Ogg Vorbis 1.2.0 is out Options

[spoon]

libvorbis 1.2.0 (2007-07-25) -- "Xiph.Org libVorbis I 20070622"

* new ov_fopen() convenience call that avoids the common
stdio conflicts with ov_open() and MSVC runtimes.
* libvorbisfile now handles multiplexed streams
* improve robustness to corrupt input streams
* fix a minor encoder bug
* updated RTP draft
* build system updates
* minor corrections to the specification

Ogg is unchanged.

[xmixahlx]

so THAT's what has been going on in SVN

any aotuv merges?

thanks for the note, spoon.


later

[dannyb37]

I feel like saying "its about time there was an update"
although I don't know when the last one was. Good on them!

[DOS386]

> Ogg Vorbis 1.2.0 is out

Nice. But no "official" announcement ?

Also "official" binaries (like FLAC and WAVPACK do have) would be good.

[kjoonlee]

From the mailing list thread for 1.2.0 RC:
>> This does not incorporate any of the tunings from the aoTuV branch
> ...Yet. Before anyone asks, Monty will add the tunings on another
> release. There can't be just a blind merge. It has to be tested
> appropriately.
> -Ivo

This post has been edited by kjoonlee: Jul 26 2007, 19:51

[JensRex]

Also "official" binaries (like FLAC and WAVPACK do have) would be good.

Paging John33.

[spoon]

The last vorbis update was early 2005! (off the top of my head)

We have updated dBpoweramp beta codecs (Flac and Ogg Vorbis( to 1.2.0.

-------

I think it might tie in with FLAC 1.2.0, the sudden jump to 1.2.0 was (atleast for me) unexpected for FLAC and Ogg Vorbis, perhaps Josh can shed some light, is there a big picture somewhere?

[jcoalson]

I think it might tie in with FLAC 1.2.0, the sudden jump to 1.2.0 was (atleast for me) unexpected for FLAC and Ogg Vorbis, perhaps Josh can shed some light, is there a big picture somewhere?

no, just coincidence!

[TrNSZ]

libvorbis 1.2.0 (2007-07-25) -- "Xiph.Org libVorbis I 20070622"

CODE

Affected package: libvorbis-1.1.2,3 (matched by libvorbis<1.2.0,3)
Type of problem: libvorbis -- Multiple memory corruption flaws.
Reference: <http://www.FreeBSD.org/ports/portaudit/b73335a5-3bbe-11dc-8e83-0016179b2dd5.html>

CODE

iSEC Partners Security Advisory - 2007-003-libvorbis
http://www.isecpartners.com
--------------------------------------------

libvorbis 1.1.2 - Multiple memory corruption flaws

Vendor: Xiph.org
Vendor URL: http://www.xiph.org
Systems Affected: All tested software based upon libvorbis 1.1.2
Severity: High (Heap corruption, Denial of Service, Potential code execution)
Author: David Thiel <david[at]isecpartners[dot]com>

Vendor notified: 2007-06-05
Public release: 2007-07-26
Advisory URL: http://www.isecpartners.com/advisories/200...3-libvorbis.txt

Summary:
--------

libvorbis 1.1.2 contains several vulnerabilities allowing heap overwrite,
read violations and a function pointer overwrite. These bugs cause a
at least a denial of service, and potentially code execution.

Details:
--------

Invalid blocksize_0 and blocksize_1 values result in a heap overwrite in
the _01inverse() function of res0.c.

An invalid mapping type causes an out of bounds dispatch table
lookup, offset by an attacker-controlled value, during cleanup in
vorbis_info_clear() in info.c.

Additionally, invalid blocksize values cause a segmentation fault on
read in block.c.

Fix Information:
----------------

These issues are resolved in libvorbis 1.2.0, available at:

http://downloads.xiph.org/releases/vorbis/...s-1.2.0.tar.bz2

Thanks to:
----------
Xiphmont and Ralph Giles of Xiph.org for their detailed help determining
root causes of and fixes for these issues.

About iSEC Partners:
--------------------
iSEC Partners is a full-service security consulting firm that provides
penetration testing, secure systems development, security education
and software design verification, with offices in San Francisco and
Seattle.

Information on testing media players and codecs to expose and prevent
similar bugs and tools to do the same will be presented at BlackHat USA
2007.

http://www.isecpartners.com
info@isecpartners.com

This post has been edited by TrNSZ: Jul 27 2007, 01:32

[rjamorim]

Nice. But no "official" announcement ?

