2.0.8 Fix crashes in libavcodec module. Fix invalid memcpy in MMS access module. Improve resitance against malformed MKV files. Reproducible: Always
I see no security-related issues in the 2.0.8 changelog.
The version is 2.0.8a http://www.videolan.org/vlc/download-sources.html
2.0.8a seems to be a hotfix, weird version policy though. Previously 2.0.8.tar.xz -pure- ended with a runtime segfault. I managed to emerge vlc-2.0.8a source by inserting an additional SRC_URI into media-video/vlc-2.0.8.ebuild --- elif [[ "${PV}" == "2.0.8" ]]; then SRC_URI="http://download.videolan.org/pub/videolan/${PN}/${PV}/${P}a.tar.xz" --- runs perfectly ...
$ vlc --version VLC media player 2.0.8 Twoflower (revision 2.0.8a-0-g68cf50b) VLC-Version 2.0.8 Twoflower (2.0.8a-0-g68cf50b) Kompiliert von portage auf localhost (Aug 3 2013 15:55:14) Kompiler: gcc version 4.7.3 (Gentoo 4.7.3 p1.0, pie-0.5.5)
VLC 2.1.0 released https://www.videolan.org/vlc/releases/2.1.0.html
2.1.0 does compile, with some caveats. - Many configure options and use flags need to be adjusted for the new version (see configure output) - If configure sees freerdp, the compilation will fail further on (tested with net-misc/freerdp-1.1.0_beta1_p20130605). RDP should proably also become an useflag.
@harp, I ran vlc-2.0.8a using media-video/ffmpeg-1.2.3 With vlc-2.1.0 is it possible to upgrade media-video/ffmpeg-2.0.1 ? (My guess this should wait for vlc-2.2.0)
vlc-2.1.0 fails compile with media-video/ffmpeg: * Running autopoint --force ... [ !! ] * Failed Running autopoint ! Using libav compiles
Uuups: "autopoint" error above has nothing to do with ffmpeg: vlc-2.1.0 is dependend on >=sys-devel/gettext-0.18.3.1 stable sys-devel/gettext-0.18.2 obviously has a not enough capable autopoint.
Vlc-2.1 and Vlc-2.0 are two branches of their own, sorry I missed this (because we have only one vlc-2.0 I thought 2.1 of a follow up) Vlc-2.0 is on the way to 2.0.9 http://git.videolan.org/?p=vlc/vlc-2.0.git;a=shortlog Vlc-2.1 is on the way to 2.1.1 http://git.videolan.org/?p=vlc/vlc-2.1.git;a=shortlog
Created attachment 359862 [details, diff] vlc-2.1.0-on-the-way-to-2.1.1.patch Vlc-2.1.0 pretty much feels very unstable. Especially having sound issues with pulseaudio I cherry picked some patches on the way to Vlc-2.1.1. It compiled and runs, but I don't know if all my 2.1.0 issues are solved as of yet.
2.0.8a and 2.1.0, where are you?
