similar to: libvorbis 1.3.5 release

Hi Ralph and libvorbis developers, I thought the vorbis gitlab project was the main development site (https://gitlab.xiph.org/xiph/vorbis) because that's what the NVD CVE tracker points to for the two CVEs I mentioned. But I just realized there's also a vorbis github project (https://github.com/xiph/vorbis). Both appear to have recent activity. Is the gitlab project the correct one

First my environment MinGW and MYSYS with gcc 3.4.2 under Windows XP pro. I configured and built libbogg with out a problem. I configured libvorbis and it finds libogg. When I type make it dies with: gcc -shared .libs/mdct.o .libs/smallft.o .libs/block.o .libs/envelope.o .libs/window.o .libs/lsp.o .libs/lpc.o .libs/analysis.o .libs/synthesis.o .libs/psy.o .libs/info.o .libs/floor1.o

Yes, the gitlab instance is the correct upstream development repository. We maintain a mirror at github for the convenience of developers there. Cheers, Ralph On Mon, 2020-06-29 at 21:27 +0000, Ellen Johnson wrote: > Hi Ralph and libvorbis developers, > I thought the vorbis gitlab project was the main development site ( > https://gitlab.xiph.org/xiph/vorbis) because that's what

Ok, I wasn't able to track down the original steps to reproduce this issue,s but we believe CVE-2018-10393 is a dupiicate of CVE-2017-14160, both fixed by commit 018ca26dece6. Because of the confusion, I added additional bounds checks to the bark_noise_hybridmp function, which make it clear to local analysis that no for bugs in this class are possible. This change is in commit a9eb99a5bd6f.

The following has been committed to the Vorbis I spec as of r19445: Errata 20150226: Single entry codebooks A ?single-entry codebook? is a codebook with one active codeword entry. A single-entry codebook may be either a fully populated codebook with only one declared entry, or a sparse codebook with only one entry marked used. The Vorbis I spec provides no means to specify a codeword length of

I'm working on getting the Darwin/Mac OS X port of Vorbis up and running again and have run into problems building libvorbisfile. I have installed the latest libtool (1.3.5) and modified it to handle Darwin/Mac OS X better (to create shared libraries, dylibs, that can be linked against other dylibs instead of creating bundles which cannot be used as input to the linker). But, when it tries

Hi Ralph, Thank you for your reply! For context -- we consider reported CVEs as bugs even if it's in a third-party library we use (such as libvorbis). We first determine if the CVE is something that would impact our customer workflows. In this case because of our use of libvorbis for audio I/O, it does impact our customers so we need to resolve the CVE as soon as possible. In the

I downloaded libogg-1.1.2 and libvorbis-1.1.0, and want to compile them using mingw32. In libogg-1.1.2 directory, 'sh configure --prefix=/mingw' and 'make' and 'make install' works smoothly. It create libogg.a, ligogg.dll.a, libogg.la in my /mingw/lib and header files in /mingw/include/ogg, so I think the gcc compiler will find them easily. After switching to

Xiph.Org announces the release of libao-1.0.0, libvorbis-1.3.1 and vorbis-tools-1.4.0. This is a coordinated update of the audio libraries and tools to deploy improved surround-sound support across the libraries and toolchain. libao improvements: - AO returned to active development - Added surround channel mapping API and capability - Updated all drivers on modern installs - New config file

Xiph.Org announces the release of libao-1.0.0, libvorbis-1.3.1 and vorbis-tools-1.4.0. This is a coordinated update of the audio libraries and tools to deploy improved surround-sound support across the libraries and toolchain. libao improvements: - AO returned to active development - Added surround channel mapping API and capability - Updated all drivers on modern installs - New config file

A new libvorbis release is now available. http://downloads.xiph.org/releases/vorbis/libvorbis-1.2.0.tar.bz2 http://downloads.xiph.org/releases/vorbis/libvorbis-1.2.0.tar.gz http://downloads.xiph.org/releases/vorbis/libvorbis-1.2.0.zip This release fixes some robustness issues with corrupt streams, including a security issue. Also new in this release is support for multiplexed streams in

