Version 1.0.26

libsndfile · Nov 22, 2015 · f67f099 · f67f099
1 parent b520099
commit f67f099
Show file tree

Hide file tree

Showing 7 changed files with 53 additions and 43 deletions.
diff --git a/NEWS b/NEWS
@@ -1,3 +1,11 @@
+Version 1.0.26 (2015-11-22)
+  * Fix for CVE-2014-9496, SD2 buffer read overflow.
+  * Fix for CVE-2014-9756, file_io.c divide by zero.
+  * Fix for CVE-2015-7805, AIIF heap write overflow.
+  * Add support for ALAC encoder in a CAF container.
+  * Add support for Cart chunks in WAV files.
+  * Minor bug fixes and improvements.
+
 Version 1.0.25 (2011-07-13)
   * Fix for Secunia Advisory SA45125, heap overflow in PAF file handler.
   * Accept broken WAV files with blockalign == 0.

diff --git a/README b/README
@@ -1,4 +1,4 @@
-This is libsndfile, 1.0.25
+This is libsndfile, 1.0.26
 
 libsndfile is a library of C routines for reading and writing
 files containing sampled audio data.

diff --git a/configure.ac b/configure.ac
@@ -3,7 +3,7 @@
 dnl Require autoconf version
 AC_PREREQ(2.57)
 
-AC_INIT([libsndfile],[1.0.26pre6],[sndfile@mega-nerd.com],
+AC_INIT([libsndfile],[1.0.26],[sndfile@mega-nerd.com],
 		[libsndfile],[http://www.mega-nerd.com/libsndfile/])
 
 # Put config stuff in Cfg.

diff --git a/doc/FAQ.html b/doc/FAQ.html
@@ -844,7 +844,7 @@ <H2><BR/><B>Q23 : I'm cross compiling libsndfile for another platform. How can I
 		<A HREF="http://www.mega-nerd.com/libsndfile/">
 			http://www.mega-nerd.com/libsndfile/</A>.
 <BR/>
-Version : 1.0.25
+Version : 1.0.26
 </P>
 
 </BODY>

diff --git a/doc/api.html b/doc/api.html
@@ -795,7 +795,7 @@ <H2><BR><B>Note 2</B></H2>
 		<A HREF="http://www.mega-nerd.com/libsndfile/">here</A>.
 </P>
 <P>
-Version : 1.0.25
+Version : 1.0.26
 </P>
 <!-- pepper -->
 <!-- pepper -->

diff --git a/doc/dither.html b/doc/dither.html
@@ -21,18 +21,18 @@ <H1><B>sf_command</B></H1>
         int    sf_command (SNDFILE *sndfile, int cmd, void *data, int datasize) ;
 </PRE>
 <P>
-	This function allows the caller to retrieve information from or change aspects of the 
-	library behaviour. 
-	Examples include retrieving a string containing the library version or changing the 
+	This function allows the caller to retrieve information from or change aspects of the
+	library behaviour.
+	Examples include retrieving a string containing the library version or changing the
 	scaling applied to floating point sample data during read and write.
 	Most of these operations are performed on a per-file basis.
 </P>
 <P>
 	The cmd parameter is a integer identifier which is defined in &lt;sndfile.h&gt;.
 	All of the valid command identifiers have names begining with "SFC_".
-	Data is passed to and returned from the library by use of a void pointer. 
-	The library will not read or write more than datasize bytes from the void pointer. 
-	For some calls no data is required in which case data should be NULL and datasize 
+	Data is passed to and returned from the library by use of a void pointer.
+	The library will not read or write more than datasize bytes from the void pointer.
+	For some calls no data is required in which case data should be NULL and datasize
 	may be used for some other purpose.
 </P>
 <P>
@@ -70,15 +70,15 @@ <H1><B>sf_command</B></H1>
 	<TD><A HREF="#SFC_SET_NORM_FLOAT">SFC_SET_NORM_FLOAT</A></TD>
 	<TD>Modify the normalisation behaviour of the floating point reading and writing functions.</TD>
 </TR>
-<TR>	
+<TR>
 	<TD><A HREF="#SFC_SET_NORM_DOUBLE">SFC_SET_NORM_DOUBLE</A></TD>
 	<TD>Modify the normalisation behaviour of the double precision floating point reading and writing functions.</TD>
 </TR>
 <TR>
 	<TD><A HREF="#SFC_GET_NORM_FLOAT">SFC_GET_NORM_FLOAT</A></TD>
 	<TD>Retrieve the current normalisation behaviour of the floating point reading and writing functions.</TD>
 </TR>
-<TR>	
+<TR>
 	<TD><A HREF="#SFC_GET_NORM_DOUBLE">SFC_GET_NORM_DOUBLE</A></TD>
 	<TD>Retrieve the current normalisation behaviour of the double precision floating point reading and writing functions.</TD>
 </TR>
@@ -147,7 +147,7 @@ <H1><B>sf_command</B></H1>
 	<TD>Add dither to output on write.</TD>
 </TR>
 -->
-</TABLE>	
+</TABLE>
 </CENTER>
 