(In reply to haarp from comment #6) > - Many configure options and use flags need to be adjusted for the new > version (see configure output) Adapted in the soon to be committed vlc-9999.ebuild. > - If configure sees freerdp, the compilation will fail further on (tested > with net-misc/freerdp-1.1.0_beta1_p20130605). Adapted in the soon to be committed vlc-9999.ebuild; fixed using a patch ${PN}-2.1.0-newer-rdp.patch, which you can find in the files dir once ocmmited. > RDP should probably also become an useflag. --enable-freerdp (RDP/Remote Desktop client support) [default=auto] Confirmed, adapted in the soon to be committed vlc-9999.ebuild as USE flag rdp; apparently it was even missing a dependency on this as well, it was automagic. (In reply to Ulenrich from comment #8) > vlc-2.1.0 fails compile with media-video/ffmpeg: > * Running autopoint --force ... > [ !! ] > * Failed Running autopoint ! > > Using libav compiles (In reply to Ulenrich from comment #9) > Uuups: "autopoint" error above has nothing to do with ffmpeg: > > vlc-2.1.0 is dependend on > >=sys-devel/gettext-0.18.3.1 > > stable sys-devel/gettext-0.18.2 obviously has a not enough capable autopoint. Adapted in the soon to be committed vlc-9999.ebuild. (In reply to Ulenrich from comment #10) > Vlc-2.1 and Vlc-2.0 are two branches of their own, sorry I missed this > (because we have only one vlc-2.0 I thought 2.1 of a follow up) > > Vlc-2.0 is on the way to 2.0.9 > http://git.videolan.org/?p=vlc/vlc-2.0.git;a=shortlog > > Vlc-2.1 is on the way to 2.1.1 > http://git.videolan.org/?p=vlc/vlc-2.1.git;a=shortlog I plan to do 2.0.8 (and/or 2.0.8a) after having done 2.1.0; once I get into the habit, the 2.0.9 and 2.1.1 versions should not be too hard to adapt. (In reply to Ulenrich from comment #11) > Created attachment 359862 [details, diff] [details, diff] > vlc-2.1.0-on-the-way-to-2.1.1.patch > > Vlc-2.1.0 pretty much feels very unstable. Especially having sound issues > with pulseaudio I cherry picked some patches on the way to Vlc-2.1.1. > It compiled and runs, but I don't know if all my 2.1.0 issues are solved as > of yet. Having experienced that as well, I can confirm this; which of your patches fixes this and can you highlight why you have cherry picked the others? I don't think I understand all of them and I'd rather not pull too much or random patches with 2.1.1 being around the corner. (In reply to David Heidelberger (okias) from comment #12) > 2.0.8a and 2.1.0, where are you? Just became a maintainer for this package; 2.1.0 is around the corner, worked on a start in vlc-9999.ebuild for that but I will be working on deeply testing this and fixing most of the bugs filed. If all goes well, expect it to be released somewhere in the first half of next week.
+ 21 Oct 2013; Tom Wijsman <TomWij@gentoo.org> + +files/vlc-2.1.0-freetype-proper-default-font.patch, + +files/vlc-2.1.0-libva-1.2.1-compat.patch, +files/vlc-2.1.0-newer-rdp.patch, + metadata.xml, vlc-9999.ebuild: + Updated 9999 in a first preparation of the 2.1.0 version bump; switched to + git-r3, moved bootstrap to src_prepare, small cleanup, added USE flags + "chromaprint,opencv,rdp,sftp,vnc" and their respective dependencies + (exceptions: rdp --> freerdp, sftp --> libssh2), made unpacking work for + non-9999 versions, removed gcc warnings for missing pragmas in gcc C99 to + shorten build log, fix detection of git checkout, revised freetype fonts + patch, support newer freerdp and be compatibility with libva 1.2.1, disable + "decklink,goom,mfx,vxsu" which are not (yet) in the Portage tree. Updated + metadata.xml to document new USE flags. More changes and testing will follow.
(In reply to Ulenrich from comment #11) > Especially having sound issues with pulseaudio I cherry picked some patches on the way to Vlc-2.1.1. Still experiencing sound issues on vlc-9999; the "noise" I had is pretty much gone (yay!), but if I skip to another part of the video it has like a <50% chance of continuing to play the audio. Disabling "enable time stretching audio" in the Audio preferences helps a small bit; but still, 50% doesn't make it fun to skip. Upstream tracked at https://trac.videolan.org/vlc/ticket/9175 As a patch appears needed, I might try to run a git bisect.
(In reply to Tom Wijsman (TomWij) from comment #15) > Still experiencing sound issues on vlc-9999; the "noise" I had is pretty > much gone (yay!), I didn't have this issue, although... > but if I skip to another part of the video it has like a > <50% chance of continuing to play the audio. Disabling "enable time > stretching audio" in the Audio preferences helps a small bit; but still, 50% > doesn't make it fun to skip. ... I did have this one... there's some random probability that when I skip I have or not audio, so I have to click again on the same spot until audio appears.
