Merge from 1.1.

7 files changed, 89 insertions, 54 deletions

diff --git a/.hgtags b/.hgtags
index 6e05d9638..51885c59d 100644
--- a/.hgtags
+++ b/.hgtags
@@ -65,3 +65,4 @@ e0a332b9d3e8bb3fad4d7feac1e519292b062056 xine-lib-1_1_8-release
 b6be674453e922114b55d4613cb197c77d19f094 xine-lib-1_1_9-release
 9438947f88ad2bed1832385301c6b4e62709625a xine-lib-1_1_9_1-release
 7f1232425c6d715c404e6df1292075b33ecb8305 xine-lib-1_1_10-release
+0e9e4df266f639ac7ba9e0c204f205686b56d5f9 xine-lib-1_1_10_1-release
diff --git a/ChangeLog b/ChangeLog
index ee10261ba..e2e81fc8b 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -59,7 +59,21 @@ xine-lib (1.1.90) (Unreleased)
     (XvMC does not, at present.)
 
 xine-lib (1.1.11) unreleased
+  * Reworked the plugin directory naming so that external plugins don't have
+    to be rebuilt for every release. We now use a naming scheme based on the
+    API/ABI versioning, checking older directories - with this release, the
+    plugin directory name is 1.19, and if this gets bumped to 1.20 in a
+    future release, 1.19 will still be available for external plugins.
+    (Any directories not 1.* won't be looked in.)
+
+xine-lib (1.1.10.1) 2008-02-07
+  * Security fixes:
+    - Array index vulnerability which may allow remote attackers to execute
+      arbitrary code via a crafted FLAC tag, causing a stack buffer overflow.
+      (CVE-2008-0486)
   * Fix a RealPlayer codec detection bug.
+  * Improve detection of MP3 streams with ID3v2 tags. Don't trust the tag
+    size.
 
 xine-lib (1.1.10) 2008-01-26
   * Security fixes:
diff --git a/configure.ac b/configure.ac
index 8e6dc72a9..15252782c 100644
--- a/configure.ac
+++ b/configure.ac
@@ -69,10 +69,12 @@ AC_DEFINE_UNQUOTED([XINE_PATCH], [$XINE_PATCH], [xine patch version number])
 
 XINE_LT_CURRENT=__XINE_LT_CURRENT
 AC_SUBST(XINE_LT_CURRENT)
+AC_DEFINE_UNQUOTED(XINE_LT_CURRENT, $XINE_LT_CURRENT, [xine interface version number])
 XINE_LT_REVISION=__XINE_LT_REVISION
 AC_SUBST(XINE_LT_REVISION)
 XINE_LT_AGE=__XINE_LT_AGE
 AC_SUBST(XINE_LT_AGE)
+AC_DEFINE_UNQUOTED(XINE_LT_AGE, $XINE_LT_AGE, [xine interface version age])
 
 LIBNAME="libxine$(($XINE_LT_CURRENT-$XINE_LT_AGE))"
 AC_SUBST(LIBNAME)
@@ -993,38 +995,45 @@ AC_SUBST(xinelibdir)
 AC_SUBST(xinedatadir)
 AC_SUBST(pkgconfigdir)
 