 <BR><BR>
@@ -254,7 +254,7 @@ <H2><BR><B>SFC_CALC_SIGNAL_MAX</B></H2>
 <A NAME="SFC_CALC_NORM_SIGNAL_MAX"></A>
 <H2><BR><B>SFC_CALC_NORM_SIGNAL_MAX</B></H2>
 <P>
-Retrieve the measured normailised maximum signal value. This involves reading 
+Retrieve the measured normailised maximum signal value. This involves reading
 through the whole file which can be slow on large files.
 </P>
 <P>
@@ -347,7 +347,7 @@ <H2><BR><B>Read text</B></H2>
 </P>
 <P>
 It should be noted that the way the string is added to the file is file format dependant
-but that any string added with <A HREF="#write-text">write text</A> will be returned by 
+but that any string added with <A HREF="#write-text">write text</A> will be returned by
 <A HREF="#read-text">read text</A>.
 </P>
 <P>
@@ -369,9 +369,9 @@ <H2><BR><B>Read text</B></H2>
 </PRE>
 <DL>
 <DT>Return value:</DT>
-<DD>If a text string is found, this call will return the length of the retrieved text 
+<DD>If a text string is found, this call will return the length of the retrieved text
 	string.
-	<DD>If no text string is found, zero will be returned and the first element in the 
+	<DD>If no text string is found, zero will be returned and the first element in the
 	buffer will be set to the null character.
 <DT>Notes:</DT>
 <DD>The string returned in the buffer passed to this function will not overflow
@@ -382,7 +382,7 @@ <H2><BR><B>Read text</B></H2>
 <H2><BR><B>Write text</B></H2>
 <P>
 Add a text string to a file. The text string added can be retrieved when the file is
-read using <A HREF="#read-text">read text</A>. 
+read using <A HREF="#read-text">read text</A>.
 </P>
 <P>
 Parameters:
@@ -402,10 +402,10 @@ <H2><BR><B>Write text</B></H2>
 </PRE>
 <DL>
 <DT>Return value: </DT>
-	<DD>If the current file format allows the addition of text strings, the string will 
-		be added and the length of the string will be returned. 
+	<DD>If the current file format allows the addition of text strings, the string will
+		be added and the length of the string will be returned.
 	<DD>If the file format does not allow the addition of text strings zero will be returned.
-	<DD>If this function is called after the file is openned but before 
+	<DD>If this function is called after the file is openned but before
 </DL>
 -->
 
