Bug#1089543: libout123: UAF due to use strtok both inside jack and in libout123

2024-12-08 Thread Thomas Orgis
Thanks for noting that. Of course libout123 should better use strtok_r() instead of the plain strtok(). I added a change towards that (with the more cautionous state pointer intialized to NULL) to the mpg123 upstream repo. Am Sun, 08 Dec 2024 20:24:01 +0300 schrieb "Yuriy M. Kaminskiy" : > ==107

Bug#1089543: libout123: UAF due to use strtok both inside jack and in libout123

2024-12-08 Thread Yuriy M. Kaminskiy
Package: mpg123 Version: 1.31.2-1+deb12u1 Severity: normal Tags: patch X-Debbugs-Cc: yumkam+deb...@gmail.com Dear Maintainer, While trying to catch another sigsegv, noticed in valgrind report: ==107307== Invalid read of size 1 ==107307==at 0x4AE712C: strtok_r (strtok_r.c:47) ==107307==by