dividing by zero later. (bug 392)
0001-mpg123-upgrade-1.33.6-1.33.7.patch
Description: Binary data
packages/x86-64-v3-poky-linux/mpg123: SRC_URI changed from "https://www.mpg123.de/download/mpg123-1.33.6.tar.bz2"; to "https://www.mpg123.de/download/mpg123-1.33.7.tar.bz2"; packages/x86-64-v3-poky-linux/mpg123: PKGV changed from 1.33.6 [default] to 1.33.7 [default] packages/x86-64-v3-poky-linux/mpg123: PV changed from "1.33.6" to "1.33.7" packages/x86-64-v3-poky-linux/mpg123/mpg123-dbg: PKGSIZE changed from 2640648 to 2649672 (+0%) packages/x86-64-v3-poky-linux/mpg123/mpg123-dbg: PKGV changed from 1.33.6 [default] to 1.33.7 [default] packages/x86-64-v3-poky-linux/mpg123/mpg123-dbg: PV changed from "1.33.6" to "1.33.7" packages/x86-64-v3-poky-linux/mpg123/mpg123-dev: PKGSIZE changed from 197209 to 197706 (+0%) packages/x86-64-v3-poky-linux/mpg123/mpg123-dev: PKGV changed from 1.33.6 [default] to 1.33.7 [default] packages/x86-64-v3-poky-linux/mpg123/mpg123-dev: PV changed from "1.33.6" to "1.33.7" packages/x86-64-v3-poky-linux/mpg123/mpg123-doc: PKGV changed from 1.33.6 [default] to 1.33.7 [default] packages/x86-64-v3-poky-linux/mpg123/mpg123-doc: PV changed from "1.33.6" to "1.33.7" packages/x86-64-v3-poky-linux/mpg123/mpg123-locale: PKGV changed from 1.33.6 [default] to 1.33.7 [default] packages/x86-64-v3-poky-linux/mpg123/mpg123-locale: PV changed from "1.33.6" to "1.33.7" packages/x86-64-v3-poky-linux/mpg123/mpg123-src: PKGSIZE changed from 1918426 to 1922933 (+0%) packages/x86-64-v3-poky-linux/mpg123/mpg123-src: PKGV changed from 1.33.6 [default] to 1.33.7 [default] packages/x86-64-v3-poky-linux/mpg123/mpg123-src: FILELIST: directory renamed /usr/src/debug/mpg123/1.33.6/src -> /usr/src/debug/mpg123/1.33.7/src, directory renamed /usr/src/debug/mpg123/1.33.6/src/compat -> /usr/src/debug/mpg123/1.33.7/src/compat, directory renamed /usr/src/debug/mpg123/1.33.6/src/libout123/modules -> /usr/src/debug/mpg123/1.33.7/src/libout123/modules, directory renamed /usr/src/debug/mpg123/1.33.6/src/include -> /usr/src/debug/mpg123/1.33.7/src/include, directory renamed /usr/src/debug/mpg123/1.33.6/src/libmpg123 -> /usr/src/debug/mpg123/1.33.7/src/libmpg123, directory renamed /usr/src/debug/mpg123/1.33.6/src/libout123 -> /usr/src/debug/mpg123/1.33.7/src/libout123, directory renamed /usr/src/debug/mpg123/1.33.6/src/libsyn123 -> /usr/src/debug/mpg123/1.33.7/src/libsyn123, directory renamed /usr/src/debug/mpg123/1.33.6/src/common -> /usr/src/debug/mpg123/1.33.7/src/common packages/x86-64-v3-poky-linux/mpg123/mpg123-src: PV changed from "1.33.6" to "1.33.7" packages/x86-64-v3-poky-linux/mpg123/mpg123-staticdev: PKGV changed from 1.33.6 [default] to 1.33.7 [default] packages/x86-64-v3-poky-linux/mpg123/mpg123-staticdev: PV changed from "1.33.6" to "1.33.7" packages/x86-64-v3-poky-linux/mpg123/mpg123: PKGSIZE changed from 1034767 to 1042959 (+1%) packages/x86-64-v3-poky-linux/mpg123/mpg123: PKGV changed from 1.33.6 [default] to 1.33.7 [default] packages/x86-64-v3-poky-linux/mpg123/mpg123: PV changed from "1.33.6" to "1.33.7"
-=-=-=-=-=-=-=-=-=-=-=- Links: You receive all messages sent to this group. View/Reply Online (#242602): https://lists.openembedded.org/g/openembedded-core/message/242602 Mute This Topic: https://lists.openembedded.org/mt/120573000/21656 Group Owner: [email protected] Unsubscribe: https://lists.openembedded.org/g/openembedded-core/unsub [[email protected]] -=-=-=-=-=-=-=-=-=-=-=-