@Tom, regarding vlc-2.0.x for 2.0.8 you have to get the 2.0.8a sources at http://download.videolan.org/pub/videolan/vlc/2.0.8/ which works for me (I downgraded to 2.0 from 2.1 because I couldn't fix sound). My guess a fresh vlc-2.0.9 is just hours away ... regarding 2.1 The coming point release will have in its NEWS: --- Stream out: * Fix transcoding audio drift issues * Fix numerous audio encoding issues --- my guess a fixing point release soonishly comes. I wonder if backporting cherry picked patches is worth it. Normally a few days after a release I look for easy patches, when the next monthly release is more than 3 weeks ahead ... but it is days now.
@Tom I just read the upstream ticket https://trac.videolan.org/vlc/ticket/9175 The original poster refers to vlc-2.0.8 I doubt this is recognized by upstream developers to be an 2.1 issue Though I don't habits using track ...
Thanks for the update. + 21 Oct 2013; Tom Wijsman <TomWij@gentoo.org> + -files/vlc-2.1.0-freetype-proper-default-font.patch, metadata.xml, + vlc-9999.ebuild: + Worked further on the 2.1.0 version bump: Added USE flags and dependencies to + support fdk(aac), opus, tremor, vdpau and vpx. Added support for the upcming + Qt 5 release. Added missing dependencies (libgpg-error used in HTML + communication, libidn which is used by most objects, gdb-pixbuf, glib and xcb- + util-keysyms) SLOTted all dependencies, used the slot operator where + dependencies have sub slots; to avoid incorrect dependencies, new SLOTs and + overlays versions from breaking the vlc package. Moved gettext to RDEPEND as + it was duplicated. Remove _FORTIFY_SOURCE definition as it is set to Gentoo's + default to shorten the build log by removing unnecessary warnings. Removed the + freetype patch as the configure parameters work. Ensured that there are less + to none automagic dependencies. Enumerated almost all configure parameters as + there were some missing. Removed oss due to compile error due to missing + package. Run tests using virtualx to avoid a window from popping up. + Simplified src_install. Documented fdk, tremor and vpx USE flags in + metadata.xml. More changes and testing will follow; there still appear + warnings and errors to look into (also resid_builder), which probably requires + configure.ac patching. Progress is being tracked mainly in bug #479566.
I really wonder if the bisecting method is possible with such a beast as vlc. It has not a linux-next extra tree, where changes are carefully tested and after that atomicly submitted to the main tree. Most vlc-gitversions will not come up running at all I guess.
Just arrived: http://download.videolan.org/vlc/2.0.9/ +++ b/NEWS Contribs: * Fix modplug security issues +Miscellaneous: + * Fix possible crash in directory access module + * Split PPC, Intel 32 and Intel 64 upgrade path for OS X + * Fix various memory leaks
+ 24 Oct 2013; Tom Wijsman <TomWij@gentoo.org> + +files/vlc-2.1.0-fix-libtremor-libs.patch, vlc-9999.ebuild: + More preparations for 2.1.0 version bump: Added missing line continuation + characters which absence caused the econf command to split. Made sure qt5 + being disabled doesn't override qt4's state. Removed the waveout flag. Fixed a + bug in the libraries libtremor uses by patching the Makefile. Progress is + tracked in bug #479566. 9999 is very much finished; so, I'm going to do a git bisect to find both audio bugs (garbled audio in 2.1.0 as well as skip bug in 9999), patch them up and release the bumps as soon as that is done. Bump in 24h to 48h if all goes well. (In reply to Ulenrich from comment #20) > I really wonder if the bisecting method is possible with such a beast as > vlc. It has not a linux-next extra tree, where changes are carefully tested > and after that atomicly submitted to the main tree. Most vlc-gitversions > will not come up running at all I guess. Well, the commits pulled in with 9999 seem to build / run so, I just think there will be a few commits here and there that might not, but you can skip those with git bisect. I'm also going to try to find the minimal USE / configure flags needed to reproduce the audio bugs such that the rebuilds happen fairly quick. Anyhow, I'm going to give it a shot as I want to avoid committing broken audio to the Portage tree; if it's not fixed this weekend, I guess we'll have to commit 2.1.0 masked in which case we'll have to wait for 2.1.1 or so. But before we start guessing, will see how it goes tomorrow. Meanwhile, feel free to run 9999 if you want to help pinpoint bugs I missed; given the amount of libraries involved and what not, there might for example be an incompatibility bug I'm not aware of yet (perhaps on a stable system).