-XINE_PLUGINDIR="\${xinelibdir}/plugins/$XINE_MAJOR.$XINE_MINOR.$XINE_SUB$XINE_PATCH"
+XINE_PLUGINROOT="\${xinelibdir}/plugins/$(($XINE_LT_CURRENT-$XINE_LT_AGE))"
+XINE_PLUGINDIR="$XINE_PLUGINROOT.$XINE_LT_AGE"
 XINE_FONTDIR="\${xinedatadir}/libxine$XINE_MAJOR/fonts"
 XINE_LOCALEDIR='${datadir}/locale'
-XINE_REL_PLUGINDIR="`makeexpand "$XINE_PLUGINDIR"`"
-XINE_REL_PLUGINDIR="`makeexpand "$XINE_REL_PLUGINDIR" | sed -e "s,^${prefix}/,,"`"
+XINE_REL_PLUGINROOT="`makeexpand "$XINE_PLUGINROOT"`"
+XINE_REL_PLUGINROOT="`makeexpand "$XINE_REL_PLUGINROOT" | sed -e "s,^${prefix}/,,"`"
+XINE_REL_PLUGINDIR="$XINE_REL_PLUGINROOT.$XINE_LT_AGE"
 XINE_REL_FONTDIR="`makeexpand "$XINE_FONTDIR" | sed -e "s,^${prefix}/,,"`"
 XINE_REL_LOCALEDIR="`makeexpand "$XINE_LOCALEDIR" | sed -e "s,^${prefix}/,,"`"
 XINE_PKGCONFIG_DIR="`makeexpand "$pkgconfigdir"`"
 if test "x$WIN32_SYS" = "xmingw32" -o "x$WIN32_SYS" = "xcygwin"; then
     dnl polish paths (MinGW runtime accepts both \ and / anyway)
-    XINE_REL_PLUGINDIR="`echo "$XINE_REL_PLUGINDIR" | sed -e 's/\\//\\\\\\\\/g'`"
+    XINE_REL_PLUGINROOT="`echo "$XINE_REL_PLUGINROOT" | sed -e 's/\\//\\\\\\\\/g'`"
+    XINE_REL_PLUGINDIR="$XINE_REL_PLUGINROOT.$XINE_LT_AGE"
     XINE_REL_FONTDIR="`echo "$XINE_REL_FONTDIR" | sed -e 's/\\//\\\\\\\\/g'`"
     XINE_REL_LOCALEDIR="`echo "$XINE_REL_LOCALEDIR" | sed -e 's/\\//\\\\\\\\/g'`"
     dnl prefix in xine-config
     XINE_CONFIG_PREFIX="\$(cd \$(dirname \$0)/..; pwd)"
     dnl installation directories (in xine-config)
-    XINE_PLUGINPATH="$XINE_CONFIG_PREFIX/$XINE_REL_PLUGINDIR"
+    XINE_PLUGINROOTPATH="$XINE_CONFIG_PREFIX/$XINE_REL_PLUGINROOT"
+    XINE_PLUGINPATH="$XINE_PLUGINROOTPATH.$XINE_LT_AGE"
     XINE_FONTPATH="$XINE_CONFIG_PREFIX/$XINE_REL_FONTDIR"
     XINE_LOCALEPATH="$XINE_CONFIG_PREFIX/$XINE_REL_LOCALEDIR"
     dnl runtime directories
-    AC_DEFINE([XINE_PLUGINDIR], [xine_get_plugindir()], [Define this to plugins directory location])
+    AC_DEFINE([XINE_PLUGINROOT],[xine_get_pluginroot()],[Define this to general plugins directory location])
+    AC_DEFINE([XINE_PLUGINDIR], [xine_get_plugindir()], [Define this to specific plugins directory location])
     AC_DEFINE([XINE_FONTDIR],   [xine_get_fontdir()],   [Define this to osd fonts dir location])
     AC_DEFINE([XINE_LOCALEDIR], [xine_get_localedir()], [Path where catalog files will be.])
 else
     dnl prefix in xine-config
     XINE_CONFIG_PREFIX="`makeexpand "${prefix}"`"
     dnl directories from xine-config and runtime directories
-    XINE_PLUGINPATH="`makeexpand "$XINE_PLUGINDIR"`"
+    XINE_PLUGINROOTPATH="`makeexpand "$XINE_PLUGINROOT"`"
+    XINE_PLUGINPATH="$XINE_PLUGINROOTPATH.$XINE_LT_AGE"
     XINE_FONTPATH="`makeexpand "$XINE_FONTDIR"`"
     XINE_LOCALEPATH="`makeexpand "$XINE_LOCALEDIR"`"
     dnl defining runtime directories
-    AC_DEFINE_UNQUOTED([XINE_PLUGINDIR], ["$XINE_PLUGINPATH"], [Define this to plugins directory location])
+    AC_DEFINE_UNQUOTED([XINE_PLUGINROOT],["$XINE_PLUGINROOTPATH"], [Define this to general plugins directory location])
+    AC_DEFINE_UNQUOTED([XINE_PLUGINDIR], ["$XINE_PLUGINPATH"], [Define this to soecific plugins directory location])
     AC_DEFINE_UNQUOTED([XINE_FONTDIR],   ["$XINE_FONTPATH"],   [Define this to osd fonts dir location])
     AC_DEFINE_UNQUOTED([XINE_LOCALEDIR], ["$XINE_LOCALEPATH"], [Path where catalog files will be.])
 fi
diff --git a/debian/changelog b/debian/changelog
index 803c3f72f..b015c2afa 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -5,7 +5,7 @@ xine-lib-1.2 (1.2.0~hg-0) experimental; urgency=low
 
