I'm working on up-porting xmms to gtk2, when I stumbled across some bad things that needs confirmation. When decoding russian charsets in libxmms, buffers are allocated with g_malloc() like functions, but free'd with free() in playlist code a couple of places. Wouldn't it be possible to create "bad" russian filenames and craft them to skip the first characters, and when free() is called on them, glibc stores the heap-information in-front of the pointer as far as I know.
xmms-1.2.10-r9 fixes this issue, but this version is masked.
fixed packages are in portage.
