update to 1.1.9
changes:
There are improvements to DVB subtitle support and H.264 video, and fixes
for MP3 playback, DVB, ivtv, Flash video streams and some playlist types
(particularly XML ones). One significant fix is that the special "be nice
to the user" '#' handling has been dropped since it seems to have been
causing more problems than it fixes.

pkgsrc note: a fix for CVE-2008-0225 (RTSP buffer overflow) is
already included


(drochner)

$NetBSD: patch-fa,v 1.1 2008/01/11 16:05:27 drochner Exp $

--- m4/pthreads.m4.orig	2008-01-10 16:56:36.000000000 +0100
+++ m4/pthreads.m4
@@ -37,6 +37,9 @@ AC_DEFUN([CC_PTHREAD_FLAGS], [
      esac
   fi
 
+dnl compensate for pkgsrc pthread.bl3 smartness
+  PTHREAD_LIBS="${PTHREAD_LDFLAGS} ${PTHREAD_LIBS}"
+
   AC_CACHE_CHECK([if $CC supports Pthread],
     AS_TR_SH([cc_cv_pthreads]),
     [ac_save_CFLAGS="$CFLAGS"

$NetBSD: patch-ga,v 1.1 2008/01/11 16:05:28 drochner Exp $

--- src/input/libreal/rmff.c.orig	2008-01-01 14:30:08.000000000 +0100
+++ src/input/libreal/rmff.c
@@ -35,9 +35,14 @@
  * writes header data to a buffer
  */
 
-static void rmff_dump_fileheader(rmff_fileheader_t *fileheader, char *buffer) {
+static int rmff_dump_fileheader(rmff_fileheader_t *fileheader, uint8_t *buffer,
+int bufsize) {
+
+  if (!fileheader) return 0;
+
+  if (bufsize < RMFF_FILEHEADER_SIZE)
+	return -1;
 
-  if (!fileheader) return;
   fileheader->object_id=_X_BE_32(&fileheader->object_id);
   fileheader->size=_X_BE_32(&fileheader->size);
   fileheader->object_version=_X_BE_16(&fileheader->object_version);
@@ -53,11 +58,17 @@ static void rmff_dump_fileheader(rmff_fi
   fileheader->file_version=_X_BE_32(&fileheader->file_version);
   fileheader->num_headers=_X_BE_32(&fileheader->num_headers);
   fileheader->object_id=_X_BE_32(&fileheader->object_id);
+
+  return RMFF_FILEHEADER_SIZE;
 }
 
-static void rmff_dump_prop(rmff_prop_t *prop, char *buffer) {
+static int rmff_dump_prop(rmff_prop_t *prop, uint8_t *buffer, int bufsize) {
+
+  if (!prop) return 0;
+
+  if (bufsize < RMFF_PROPHEADER_SIZE)
+	return -1;
 
-  if (!prop) return;
   prop->object_id=_X_BE_32(&prop->object_id);
   prop->size=_X_BE_32(&prop->size);
   prop->object_version=_X_BE_16(&prop->object_version);
@@ -93,13 +104,20 @@ static void rmff_dump_prop(rmff_prop_t *
   prop->num_streams=_X_BE_16(&prop->num_streams);
   prop->flags=_X_BE_16(&prop->flags);
   prop->object_id=_X_BE_32(&prop->object_id);
+
+  return RMFF_PROPHEADER_SIZE;
 }
 
-static void rmff_dump_mdpr(rmff_mdpr_t *mdpr, char *buffer) {
+static int rmff_dump_mdpr(rmff_mdpr_t *mdpr, uint8_t *buffer, int bufsize) {
 
   int s1, s2, s3;
 
-  if (!mdpr) return;
+  if (!mdpr) return 0;
+
+  if (bufsize < RMFF_MDPRHEADER_SIZE + mdpr->type_specific_len +
+      mdpr->stream_name_size + mdpr->mime_type_size)
+	return -1;
+
   mdpr->object_id=_X_BE_32(&mdpr->object_id);
   mdpr->size=_X_BE_32(&mdpr->size);
   mdpr->object_version=_X_BE_16(&mdpr->object_version);
@@ -141,13 +159,19 @@ static void rmff_dump_mdpr(rmff_mdpr_t *
   mdpr->duration=_X_BE_32(&mdpr->duration);
   mdpr->object_id=_X_BE_32(&mdpr->object_id);
 
+  return RMFF_MDPRHEADER_SIZE + s1 + s2 + s3;
 }
 
-static void rmff_dump_cont(rmff_cont_t *cont, char *buffer) {
+static int rmff_dump_cont(rmff_cont_t *cont, uint8_t *buffer, int bufsize) {
 
   int p;
 
-  if (!cont) return;
+  if (!cont) return 0;
+
+  if (bufsize < RMFF_CONTHEADER_SIZE + cont->title_len + cont->author_len +
+      cont->copyright_len + cont->comment_len)
+	return -1;
+
   cont->object_id=_X_BE_32(&cont->object_id);
   cont->size=_X_BE_32(&cont->size);
   cont->object_version=_X_BE_16(&cont->object_version);
@@ -181,11 +205,19 @@ static void rmff_dump_cont(rmff_cont_t *
   cont->size=_X_BE_32(&cont->size);
   cont->object_version=_X_BE_16(&cont->object_version);
   cont->object_id=_X_BE_32(&cont->object_id);
+
+  return RMFF_CONTHEADER_SIZE + cont->title_len + cont->author_len +
+	 cont->copyright_len + cont->comment_len;
 }
 