  -- Darren Salt <linux@youmustbejoking.demon.co.uk>  Tue, 17 Apr 2007 16:50:37 +0100
 
-xine-lib (1.1.10+hg-0) unstable; urgency=low
+xine-lib (1.1.10.1+hg-0) unstable; urgency=low
 
   [ Darren Salt ]
   * Hg snapshot.
@@ -14,7 +14,7 @@ xine-lib (1.1.10+hg-0) unstable; urgency=low
   * remove gs from build-dependencies
   * change the maintainer field to xine-devel@lists.sourceforge.net.
 
- -- Darren Salt <linux@youmustbejoking.demon.co.uk>  Sun, 27 Jan 2008 01:41:45 +0000
+ -- Darren Salt <linux@youmustbejoking.demon.co.uk>  Thu, 07 Feb 2008 17:52:34 +0000
 
 xine-lib (1.1.5~cvs-0) unstable; urgency=low
 
diff --git a/src/demuxers/demux_flac.c b/src/demuxers/demux_flac.c
index 40cd5d265..2e84eb4b7 100644
--- a/src/demuxers/demux_flac.c
+++ b/src/demuxers/demux_flac.c
@@ -189,7 +189,7 @@ static int open_flac_file(demux_flac_t *flac) {
     case 4:
       lprintf ("VORBIS_COMMENT metadata\n");
       {
-        char comments[block_length];
+        char comments[block_length + 1]; /* last byte for NUL termination */
         char *ptr = comments;
         uint32_t length, user_comment_list_length, cn;
         char *comment;
@@ -201,18 +201,25 @@ static int open_flac_file(demux_flac_t *flac) {
 
           length = _X_LE_32(ptr);
           ptr += 4 + length;
+          if (length >= block_length - 8)
+            return 0; /* bad length or too little left in the buffer */
 
           user_comment_list_length = _X_LE_32(ptr);
           ptr += 4;
 
           cn = 0;
           for (; cn < user_comment_list_length; cn++) {
+            if (ptr > comments + block_length - 4)
+              return 0; /* too little left in the buffer */
+
             length = _X_LE_32(ptr);
             ptr += 4;
+            if (length >= block_length || ptr + length > comments + block_length)
+              return 0; /* bad length */
 
             comment = (char*) ptr;
             c = comment[length];
-            comment[length] = 0;
+            comment[length] = 0; /* NUL termination */
 
             lprintf ("comment[%02d] = %s\n", cn, comment);
 
@@ -247,8 +254,8 @@ static int open_flac_file(demux_flac_t *flac) {
           }
 
           if ((tracknumber > 0) && (tracktotal > 0)) {
-            char tn[16];
-            snprintf (tn, 16, "%02d/%02d", tracknumber, tracktotal);
+            char tn[24];
+            snprintf (tn, 24, "%02d/%02d", tracknumber, tracktotal);
             _x_meta_info_set(flac->stream, XINE_META_INFO_TRACK_NUMBER, tn);
           }
           else if (tracknumber > 0) {
diff --git a/src/demuxers/demux_mpgaudio.c b/src/demuxers/demux_mpgaudio.c
index 79da40e36..dd6c62015 100644
--- a/src/demuxers/demux_mpgaudio.c
+++ b/src/demuxers/demux_mpgaudio.c
@@ -807,7 +807,6 @@ static int demux_mpgaudio_read_head(input_plugin_t *input, uint8_t *buf) {
  * return 1 if detected, 0 otherwise
  */
 static int detect_mpgaudio_file(input_plugin_t *input) {
-  mpg_audio_frame_t frame;
   uint8_t buf[MAX_PREVIEW_SIZE];
   int preview_len;
   uint32_t head;
@@ -835,8 +834,8 @@ static int detect_mpgaudio_file(input_plugin_t *input) {
       lprintf("cannot read mp3 frame header\n");
       return 0;
     }
-    if (!parse_frame_header(&frame, &buf[10 + tag_size])) {
-      lprintf ("invalid mp3 frame header\n");
+    if (!sniff_buffer_looks_like_mp3(&buf[10 + tag_size], preview_len - 10 - tag_size)) {
+      lprintf ("sniff_buffer_looks_like_mp3 failed\n");
       return 0;
     } else {
       lprintf ("a valid mp3 frame follows the id3v2 tag\n");
diff --git a/src/xine-engine/load_plugins.c b/src/xine-engine/load_plugins.c
index 94afc5b01..8e4a10a60 100644
--- a/src/xine-engine/load_plugins.c
+++ b/src/xine-engine/load_plugins.c
@@ -539,7 +539,6 @@ static void _register_plugins_internal(xine_t *this, plugin_file_t *file,
       node_cache = _get_cached_node (this, file->filename, file->filesize, file->filemtime, node_cache);
       info = (node_cache) ? node_cache->info : NULL;
     } else {
-      
       info++;
     }
   }
@@ -1234,14 +1233,24 @@ static void load_cached_catalog (xine_t *this) {
 }
 
