[vlc-commits] [Git][videolan/vlc][3.0.x] 4 commits: contrib: zbvi: update to 0.2.45

[Steve Lhomme (@robUx4)]

Steve Lhomme pushed to branch 3.0.x at VideoLAN / VLC


Commits:
cb10fccc by Steve Lhomme at 2026-09-05T06:57:00+00:00
contrib: zbvi: update to 0.2.45

It fixes some security issues [^1] [^2].

[^1]: https://github.com/zapping-vbi/zvbi/security/advisories/GHSA-86rm-g7qf-j2fh
[^2]: https://github.com/zapping-vbi/zvbi/blob/main/ChangeLog

(cherry picked from commit b6d509c768f0f14038001237fab8c166be1301ed)
Signed-off-by: Steve Lhomme <robux4 at ycbcr.xyz>

- - - - -
ef3c45e5 by Steve Lhomme at 2026-09-05T06:57:00+00:00
contrib: faad2: do not build if the package already exists

It is found in Debian [^1] with faad2.pc file [^2].

[^1]: https://packages.debian.org/trixie/libfaad-dev
[^2]: https://packages.debian.org/trixie/amd64/libfaad-dev/filelist

(cherry picked from commit ac6f7bd5bbc82e6abd89018573df3fa6355e73c2)
Signed-off-by: Steve Lhomme <robux4 at ycbcr.xyz>

- - - - -
b1f9704b by Steve Lhomme at 2026-09-05T06:57:00+00:00
package/win32: only install libbluray JARs in plugins/access

Similar to what is done on macOS.

It would be better to get the exact name to use for our version from
the pkg-config file [^1].

[^1]: https://code.videolan.org/videolan/libbluray/-/work_items/51

(cherry picked from commit 03425fb4761f02cac7f8223bf1d334da2c2ef687)
Signed-off-by: Steve Lhomme <robux4 at ycbcr.xyz>

- - - - -
8f421a25 by Steve Lhomme at 2026-09-05T06:57:00+00:00
contrib: gme: backport AY_emu read buffer overflow

Until there's a release with that fix.

Fixes #29895

(cherry picked from commit cb00196e1d88781dc13f785f38efaab0bde4c9ae)
Signed-off-by: Steve Lhomme <robux4 at ycbcr.xyz>

- - - - -


6 changed files:

- contrib/src/faad2/rules.mak
- + contrib/src/gme/ae10a8f05479e3c8f80429e7a59759fed06f8c13.patch
- contrib/src/gme/rules.mak
- contrib/src/zvbi/SHA512SUMS
- contrib/src/zvbi/rules.mak
- extras/package/win32/package.mak


Changes:

=====================================
contrib/src/faad2/rules.mak
=====================================
@@ -9,6 +9,9 @@ ifdef GPL
 PKGS += faad2
 endif
 endif
+ifeq ($(call need_pkg,"faad2"),)
+PKGS_FOUND += faad2
+endif
 
 $(TARBALLS)/faad2-$(FAAD2_VERSION).tar.gz:
 	$(call download_pkg,$(FAAD2_URL),faad2)


=====================================
contrib/src/gme/ae10a8f05479e3c8f80429e7a59759fed06f8c13.patch
=====================================
@@ -0,0 +1,25 @@
+From ae10a8f05479e3c8f80429e7a59759fed06f8c13 Mon Sep 17 00:00:00 2001
+From: Wohlstand <admin at wohlnet.ru>
+Date: Sat, 4 Jul 2026 15:56:19 +0300
+Subject: [PATCH] Ay_Emu.cpp: Don't read farther than buffer allows
+
+Even at release builds!
+---
+ gme/Ay_Emu.cpp | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/gme/Ay_Emu.cpp b/gme/Ay_Emu.cpp
+index e99b6fdc..af290fbc 100644
+--- a/gme/Ay_Emu.cpp
++++ b/gme/Ay_Emu.cpp
+@@ -54,7 +54,9 @@ static byte const* get_data( Ay_Emu::file_t const& file, byte const* ptr, int mi
+ {
+ 	long pos = ptr - (byte const*) file.header;
+ 	long file_size = file.end - (byte const*) file.header;
+-	assert( (unsigned long) pos <= (unsigned long) file_size - 2 );
++	// assert( (unsigned long) pos <= (unsigned long) file_size - 2 );
++	if ( (unsigned long) pos > (unsigned long) file_size - 2 )
++		return 0; // Don't read farther than buffer allows
+ 	int offset = (int16_t) get_be16( ptr );
+ 	if ( !offset || uint32_t (pos + offset) > uint32_t (file_size - min_size) )
+ 		return 0;


=====================================
contrib/src/gme/rules.mak
=====================================
@@ -14,6 +14,7 @@ DEPS_gme = zlib $(DEPS_zlib)
 
 game-music-emu: game-music-emu-$(GME_VERSION).tar.gz .sum-gme
 	$(UNPACK)
+	$(APPLY) $(SRC)/gme/ae10a8f05479e3c8f80429e7a59759fed06f8c13.patch
 	$(call pkg_static,"gme/libgme.pc.in")
 	$(MOVE)
 


=====================================
contrib/src/zvbi/SHA512SUMS
=====================================
@@ -1 +1 @@
-74b7d44faf42f919ebd3ccb69f8567f56909075d3acf4a3b4dfcbdf85489492f27d8a04173e0010f59706356e4078cd10911945f87e2596de2b897672d1e55cb  zvbi-0.2.44.tar.gz
+c627b65627446287cededd26857a7f25191adc8c42cab5a66e76f9673e06cafa52d9c3e2d31e60f949bbcaa155f61b31d775876f97f3f5c7cffe980548992a07  zvbi-0.2.45.tar.gz


=====================================
contrib/src/zvbi/rules.mak
=====================================
@@ -1,6 +1,6 @@
 # zvbi
 
-ZVBI_VERSION := 0.2.44
+ZVBI_VERSION := 0.2.45
 ZVBI_URL := $(GITHUB)/zapping-vbi/zvbi/archive/refs/tags/v$(ZVBI_VERSION).tar.gz
 
 PKGS += zvbi


=====================================
extras/package/win32/package.mak
=====================================
@@ -68,7 +68,7 @@ package-win-common: package-win-install package-win-sdk
 	-cp -r $(prefix)/share/locale $(win32_destdir)
 
 # BD-J JAR
-	-cp $(CONTRIB_DIR)/share/java/*.jar $(win32_destdir)/plugins/access/
+	-cp $(CONTRIB_DIR)/share/java/libbluray*.jar $(win32_destdir)/plugins/access/
 
 if BUILD_LUA
 	mkdir -p $(win32_destdir)/lua/



View it on GitLab: https://code.videolan.org/videolan/vlc/-/compare/d62ce2d2d6bade49f4bb32fc09b1fef4d2f73827...8f421a252eb7a192a4a71d184bc48600afe182e6

-- 
View it on GitLab: https://code.videolan.org/videolan/vlc/-/compare/d62ce2d2d6bade49f4bb32fc09b1fef4d2f73827...8f421a252eb7a192a4a71d184bc48600afe182e6
You're receiving this email because of your account on code.videolan.org. Manage all notifications: https://code.videolan.org/-/profile/notifications | Help: https://code.videolan.org/help