Also "official" binaries (like FLAC and WAVPACK do have) would be good.

That's no surprise at all. Xiph has been like that since Emmett left.

Paging John33.

Interestingly enough, John33 was the purveyor of official Vorbis binaries. I guess the Xiph guys lost his e-mail address or something

[DOS386]

That's no surprise at all. Xiph has been like that since Emmett left.

Get up-to-date binaries of Lame, AAC, Vorbis and much more at RareWares:
http://www.rarewares.org

No new Vorbis 1.2.0 so far ...

[john33]

Paging John33.

All libvorbis 1.1.2 based compiles now updated to 1.2.0.

[naylor83]

So, to the question everyone is asking but no one can (?) answer:

Is it better than aoTuV b5?

Edit: Now that I actually read the first post, it seems this release doesn't touch audio quality. Am I right?

This post has been edited by naylor83: Jul 27 2007, 16:19

[john33]

Yes!!

[Saoshyant]

FIY, the new release includes multiplex stream support. What does that mean? If you have a bunch of stuff inside Ogg, like Theora, or strange mixes, the Vorbis part will still play on a Vorbis-only player.

Xiph has been like that since Emmett left.

Who?

Interestingly enough, John33 was the purveyor of official Vorbis binaries.

John33 does the OggDropXPd program for Windows, so what are you talking about?

Edit: Nevermind. Just noticed that rarewares carries compiled binaries.

But no "official" announcement ?

We made an official announcement. I think I'm missing the joke.

This post has been edited by Saoshyant: Jul 27 2007, 18:50

[john33]

FIY, the new release includes multiplex stream support. What does that mean? If you have a bunch of stuff inside Ogg, like Theora, or strange mixes, the Vorbis part will still play on a Vorbis-only player.

Xiph has been like that since Emmett left.

Who?

Interestingly enough, John33 was the purveyor of official Vorbis binaries.

John33 does the OggDropXPd program for Windows, so what are you talking about?

But no "official" announcement ?

We made an official announcement. I think I'm missing the joke. Oh, nevermind.

Emmett Plant was the one-time CEO of Xiph.

At one time I also provided the 'official' win32 release compiles for Xiph, but that seems to have fallen by the wayside now.

This post has been edited by john33: Jul 27 2007, 18:50

[Saoshyant]

Emmett Plant was the one-time CEO of Xiph.

I see. I suppose he's left way before I joined last year.

At one time I also provided the 'official' win32 release compiles for Xiph, but that seems to have fallen by the wayside now.

I just noticed that you replied to the Speex thread regarding Windows binaries. Would you mind if we mirrored your MSVC8 compiles on //xiph.org/downloads?

I think it might tie in with FLAC 1.2.0, the sudden jump to 1.2.0 was (atleast for me) unexpected for FLAC and Ogg Vorbis, perhaps Josh can shed some light, is there a big picture somewhere?

no, just coincidence!

Strangely enough, Speex also reaching the 1.2.0 stage. I actually thought it was intentional.

[DOS386]

All libvorbis 1.1.2 based compiles now updated to 1.2.0.

Sure ?

EDITED: shot kicked since problem (partially) fixed, but © remained 2005 in OGGENC, OGGDEC not updated at all

Saoshyant wrote:

FIY, the new release includes multiplex stream support. What does that mean? If you have a bunch of stuff inside Ogg, like Theora, or strange mixes, the Vorbis part will still play on a Vorbis-only player.

Thanks.

We made an official announcement. I think I'm missing the joke.

NO. The announcement didn't exist at the time I complained about "no announcement". And it was very hidden and tiny when you posted about the "joke". I extended it a bit

The XIPH's pages (xiph.org, vorbis.com, theora.org, ... etc. ) do leave some space for improvement IMHO

This post has been edited by DOS386: Jul 29 2007, 04:04

[xmixahlx]

so speex, vorbis & flac all release 1.2.0 releases at the same time - and it wasn't planned?

[john33]

At one time I also provided the 'official' win32 release compiles for Xiph, but that seems to have fallen by the wayside now.

I just noticed that you replied to the Speex thread regarding Windows binaries. Would you mind if we mirrored your MSVC8 compiles on //xiph.org/downloads?

Feel free, go ahead.

All libvorbis 1.1.2 based compiles now updated to 1.2.0.

