My plan for libvorbis towards Jessie

[Ralph Giles]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

On 2014-10-24 6:28 AM, Petter Reinholdtsen wrote:

> It was in the "Migrate to git - quickly?" thread, but it do not
> matter.

You just said the same thing there:

> I had a look at the code changes, and found type changes in a
> header file (long -> char), which I suspect change the ABI and API
> of the library.

But you didn't say what symbol the type change occured on. Could you
have been mistaken? I've just diff'd include/vorbis/*.h between the
libvorbis_1.3.2-2 source package and a checkout of upstream trunk and
there are no differences at all.

Perhaps you saw the codebook change? That's internal to the library.
https://git.xiph.org/?p=mirrors/vorbis.git;a=commitdiff;h=7874c923e2c3548aedf24ab07d2695e7d344bdf1

> Is there some way to rule out ABI changes in the new version?

I linked earlier to
http://upstream-tracker.org/versions/libvorbis.html which is a site
that tracks ABI changes. It shows no differences since 1.3.2, and
there only the const-ification of the strings passed to the vorbisfile
entry points, which is safe.

> Which security fixes are currently missing in unstable?

I don't remember in detail. I think the last major one was
https://git.xiph.org/?p=mirrors/vorbis.git;a=commit;h=47156649a659381d5b90b82241bf43b32ff3cd98

I see a patch for floor1 overflow, but not floor0.

The codebook change was for memory footprint, I think.

 -r

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQEcBAEBCAAGBQJUSoeiAAoJEEcAD3uxRB3vhK8H/j/RQmHrGiNUI9vHplqxzTch
5OPyzrlQlebE4bUAjLyNHbSl7dE4L9dBYch7JZ2mFqNWPIljUMiAAWJXqczFxQQt
Zm7H1lk8+ooRAby56ur3vDXnEgSMBdeJD5IzeQZd8G2hVBIySpevtF4IPkDdAaq9
iLhmSuPWWcA8bdhaEsFstq0lYu2BzdwICZEBhiGQhnKIsQ66nD+24YVQ4Wa5qbzu
i1K/wvzeCXN2fZ802k6yYMT89RZgyIf0eVBu5XKF2dGHhuJy71rTA/8hQ6wfeosb
N1x1ONjFGtasBeHTTSGWmK40roYNFn2M4PEPoSgZJ3xRZCKfhtHgC8SO9apthNc=
=D+fP
-----END PGP SIGNATURE-----