Everyone, I'm pleased to announce the release of libvorbis version 1.1.0. This is the first major release since 1.0 and offers new encoder tunings for additional compression efficiency as well as a number of bugs fixes. Developers will be interested in the new 'CBR' mode support and encoder_ctl() interface. Source archives are available from our new download site:

The latest CVS update of libvorbis fails to compile on SuSE Linux 6.4. The error is below. Also, what happened to the xmms plugin directory in cvs? It complains that it is missing when I do a 'cvs update'. gcc -DPACKAGE=\"libvorbis\" -DVERSION=\"1.0beta3\" -DHAVE_ALLOCA_H=1 -DHAVE_ ALLOCA=1 -I. -I. -I../include -O20 -ffast-math -mno-ieee-fp -D_REENTRANT -fs

libvorbis 1.3.6 has been released. This release fixes several vulnerabilities, including CVE-2018-5146, that could allow code execution from a specially crafted Ogg Vorbis file. * Fix CVE-2018-5146 - out-of-bounds write on codebook decoding. * Fix CVE-2017-14632 - free() on unitialized data * Fix CVE-2017-14633 - out-of-bounds read * Fix bitrate metadata parsing. * Fix out-of-bounds read in

libvorbis 1.3.6 has been released. This release fixes several vulnerabilities, including CVE-2018-5146, that could allow code execution from a specially crafted Ogg Vorbis file. * Fix CVE-2018-5146 - out-of-bounds write on codebook decoding. * Fix CVE-2017-14632 - free() on unitialized data * Fix CVE-2017-14633 - out-of-bounds read * Fix bitrate metadata parsing. * Fix out-of-bounds read in

Hi Ralph, Again, thanks so much for doing all this! Plus thanks to all the folks who contributed to the new release! Quick clarifying question -- Isn't CVE-2018-10392 (looks like it’s fixed in https://gitlab.xiph.org/xiph/vorbis/-/issues/2335) also included in new version 1.3.7? If so can you please add it to release notes? (I asked the same question in

We have downloaded all of the Windows Vorbis 1.0 distribution files and are attempting to compile the libvorbis libraries using the batch files (e.g. build_vorbisfile_dynamic.bat). This succesfully invokes Microsoft Visual Studio but fails as shown below: <p>F:\pnewton\Project\Ogg Vorbis Downloads\V1.0\libvorbis-1.0\win32> build_vorbisfile_dynamic.bat ---+++--- Building Vorbisfile

Hi Guys, I want to compile libvorbis, but I get this error message if I made a make. I use Sun Solaris 9 on a UltraSPARC Server and gcc 3.3 can anyone help me, please? <p>Best Thanks Daniel Here the message output from compiling. ----------------------------------------- /usr/ccs/bin/ld -G -z defs -h libvorbis.so.0 -o .libs/libvorbis.so.0.3.0 mdct.lo smallft.lo block.lo envelope.lo

Hi Guys, I want to compile libvorbis, but I get this error message if I made a make. I use Sun Solaris 9 on a UltraSPARC Server. can anyone help me, please? Here the message output from compiling. Best Thanks Daniel <p>/usr/ccs/bin/ld -G -z defs -h libvorbis.so.0 -o .libs/libvorbis.so.0.3.0 mdct.lo smallft.lo block.lo envelope.lo window.lo lsp.lo lpc.lo analysis.lo synthesis.lo psy.lo

Greetings, On the official documentation page, http://www.xiph.org/ogg/vorbis/docs.html, there are links to the documents describing the released libraries, ie. libvorbis, vorbisfile and vorbisenc. However, the first one is not a link at all, although I seem to remember that it was so earlier. I also downloaded the SDK for Mac OSX, which sorta contains a documentation for libvorbis, but