Sure ?

Yep, that's just a text string that I often forget to update!! I'll recompile and upload again shortly.

Edit: Just recompiled and uploaded again.

This post has been edited by john33: Jul 27 2007, 23:33

[Saoshyant]

Just one more thing: there's also a new change on Vorbis, which developers may be interested. MIME Type has changed to audio/ogg per the MIME Type and File Extensions proposal.

The Xiph's pages (xiph.org, vorbis.com, theora.org, ... etc. ) do leave some space for improvement IMHO

Indeed. We are looking for interested (and qualified) webmaster(s).

Feel free, go ahead.

Thanks.

This post has been edited by Saoshyant: Jul 27 2007, 23:54

[Zarggg]

Anyone care to explain the changes in plain English? I'm afraid my geek is weak today.

[DOS386]

Just one more thing: there's also a new change on Vorbis, which developers may be interested. MIME Type has changed to audio/ogg per the MIME Type and File Extensions proposal.

Just one more mystery: why are the binaries called OGGENC and OGGDEC, rather than VORBENC and VORBDEC ?

[yoshikaku]

When I used oggdropXPd V.1.8.9 using libVorbis v1.2.0(Generic) shown in RAREWARES, I vomit Dr.Watson log with the end of the encoding, and oggdropXPd crashes.

CODE

アプリケーション例外が発生しました:
アプリケーション: (pid=1244)
発生時間: 2007/07/28 @ 06:18:02.457
例外番号: c0000005 (アクセス違反)

*----> システム情報 <----*
コンピュータ名:
ユーザー名:
プロセッサの数: 1
プロセッサの種類: x86 Family 6 Model 8 Stepping 10
Windows 2000 Version: 5.0
現在のビルド: 2195
Service Pack: 4
現在のタイプ: Uniprocessor Free
登録されている会社名:
登録されている所有者:

*----> タスク リスト <----*
0 Idle.exe
8 System.exe
140 smss.exe
168 csrss.exe
212 winlogon.exe
240 services.exe
252 lsass.exe
432 svchost.exe
456 spoolsv.exe
484 ccProxy.exe
496 ccSetMgr.exe
516 svchost.exe
556 Matrox.PowerDesk.Services.exe
604 mgabg.exe
616 navapsvc.exe
632 NPROTECT.exe
696 regsvc.exe
720 MSTask.exe
744 SNDSrvc.exe
808 NOPDB.exe
884 WinMgmt.exe
904 svchost.exe
920 ccEvtMgr.exe
1316 Explorer.exe
1384 SymTray.exe
1484 ccApp.exe
1524 kxmixer.exe
1516 Internat.exe
1528 MsnMsgr.exe
1244 oggdropXPd.exe
1308 drwtsn32.exe
0 _Total.exe

(00400000 - 00583000)
(77F80000 - 77FFC000)
(77520000 - 77550000)
(77DE0000 - 77E3F000)
(77E50000 - 77F33000)
(77F40000 - 77F7C000)
(79480000 - 794E5000)
(78780000 - 787EF000)
(73CC0000 - 73F06000)
(70A70000 - 70AD6000)
(78000000 - 78045000)
(71710000 - 71794000)
(7CFB0000 - 7D09F000)
(75DF0000 - 75E0A000)
(10000000 - 10030000)
(7C000000 - 7C054000)
(6CC90000 - 6CC96000)
(5EC20000 - 5EE97000)
(777D0000 - 777D7000)
(75940000 - 75946000)
(5EAE0000 - 5EB4B000)
(5EA80000 - 5EAC2000)

スレッド ID 0x138 のステート ダンプ

eax=00000000 ebx=00000000 ecx=0012ffb0 edx=00000000 esi=0012fee0 edi=77de55c4
eip=77e285c7 esp=0012fe98 ebp=0012feb8 iopl=0 nv up ei pl zr na po nc
cs=001b ss=0023 ds=0023 es=0023 fs=0038 gs=0000 efl=00000246


ファンクション: GetMenuItemRect
77e285ae b899110000 mov eax,0x1199
77e285b3 8d542404 lea edx,[esp+0x4] ss:01289d7f=????????
77e285b7 cd2e int 2e
77e285b9 c21000 ret 0x10
77e285bc b89a110000 mov eax,0x119a
77e285c1 8d542404 lea edx,[esp+0x4] ss:01289d7f=????????
77e285c5 cd2e int 2e
77e285c7 c21000 ret 0x10