-static void rmff_dump_dataheader(rmff_data_t *data, char *buffer) {
+static int rmff_dump_dataheader(rmff_data_t *data, uint8_t *buffer, int
+bufsize) {
+
+  if (!data) return 0;
+
+  if (bufsize < RMFF_DATAHEADER_SIZE)
+	return -1;
 
-  if (!data) return;
   data->object_id=_X_BE_32(&data->object_id);
   data->size=_X_BE_32(&data->size);
   data->object_version=_X_BE_16(&data->object_version);
@@ -201,31 +233,43 @@ static void rmff_dump_dataheader(rmff_da
   data->size=_X_BE_32(&data->size);
   data->object_version=_X_BE_16(&data->object_version);
   data->object_id=_X_BE_32(&data->object_id);
+
+  return RMFF_DATAHEADER_SIZE;
 }
 
-int rmff_dump_header(rmff_header_t *h, char *buffer, int max) {
+int rmff_dump_header(rmff_header_t *h, void *buf_gen, int max) {
+  uint8_t *buffer = buf_gen;
 
-  int written=0;
+  int written=0, size;
   rmff_mdpr_t **stream=h->streams;
 
-  rmff_dump_fileheader(h->fileheader, &buffer[written]);
-  written+=h->fileheader->size;
-  rmff_dump_prop(h->prop, &buffer[written]);
-  written+=h->prop->size;
-  rmff_dump_cont(h->cont, &buffer[written]);
-  written+=h->cont->size;
+  if ((size=rmff_dump_fileheader(h->fileheader, &buffer[written], max)) < 0)
+	return -1;
+  written+=size;
+  max -= size;
+  if ((size=rmff_dump_prop(h->prop, &buffer[written], max)) < 0)
+	return -1;
+  written+=size;
+  max -= size;
+  if ((size=rmff_dump_cont(h->cont, &buffer[written], max)) < 0)
+	return -1;
+  written+=size;
+  max -= size;
   if (stream)
   {
     while(*stream)
     {
-      rmff_dump_mdpr(*stream, &buffer[written]);
-      written+=(*stream)->size;
+      if ((size=rmff_dump_mdpr(*stream, &buffer[written], max)) < 0)
+	return -1;
+      written+=size;
+      max -= size;
       stream++;
     }
   }
     
-  rmff_dump_dataheader(h->data, &buffer[written]);
-  written+=18;
+  if ((size=rmff_dump_dataheader(h->data, &buffer[written], max)) < 0)
+	return -1;
+  written+=size;
 
   return written;
 }

$NetBSD: patch-gb,v 1.1 2008/01/11 16:05:28 drochner Exp $

--- src/input/libreal/rmff.h.orig	2008-01-01 14:30:08.000000000 +0100
+++ src/input/libreal/rmff.h
@@ -39,6 +39,12 @@
 
 #define RMFF_HEADER_SIZE 0x12
 
+#define RMFF_FILEHEADER_SIZE 18
+#define RMFF_PROPHEADER_SIZE 50
+#define RMFF_MDPRHEADER_SIZE 46
+#define RMFF_CONTHEADER_SIZE 18
+#define RMFF_DATAHEADER_SIZE 18
+
 #define FOURCC_TAG( ch0, ch1, ch2, ch3 ) \
         (((long)(unsigned char)(ch3)       ) | \
         ( (long)(unsigned char)(ch2) << 8  ) | \
@@ -245,7 +251,7 @@ int rmff_get_header_size(rmff_header_t *
 /*
  * dumps the header <h> to <buffer>. <max> is the size of <buffer>
  */
-int rmff_dump_header(rmff_header_t *h, char *buffer, int max);
+int rmff_dump_header(rmff_header_t *h, void *buffer, int max);
 
 /*
  * dumps a packet header

$NetBSD: patch-gc,v 1.1 2008/01/11 16:05:28 drochner Exp $

--- src/input/librtsp/rtsp_session.c.orig	2008-01-01 14:30:08.000000000 +0100
+++ src/input/librtsp/rtsp_session.c
@@ -148,6 +148,11 @@ connect:
 	
 	  rtsp_session->header_left = 
     rtsp_session->header_len  = rmff_dump_header(h,rtsp_session->header,HEADER_SIZE);
+    if (rtsp_session->header_len < 0) {
+	xprintf (stream->xine, XINE_VERBOSITY_LOG,
+		_("rtsp_session: rtsp server returned overly-large headers, session can not be established.\n"));
+	goto session_abort;
+    }
 
     xine_buffer_copyin(rtsp_session->recv, 0, rtsp_session->header, rtsp_session->header_len);
     rtsp_session->recv_size = rtsp_session->header_len;
@@ -157,6 +162,7 @@ connect:
   {
     xprintf(stream->xine, XINE_VERBOSITY_LOG,
 	    _("rtsp_session: rtsp server type '%s' not supported yet. sorry.\n"), server);
+session_abort:
     rtsp_close(rtsp_session->s);
     free(server);
     xine_buffer_free(rtsp_session->recv);