+ 26 Oct 2013; Tom Wijsman <TomWij@gentoo.org> + +files/vlc-2.0.8-freetype-proper-default-font.patch, +vlc-2.1.9999.ebuild, + metadata.xml, vlc-2.0.9999.ebuild: + Updated 2.0.9999 and added 2.1.9999 by backporting fixes from 9999; adapted + 2.0.9999 to work for the 2.0 branch, disabled opencv support because it breaks + against current ~ versions of opencv and requires multiple commits to be + backported. + 26 Oct 2013; Tom Wijsman <TomWij@gentoo.org> vlc-2.0.9999.ebuild, + vlc-2.1.9999.ebuild, vlc-9999.ebuild: + Fix bug #426754 by bailing out on <sys-devel/gcc-4.5. Prepared for version + bumps by fixing up SRC_URI to support the a release. + 26 Oct 2013; Tom Wijsman <TomWij@gentoo.org> metadata.xml: + Proper indentation of metadata.xml. + 26 Oct 2013; Tom Wijsman <TomWij@gentoo.org> metadata.xml: + Document lua USE flag; fixes bug #437632, description contributed and reported + by tucxholg. + 26 Oct 2013; Tom Wijsman <TomWij@gentoo.org> + +files/vlc-2.0.8-support-uclibc.patch, vlc-2.0.9999.ebuild, + vlc-2.1.9999.ebuild, vlc-9999.ebuild: + Support uclibc on the 2.0 branch; not applied to older branches as they no + longer have the code present, therefore they might already support it. + Reported and patch contributed by Amadeusz Sławiński, fixes bug #479542. + 26 Oct 2013; Tom Wijsman <TomWij@gentoo.org> vlc-2.0.9999.ebuild, + vlc-2.1.9999.ebuild, vlc-9999.ebuild: + Support Samba 4; reported and patch provided by Torsten Kurbad, patch slightly + adapted to keep minimal version restriction in place (USE flags will + differentiate between both), fixes bug #452048. + 26 Oct 2013; Tom Wijsman <TomWij@gentoo.org> metadata.xml, + vlc-2.0.9999.ebuild, vlc-2.1.9999.ebuild, vlc-9999.ebuild: + Renamed the aac USE flag to faad as with --disable-faad, libavcodec will do + aac decoding; documented the faad USE flag in metadata.xml; solution for bug + #476598, reported by Nikoli. + 26 Oct 2013; Tom Wijsman <TomWij@gentoo.org> +vlc-2.0.8.ebuild, + +vlc-2.0.8a.ebuild, +vlc-2.0.9.ebuild, vlc-2.0.9999.ebuild: + Version bumps 2.0.8, 2.0.8a and 2.0.9. Going for yet another bisect for 2.1.0; I've already pinpointed the noise fixes, now trying to do the reverse to pinpoint the bad commit that introduced the skipping bug. Roughtly 13 builds; but well, if I get near I might be able to filter the list based on the commit descriptions. Hopefully all goes well...
