[vorbis-dev] Ports

[Kenneth C. Arnold]

According to Michael Smith (sometime around Wed, Dec 27, 2000 at 01:39:16PM +1100):
> >A few notes about the patch:
> >- in ao_wav.c the "#include <sys/types.h>" is to define off_t.
> >- I've added support for an optional AO_PLUGIN_PATH environment variable
> >allowing the plugin directory to be specified at runtime, making
> >distribution of binaries practical. I'm not sure if this is a good idea for
> >unix (setuid hole perhaps?).
> >- I've switched to using gcc instead of Watcom C as its more widely
> >available & free. It's also the only OS/2 compiler that supports fdopen()
> >on a socket, necessary for streaming.
> 
> Sounds good. Though it's probably a setuid hole, that's not an issue. I can
> guarantee that there would be a LOT more holes there than just that.
> libogg, libvorbis, libao, and ogg123 have all not been audited, and are not
> intended to be run setuid. 

ogg123 is _starting_ to get a few cleanups, but it's still wide open
until proven otherwise. It would be interesting to see some shellcode
for ogg123 though :) There have been reports that certain Vorbis files
cause players to segfault, so there is something in libogg /
libvorbis, but I wouldn't know if it's exploitable.

> Is using gcc a problem? (i.e. would you prefer to use watcom?) ogg123 is
> being largely rewritten at the moment, I suspect it'd be possible to not
> have it do fdopen() at all (it's a bit of a messy way to do socket stuff).

It's a very messy way to do socket stuff, and only there to deal with
a library that used FILE*. It could have been a lot neater if I had
instead used callbacks to begin with, but the whole mess is getting a
big rewrite very soon. I'm currently busy with buffering; since we're
on the OS/2 topic, how would one go about doing a buffer for OS/2? My
current approach is a fixed shared memory segment and two processes
(could be threads on a platform that supports it).


-- 
Kenneth Arnold <ken at arnoldnet.net> / kcarnold / Linux user #180115
http://arnoldnet.net/~kcarnold/



<HR NOSHADE>
<UL>
<LI>application/pgp-signature attachment: stored
</UL>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: part
Type: application/octet-stream
Size: 233 bytes
Desc: not available
Url : http://lists.xiph.org/pipermail/vorbis-dev/attachments/20001227/56357260/part.obj