 
+/* helper function for _x_scan_plugins */
+static void push_if_dir (xine_list_t *plugindirs, void *path)
+{
+  struct stat st;
+  if (!stat (path, &st) && S_ISDIR (st.st_mode))
+    xine_list_push_back (plugindirs, path);
+  else
+    free (path);
+}
+
 /*
  *  initialize catalog, load all plugins into new catalog
  */
 void _x_scan_plugins (xine_t *this) {
-  
-  char *homedir, *plugindir, *pluginpath;
-  int i,j;
-  int lenpluginpath;
+
+  char *homedir, *pluginpath;
+  xine_list_t *plugindirs = xine_list_new ();
+  xine_list_iterator_t iter;
   
   lprintf("_x_scan_plugins()\n");
 
@@ -1255,41 +1264,37 @@ void _x_scan_plugins (xine_t *this) {
   this->plugin_catalog = _new_catalog();
   XINE_PROFILE(load_cached_catalog (this));
 
-  if ((pluginpath = getenv("XINE_PLUGIN_PATH")) != NULL) {
-    pluginpath = strdup(pluginpath);
+  if ((pluginpath = getenv("XINE_PLUGIN_PATH")) != NULL && *pluginpath) {
+    char *p = pluginpath - 1;
+    while (p[1])
+    {
+      char *dir, *q = p;
+      p = strchr (p + 1, XINE_PATH_SEPARATOR_CHAR);
+      if (q[0] == '~' && q[1] == '/')
+	asprintf (&dir, "%s%.*s", homedir, (int)(p - q - 1), q + 1);
+      else
+	dir = strndup (q, p - q);
+      push_if_dir (plugindirs, dir); /* store or free it */
+    }
   } else {
-    const char *str1, *str2;
-    int len;
-
-    str1 = "~/.xine/plugins";
-    str2 = XINE_PLUGINDIR;
-    len = strlen(str1) + strlen(str2) + 2;
-    pluginpath = xine_xmalloc(len);
-    snprintf(pluginpath, len, "%s" XINE_PATH_SEPARATOR_STRING "%s", str1, str2);
-  }
-  plugindir = xine_xmalloc(strlen(pluginpath)+strlen(homedir)+2);
-  j=0;
-  lenpluginpath = strlen(pluginpath);
-  for (i=0; i <= lenpluginpath; ++i){
-    switch (pluginpath[i]){
-    case XINE_PATH_SEPARATOR_CHAR:
-    case '\0':
-      plugindir[j] = '\0';
-      XINE_PROFILE(collect_plugins(this, plugindir));
-      j = 0;
-      break;
-    case '~':
-      if (j == 0){
-	strcpy(plugindir, homedir);
-	j = strlen(plugindir);
-	break;
-      }
-    default:
-      plugindir[j++] = pluginpath[i];
+    char *dir;
+    int i;
+    asprintf (&dir, "%s/.xine/plugins", homedir);
+    push_if_dir (plugindirs, dir);
+    for (i = 0; i <= XINE_LT_AGE; ++i)
+    {
+      asprintf (&dir, "%s.%d", XINE_PLUGINROOT, XINE_LT_AGE - i);
+      push_if_dir (plugindirs, dir);
     }
   }
-  free(plugindir);
-  free(pluginpath);
+  for (iter = xine_list_front (plugindirs); iter;
+       iter = xine_list_next (plugindirs, iter))
+  {
+    char *dir = xine_list_get_value (plugindirs, iter);
+    collect_plugins(this, dir);
+    free (dir);
+  }
+  xine_list_delete (plugindirs);
   free(homedir);
 
   load_required_plugins (this);