xine-lib 1.1.12, and other 1.1.15 and earlier versions, does not
properly handle (a) negative and (b) zero values during unspecified
read function calls in input_file.c, input_net.c, input_smb.c, and
input_http.c, which allows remote attackers to cause a denial of
service (crash) or possibly execute arbitrary code via vectors such as
(1) a file or (2) an HTTP response, which triggers consequences such
as out-of-bounds reads and heap-based buffer overflows.

libmms will always fail to request media with URIs containing percent-encoded
characters. This is because the path component in the MMS URI should be
decoded before it is sent to the server.

http://download.microsoft.com/download/9/5/E/95EF66AF-9026-4BB0-A41D-A4F81802D92C/%5BMS-MMSP%5D.pdf
(page 48)

Add warning flags to the DEBUG_CFLAGS too.

Date: Thu, 1 May 2008 21:09:25 +0200
This patch improves the parsing of cddb information:
* Disc and track titles can now contain '='.
* If a track title is of the form <track-artist> / <track-title> the
  meta-info will contain the track-artist rather than the disc-artist.

I have tested these changes together with my get_dir patch with the
sources from debian testing/security and both Amarok and gxine now
show the right artists for tracks on a compilation album.

Date: Thu, 1 May 2008 21:05:55 +0200
This patch adds a cdda_class_get_dir method to the cdda input plugin.
I can now add an audio cd to a play-list in Amarok.
There may be small interruptions if another cd is playing though, so
it would be desirable to lower the priority for access to the
cd-drive by the get_dir function.

--HG--
extra : transplant_source : %80%12%03%93%EFL%FC%AF%A6%22Z%D0%95C%D5%29%AF%FB%95%B2