@@ -433,7 +433,7 @@ <H2><BR><B>SFC_SET_NORM_FLOAT</B></H2>
         datasize : SF_TRUE or SF_FALSE
 </PRE>
 <P>
-For read operations setting normalisation to SF_TRUE means that the data from all 
+For read operations setting normalisation to SF_TRUE means that the data from all
 subsequent reads will be be normalised to the range [-1.0, 1.0].
 </P>
 <P>
@@ -461,7 +461,7 @@ <H2><BR><B>SFC_SET_NORM_FLOAT</B></H2>
 <A NAME="SFC_SET_NORM_DOUBLE"></A>
 <H2><BR><B>SFC_SET_NORM_DOUBLE</B></H2>
 <P>
-This command only affects data read from or written to using the double precision 
+This command only affects data read from or written to using the double precision
 floating point functions:
 </P>
 <PRE>
@@ -481,7 +481,7 @@ <H2><BR><B>SFC_SET_NORM_DOUBLE</B></H2>
         datasize : SF_TRUE or SF_FALSE
 </PRE>
 <P>
-For read operations setting normalisation to SF_TRUE means that the data 
+For read operations setting normalisation to SF_TRUE means that the data
 from all subsequent reads will be be normalised to the range [-1.0, 1.0].
 </P>
 <P>
@@ -610,7 +610,7 @@ <H2><BR><B>SFC_GET_SIMPLE_FORMAT</B></H2>
         } SF_FORMAT_INFO ;
 </PRE>
 <P>
-When sf_command() is called with SF_GET_SIMPLE_FORMAT, the value of the format 
+When sf_command() is called with SF_GET_SIMPLE_FORMAT, the value of the format
 field should be the format number (ie 0 <= format <= count value obtained using
 SF_GET_SIMPLE_FORMAT_COUNT).
 </P>
@@ -632,8 +632,8 @@ <H2><BR><B>SFC_GET_SIMPLE_FORMAT</B></H2>
 <DL>
 <DT>Return value: </DT>
 	<DD>0 on success and non-zero otherwise.
-	<DD>The value of the format field of the SF_FORMAT_INFO struct will be an value which 
-		can be placed in the format field of an SF_INFO struct when a file is to be opened 
+	<DD>The value of the format field of the SF_FORMAT_INFO struct will be an value which
+		can be placed in the format field of an SF_INFO struct when a file is to be opened
 		for write.
 	<DD>The name field will contain a char* pointer to the name of the string ie "WAV (Microsoft 16 bit PCM)".
 	<DD>The extention field will contain the most commonly used file extension for that file type.
@@ -665,11 +665,11 @@ <H2><BR><B>SFC_GET_FORMAT_INFO</B></H2>
         } SF_FORMAT_INFO ;
 </PRE>
 <P>
-When sf_command() is called with SF_GET_FORMAT_INFO, the format field is 
+When sf_command() is called with SF_GET_FORMAT_INFO, the format field is
 examined and if (format & SF_FORMAT_TYPEMASK) is a valid format then the struct
 is filled in with information about the given major type.
 If (format & SF_FORMAT_TYPEMASK) is FALSE and (format & SF_FORMAT_SUBMASK) is a
-valid subtype format then the struct is filled in with information about the given 
+valid subtype format then the struct is filled in with information about the given
 subtype.
 </P>
 <P>
@@ -829,7 +829,7 @@ <H2><BR><B>SFC_GET_FORMAT_SUBTYPE</B></H2>
 	<DD>0 on success and non-zero otherwise.
 	<DD>The value of the format field will one of the major format identifiers such as SF_FORMAT_WAV
 		SF_FORMAT_AIFF.
-	<DD>The name field will contain a char* pointer to the name of the string; for instance 
+	<DD>The name field will contain a char* pointer to the name of the string; for instance
 		"WAV (Microsoft)" or "AIFF (Apple/SGI)".
 	<DD>The extention field will be a NULL pointer.
 </DL>
@@ -838,7 +838,7 @@ <H2><BR><B>SFC_GET_FORMAT_SUBTYPE</B></H2>
 <A NAME="SFC_SET_ADD_PEAK_CHUNK"></A>
 <H2><BR><B>SFC_SET_ADD_PEAK_CHUNK</B></H2>
 <P>
-By default, WAV and AIFF files which contain floating point data (subtype SF_FORMAT_FLOAT 
+By default, WAV and AIFF files which contain floating point data (subtype SF_FORMAT_FLOAT
 or SF_FORMAT_DOUBLE) have a PEAK chunk.
 By using this command, the addition of a PEAK chunk can be turned on or off.
 </P>
@@ -879,9 +879,9 @@ <H2><BR><B>SFC_UPDATE_HEADER_NOW</B></H2>
 <P>
 There are however situations where large files are being generated and it would
 be nice to have valid data in the header before the file is complete.
-Using this command will update the file header to reflect the amount of data written 
+Using this command will update the file header to reflect the amount of data written
 to the file so far.
-Other programs opening the file for read (before any more data is written) will 
+Other programs opening the file for read (before any more data is written) will
 then read a valid sound file header.
 </P>
 <P>
@@ -954,7 +954,7 @@ <H2><BR><B>SFC_FILE_TRUNCATE</B></H2>
 to by data.
 After this command, both the read and the write pointer will be
 at the new end of the file.
-This command will fail (returning non-zero) if the requested truncate position 
+This command will fail (returning non-zero) if the requested truncate position
 is beyond the end of the file.
 </P>
 <P>
@@ -1006,11 +1006,11 @@ <H2><BR><B>SFC_SET_RAW_START_OFFSET</B></H2>
 