*----> スタック バック トレース <----*

FramePtr ReturnAd Param#1 Param#2 Param#3 Param#4 ファンクション名
0012FEB8 00415440 0012FEE0 00000000 00000000 00000000 user32!GetMenuItemRect
77DE5B6C AAE80824 C2FFFFE7 4C8B0004 7EE80424 85FFFFE7 !<nosymbols>
74FF016A 00000000 00000000 00000000 00000000 00000000 <nosymbols>

*----> ロウ スタック ダンプ <----*
0012fe98 8f 69 de 77 e0 fe 12 00 - 00 00 00 00 00 00 00 00 .i.w............
0012fea8 00 00 00 00 00 00 00 00 - 11 69 de 77 c4 55 de 77 .........i.w.U.w
0012feb8 6c 5b de 77 40 54 41 00 - e0 fe 12 00 00 00 00 00 l[.w@TA.........
0012fec8 00 00 00 00 00 00 00 00 - 93 08 00 00 02 00 00 00 ................
0012fed8 c0 ff 12 00 01 00 00 00 - ee 00 20 00 0f 00 00 00 .......... .....
0012fee8 00 00 00 00 00 00 00 00 - cf 2b 37 02 91 02 00 00 .........+7.....
0012fef8 f0 00 00 00 30 00 00 00 - 03 00 00 00 70 40 41 00 ....0.......p@A.
0012ff08 00 00 00 00 00 00 00 00 - 00 00 40 00 eb 03 c7 01 ..........@.....
0012ff18 11 00 01 00 10 00 90 01 - 00 00 00 00 10 84 47 00 ..............G.
0012ff28 75 03 1f 01 a2 93 43 00 - 00 00 c8 42 00 00 00 00 u.....C....B....
0012ff38 cd 30 13 00 00 00 fa 47 - 03 bf 35 c0 c3 30 d7 30 .0.....G..5..0.0
0012ff48 5c 00 6f 00 00 f0 fd 7f - 44 00 00 00 90 3e 13 00 \.o.....D....>..
0012ff58 00 3b 13 00 40 3d 13 00 - 00 00 00 00 00 00 00 00 .;..@=..........
0012ff68 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................
0012ff78 00 00 00 00 01 04 00 00 - 01 00 00 00 00 00 00 00 ................
0012ff88 00 00 00 00 01 00 01 00 - 00 00 00 00 bc ff 12 00 ................
0012ff98 00 00 00 00 05 00 00 00 - 00 00 00 00 c3 30 d7 30 .............0.0
0012ffa8 40 ff 12 00 4c 7f 0c c5 - e0 ff 12 00 80 b7 43 00 @...L.........C.
0012ffb8 fb 28 60 c0 01 00 00 00 - f0 ff 12 00 d5 89 e7 77 .(`............w
0012ffc8 c3 30 d7 30 5c 00 6f 00 - 00 f0 fd 7f 6f 00 70 00 .0.0\.o.....o.p.

スレッド ID 0x418 のステート ダンプ

eax=0003bfc0 ebx=00a80000 ecx=7ffdd000 edx=00a80608 esi=00f1f310 edi=00ee3350
eip=77fcd6ad esp=00f1e93c ebp=00f1e948 iopl=0 nv up ei ng nz na pe cy
cs=001b ss=0023 ds=0023 es=0023 fs=0038 gs=0000 efl=00000283


ファンクション: RtlZeroHeap
77fcd692 56 push esi
77fcd693 8b750c mov esi,[ebp+0xc] ss:0207882e=????????
77fcd696 8b5d08 mov ebx,[ebp+0x8] ss:0207882e=????????
77fcd699 57 push edi
77fcd69a 8bfe mov edi,esi
77fcd69c 0fb74602 movzx eax,word ptr [esi+0x2] ds:020791f7=????
77fcd6a0 c1e003 shl eax,0x3
77fcd6a3 2bf8 sub edi,eax
77fcd6a5 3bfe cmp edi,esi
77fcd6a7 0f84cb010000 je RtlZeroHeap+0x702 (77fcd878)
フォールト ->77fcd6ad f6470501 test byte ptr [edi+0x5],0x1 ds:0203d236=??
77fcd6b1 0f85c1010000 jne RtlZeroHeap+0x702 (77fcd878)
77fcd6b7 0fb707 movzx eax,word ptr [edi] ds:00ee3350=????
77fcd6ba 8b4d10 mov ecx,[ebp+0x10] ss:0207882e=????????
77fcd6bd 0301 add eax,[ecx] ds:7ffdd000=00f1e9e4
77fcd6bf 3d00fe0000 cmp eax,0xfe00
77fcd6c4 0f87ae010000 jnbe RtlZeroHeap+0x702 (77fcd878)
77fcd6ca 807d1400 cmp byte ptr [ebp+0x14],0x0 ss:0207882e=??
77fcd6ce 0f84b7000000 je RtlZeroHeap+0x615 (77fcd78b)
77fcd6d4 56 push esi
77fcd6d5 53 push ebx
77fcd6d6 e814fdfcff call RtlIsValidIndexHandle+0x182f (77f9d3ef)