Gotcha! git bisect start # bad: [a0ea1e5f8e3713044c78f916d3ed85ec21298be7] playlist: trigger "activity" callback without the lock git bisect bad a0ea1e5f8e3713044c78f916d3ed85ec21298be7 # good: [5f4bb6a9e20e3860707229c31b9d1b83d4ec6732] On the road of 1.3.0 git bisect good 5f4bb6a9e20e3860707229c31b9d1b83d4ec6732 # good: [72549b918f834891a40328ddf5fc40a59cbfd653] macosx: VLC.app shouldn't rely on a script included within VLCKit git bisect good 72549b918f834891a40328ddf5fc40a59cbfd653 # good: [55cb3971ca07c3ca103231e7d5f7ed939233bd09] XCB: key symbols list update git bisect good 55cb3971ca07c3ca103231e7d5f7ed939233bd09 # good: [38150d6e9de4d8d382149aa2e174b565958ceef7] gnutls: fix memory leak in error case git bisect good 38150d6e9de4d8d382149aa2e174b565958ceef7 # good: [832c43c64543a9cc8aeb5f1c4c5d60dcbe43761d] macosx: add basic support for multiple vout windows in embedded case git bisect good 832c43c64543a9cc8aeb5f1c4c5d60dcbe43761d # good: [50eb6474185fd7c1e2a5d84577d4a48a680c1ede] wasapi: fix indentation git bisect good 50eb6474185fd7c1e2a5d84577d4a48a680c1ede # good: [024ca98d52d2f0003677c8e942f53e86c98e0ae5] aout: make flush operation mandatory git bisect good 024ca98d52d2f0003677c8e942f53e86c98e0ae5 # good: [ab75e4f913f15c920621b676ac49b75701d364a8] LGPL: relicense Tivo demuxer to LGPL git bisect good ab75e4f913f15c920621b676ac49b75701d364a8 # bad: [6eaec7cb6995c4f7c7a12d3c9e9fd6b05a446230] shm: fix PTS delay (fixes #7579) git bisect bad 6eaec7cb6995c4f7c7a12d3c9e9fd6b05a446230 # bad: [d7bb5d8230792056223d3d9053c4f6ccc77fdfcf] motion: fix orientation of transform filter git bisect bad d7bb5d8230792056223d3d9053c4f6ccc77fdfcf # good: [49829efdd242a7d4766bc9a140199cc9d1ce60f1] macosx: fix playlist focus issue in nonembedded mode git bisect good 49829efdd242a7d4766bc9a140199cc9d1ce60f1 # bad: [44a7ebee6c9d77a06ecf82be2fe3245ed68a3c36] PulseAudio?: remove custom synchronization and resampling code git bisect bad 44a7ebee6c9d77a06ecf82be2fe3245ed68a3c36 # bad: [baf47dcc4a4501b9dd1e3fea5cd1d3357dbae306] PulseAudio?: do nothing on underflow git bisect bad baf47dcc4a4501b9dd1e3fea5cd1d3357dbae306 # first bad commit: [baf47dcc4a4501b9dd1e3fea5cd1d3357dbae306] PulseAudio?: do nothing on underflow Apparently doing nothing on underflow isn't a good idea.
Reverse commit didn't apply, but I rewrote part of it to directly call PulseAudio's library to learn the stream's rate and reused that to restart the audio stream when there is being skipped to another part in the video; which makes it back as it is was before, but then without VLC remembering the rate. The original bug linked above apparently is different; so, I'll remove my comments there over time and contact the commit author and/or file a bug in the hope to get this patch and/or effort upstream. + 26 Oct 2013; Tom Wijsman <TomWij@gentoo.org> + +files/vlc-2.1.0-TomWij-bisected-PA-broken-underflow.patch, + +files/vlc-2.1.0-avcodec-check-update-buffered_time-earlier-so-we-sho.patch, + +files/vlc-2.1.0-transcode-don-t-check-drift-if-we-have-VLC_TS_INVALI.patch, + +vlc-2.1.0.ebuild, vlc-2.0.8.ebuild, vlc-2.0.8a.ebuild, vlc-2.0.9.ebuild, + vlc-2.0.9999.ebuild, vlc-2.1.9999.ebuild, vlc-9999.ebuild: + Version bump to 2.1.0; summary of the commits leading up to this: Removed and + added USE flags so users are adviced to check them, dependencies were also + revised, Qt5 support has been added, increased freerdp and libva + compatibility, downstream bisected and/or backported fixes of broken audio, + default fonts are now set trough econf based on USE flags, configure flags + were revised and automagic dependencies have been fixed. Fixes bug #479566. + Unrelated to this summary; for the other versions (>=2.0.8) the freerdp and + gettext dependencies were updated in this commit to reflect what vlc needs and + provides, thanks to Nikoli and Mike Gilbert (floppym) for reporting this last + issue on IRC. And I think we're done here; was quite a week, let's hope everything is covered.