 <HR>
 <P>
-	The libsndfile home page is here : 
+	The libsndfile home page is here :
 		<A HREF="http://www.mega-nerd.com/libsndfile/">
 			http://www.mega-nerd.com/libsndfile/</A>.
 <BR>
-Version : 1.0.25
+Version : 1.0.26
 </P>
 
 </BODY>

diff --git a/doc/index.html b/doc/index.html
@@ -6,7 +6,7 @@
 	libsndfile
 	</TITLE>
 	<META NAME="Author"      CONTENT="Erik de Castro Lopo (erikd AT mega-nerd DOT com)">
-    <META NAME="Version"     CONTENT="libsndfile-1.0.25">
+    <META NAME="Version"     CONTENT="libsndfile-1.0.26">
 	<META NAME="Description" CONTENT="The libsndfile Home Page">
 	<META NAME="Keywords"    CONTENT="WAV AIFF AU SVX PAF NIST W64 libsndfile sound audio dsp Linux">
 	<META NAME="ROBOTS" 	 CONTENT="NOFOLLOW">
@@ -368,6 +368,8 @@ <H1><B>History</B></H1>
 	<LI>Version 1.0.24 (March 23 2011) Minor bug fixes.
 	<LI>Version 1.0.25 (July 13 2011) Fix for Secunia Advisory SA45125. Minor bug fixes and
 				improvements.
+	<LI>Version 1.0.26 (November 22 2015) Fix for CVE-2014-9496, CVE-2014-9756 and CVE-2015-7805.
+				Add ALAC/CAF support. Minor bug fixes and improvements.
 	</UL>
 
 <A NAME="Similar"></A>
@@ -429,16 +431,16 @@ <H1><B>Download</B></H1>
 </P>
 	<UL>
 	<LI>Source code as a .tar.gz :
-			<A HREF="files/libsndfile-1.0.25.tar.gz">libsndfile-1.0.25.tar.gz</A>
+			<A HREF="files/libsndfile-1.0.26.tar.gz">libsndfile-1.0.26.tar.gz</A>
 			and
-			<A HREF="files/libsndfile-1.0.25.tar.gz.asc">(GPG signature)</A>.
+			<A HREF="files/libsndfile-1.0.26.tar.gz.asc">(GPG signature)</A>.
 	<LI>Win32 installer:
-			<A HREF="files/libsndfile-1.0.25-w32-setup.exe">
-			libsndfile-1.0.25-w32-setup.exe</A> (thoroughly tested under
+			<A HREF="files/libsndfile-1.0.26-w32-setup.exe">
+			libsndfile-1.0.26-w32-setup.exe</A> (thoroughly tested under
 			<a href="http://www.winehq.com/">Wine</a> and Windows XP).
 	<LI>Win64 installer:
-			<A HREF="files/libsndfile-1.0.25-w64-setup.exe">
-			libsndfile-1.0.25-w64-setup.exe</A>
+			<A HREF="files/libsndfile-1.0.26-w64-setup.exe">
+			libsndfile-1.0.26-w64-setup.exe</A>
 			(thoroughly tested on 64 bit Windows 7).
 	</UL>