*----> スタック バック トレース <----*

FramePtr ReturnAd Param#1 Param#2 Param#3 Param#4 ファンクション名
00F1E948 77FCB80C 00A80000 00F1F310 00F1E9C0 00000000 ntdll!RtlZeroHeap
00F1E9F4 00435420 00A80000 00000000 00F1F318 C0D6AAF7 ntdll!RtlFreeHeap
00F1EA34 0040C89C 00F1F318 77E5B5AF 77E7B969 00000000 !<nosymbols>
00F1FFA0 0040CF34 77FB7E64 00134340 00F1FFEC 00000000 !<nosymbols>
77E77D0D 56530C45 6AFF3357 5B40A801 C38A0474 C4F637EB !<nosymbols>
8BEC8B55 00000000 00000000 00000000 00000000 00000000 <nosymbols>

*----> ロウ スタック ダンプ <----*
00f1e93c 00 00 a8 00 10 f3 f1 00 - 18 f3 f1 00 f4 e9 f1 00 ................
00f1e94c 0c b8 fc 77 00 00 a8 00 - 10 f3 f1 00 c0 e9 f1 00 ...w............
00f1e95c 00 00 00 00 02 00 00 00 - 18 f3 f1 00 44 ac 00 00 ............D...
00f1e96c 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................
00f1e97c 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................
00f1e98c 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................
00f1e99c 00 00 00 00 00 00 00 00 - f8 01 a8 00 f8 01 a8 00 ................
00f1e9ac 02 00 00 00 01 00 00 00 - f8 01 a8 00 00 00 00 00 ................
00f1e9bc 00 00 a8 00 e0 7e 00 00 - 01 00 00 00 00 00 00 00 .....~..........
00f1e9cc 00 00 00 00 68 86 a8 00 - 01 00 00 00 00 00 00 00 ....h...........
00f1e9dc 60 e9 f1 00 88 e5 f1 00 - 24 ea f1 00 64 7e fb 77 `.......$...d~.w
00f1e9ec 78 16 f8 77 01 00 00 00 - 34 ea f1 00 20 54 43 00 x..w....4... TC.
00f1e9fc 00 00 a8 00 00 00 00 00 - 18 f3 f1 00 f7 aa d6 c0 ................
00f1ea0c 02 00 00 00 ec a7 59 00 - 44 ac 00 00 00 00 00 00 ......Y.D.......
00f1ea1c 08 ea f1 00 8c e5 f1 00 - dc ff f1 00 80 b7 43 00 ..............C.
00f1ea2c 3b 25 60 c0 fe ff ff ff - a0 ff f1 00 9c c8 40 00 ;%`...........@.
00f1ea3c 18 f3 f1 00 af b5 e5 77 - 69 b9 e7 77 00 00 00 00 .......wi..w....
00f1ea4c 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................
00f1ea5c 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................
00f1ea6c eb ec f1 00 00 00 00 00 - 09 f1 f1 00 00 00 00 00 ................

Mod edit: Codebox.

This post has been edited by JensRex: Jul 28 2007, 09:00

[Saoshyant]

Just one more mystery: why are the binaries called OGGENC and OGGDEC, rather than VORBENC and VORBDEC ?

It's one of those things that wasn't meant to be, but ended up like that because the future is never clear. It's now kept for backwards reasons, but with some luck may change in the future*. It's also why Vorbis's extension is still .ogg even though it should be either .oga or even .vorbis

*either the name or the function; if all goes well, oggenc will in theory be able to encode OggPCM soon. What is OggPCM, you ask? Think of it like a much better WAV for audio editors.