Re: lame 4.0 released

Am Sat, 11 Jul 2026 10:38:13 +0200
schrieb Alexander Leidinger via Lame-dev <[email protected]>: 

> after a loooong hiatus, two new releases where made within a short time.

Thanks a lot for peservering! I notice three remaining patches in the
pkgsrc tree for lame. Maybe these are changes still to be considered
for lame trunk? The html one is a preference by pkgsrc folks, I
presume, but I'm not sure about the need for float.h. The CVE-2015-9099
should be worth considering, though. I didn't check what else Debian
has accumulated.

Alrighty then,

Thomas

$NetBSD: patch-ab,v 1.13 2026/07/12 12:54:39 thor Exp $

Change where html doc files are installed.

--- doc/html/Makefile.in.orig	2026-07-10 18:25:39.000000000 +0000
+++ doc/html/Makefile.in
@@ -315,7 +315,7 @@ top_builddir = @top_builddir@
 top_srcdir = @top_srcdir@
 AUTOMAKE_OPTIONS = foreign
 pkgdocdir = $(docdir)/$(PACKAGE)
-pkghtmldir = $(pkgdocdir)/html
+pkghtmldir = $(pkgdocdir)
 pkghtml_DATA = \
     about.html \
 	abr.html \
$NetBSD: patch-ad,v 1.6 2026/07/12 12:54:39 thor Exp $

Add <float.h> include.

--- libmp3lame/machine.h.orig	2026-07-10 18:16:21.000000000 +0000
+++ libmp3lame/machine.h
@@ -127,6 +127,7 @@ char   *strchr(), *strrchr();
 # include <float.h>
 # define FLOAT_MAX FLT_MAX
 #else
+# include <float.h>
 # ifndef FLOAT
 typedef float FLOAT;
 #  ifdef FLT_MAX
$NetBSD: patch-libmp3lame_lame.c,v 1.3 2017/12/04 08:20:37 he Exp $

Add patch to check against invalid input sample rate.
Should fix CVE-2015-9099.  Ref.
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=775959

--- libmp3lame/lame.c.orig	2017-10-10 19:08:39.000000000 +0000
+++ libmp3lame/lame.c
@@ -801,6 +801,12 @@ lame_init_params(lame_global_flags * gfp
             gfp->samplerate_out * 16 * cfg->channels_out / (1.e3 * gfp->VBR_mean_bitrate_kbps);
     }
 
+    if (gfp->samplerate_in < 0) {
+	freegfc(gfc);
+	gfp->internal_flags = NULL;
+	return -1;
+    }
+
     cfg->disable_reservoir = gfp->disable_reservoir;
     cfg->lowpassfreq = gfp->lowpassfreq;
     cfg->highpassfreq = gfp->highpassfreq;