src/murmur/Messages.cpp | 4 3 + 1 - 0 !
1 file changed, 3 insertions(+), 1 deletion(-)

---

scripts/murmur.init | 1 1 + 0 - 0 !
1 file changed, 1 insertion(+)

---

main.pro | 3 2 + 1 - 0 !
1 file changed, 2 insertions(+), 1 deletion(-)

---

src/mumble/Audio.cpp | 6 6 + 0 - 0 !
src/mumble/Audio.h | 5 5 + 0 - 0 !
src/mumble/AudioInput.cpp | 20 18 + 2 - 0 !
src/mumble/AudioInput.h | 2 2 + 0 - 0 !
src/mumble/AudioOutputSpeech.cpp | 17 14 + 3 - 0 !
src/mumble/AudioOutputSpeech.h | 8 8 + 0 - 0 !
src/mumble/Global.h | 4 4 + 0 - 0 !
src/mumble/MainWindow.cpp | 4 4 + 0 - 0 !
src/mumble/Messages.cpp | 2 2 + 0 - 0 !
src/mumble/ServerHandler.cpp | 6 6 + 0 - 0 !
src/mumble/UserInformation.cpp | 2 2 + 0 - 0 !
src/mumble/mumble_pch.hpp | 4 4 + 0 - 0 !
12 files changed, 75 insertions(+), 5 deletions(-)

---

src/mumble/AudioOutputSpeech.cpp | 6 2 + 4 - 0 !
1 file changed, 2 insertions(+), 4 deletions(-)

---

scripts/murmur.ini | 4 4 + 0 - 0 !
scripts/murmur.ini.system | 4 4 + 0 - 0 !
src/murmur/Messages.cpp | 4 3 + 1 - 0 !
src/murmur/Meta.cpp | 5 5 + 0 - 0 !
src/murmur/Meta.h | 1 1 + 0 - 0 !
src/murmur/Server.cpp | 20 13 + 7 - 0 !
src/murmur/Server.h | 1 1 + 0 - 0 !
7 files changed, 31 insertions(+), 8 deletions(-)

---

src/murmur/Messages.cpp | 7 7 + 0 - 0 !
src/murmur/Server.cpp | 4 4 + 0 - 0 !
2 files changed, 11 insertions(+)

---

overlay_gl/overlay_gl.pro | 2 1 + 1 - 0 !
1 file changed, 1 insertion(+), 1 deletion(-)

 libmumble needs to be linked against libgl

src/mumble/AudioOutputSpeech.cpp | 7 7 + 0 - 0 !
1 file changed, 7 insertions(+)

 fix denial-of-service vulnerability
 CVE-2014-0044: A malformed Opus voice packet sent to a Mumble client
 could trigger a NULL pointer dereference or an out-of-bounds array
 access, leading to a crash (Denial of Service).

src/mumble/AudioOutputSpeech.cpp | 8 8 + 0 - 0 !
1 file changed, 8 insertions(+)

 fix heap-based buffer overflow vulnerability
 CVE-2014-0045: A malformed Opus voice packet sent to a Mumble client
 could trigger a heap-based buffer overflow. This causes a client crash
 (Denial of Service) and can potentially be used to execute arbitrary
 code.

src/mumble/Log.cpp | 153 106 + 47 - 0 !
src/mumble/Log.h | 22 8 + 14 - 0 !
src/mumble/MainWindow.cpp | 15 13 + 2 - 0 !
src/mumble/Overlay.cpp | 23 15 + 8 - 0 !
src/mumble/RichTextEditor.cpp | 19 19 + 0 - 0 !
src/mumble/RichTextEditor.h | 9 9 + 0 - 0 !
src/mumble/ServerHandler.cpp | 13 11 + 2 - 0 !
7 files changed, 181 insertions(+), 73 deletions(-)

---

src/mumble/ALSAAudio.cpp | 4 2 + 2 - 0 !
src/mumble/ASIOInput.cpp | 4 2 + 2 - 0 !
src/mumble/ASIOInput.ui | 6 6 + 0 - 0 !
src/mumble/AudioConfigDialog.cpp | 4 2 + 2 - 0 !
src/mumble/AudioOutputSample.cpp | 2 1 + 1 - 0 !
src/mumble/Cert.cpp | 7 5 + 2 - 0 !
src/mumble/ConnectDialog.cpp | 12 6 + 6 - 0 !
src/mumble/Database.cpp | 2 1 + 1 - 0 !
src/mumble/LCD.cpp | 2 1 + 1 - 0 !
src/mumble/Log.cpp | 11 6 + 5 - 0 !
src/mumble/MainWindow.cpp | 32 16 + 16 - 0 !
src/mumble/Messages.cpp | 12 6 + 6 - 0 !
src/mumble/Overlay.cpp | 2 1 + 1 - 0 !
src/mumble/Plugins.cpp | 12 6 + 6 - 0 !
src/mumble/VersionCheck.cpp | 2 1 + 1 - 0 !
15 files changed, 62 insertions(+), 52 deletions(-)

---

src/murmur/Server.cpp | 9 6 + 3 - 0 !
1 file changed, 6 insertions(+), 3 deletions(-)

 if the source address of outgoing packets is not detected
 correctly, users connected to a mumble server cannot hear anyone speak until
 first activating and speaking through their mic.

src/bonjour/BonjourServiceResolver.cpp | 2 1 + 1 - 0 !
1 file changed, 1 insertion(+), 1 deletion(-)

 fix avahi libdns_sd deadlock in bounjour code

    bonjour: use Qt::AutoConnection for BonjourServiceResolver's QSocketNotifier slot.
    
    Using a QueuedConnection for the slot had the unpleasant
    side effect that the QSocketNotifier could have its activated()
    slot invoked even though no data was waiting to be read.
    
    In our case, this could cause a deadlock inside Avahi's
    libdns_sd compatibility library.
    
    I've settled on using Qt::AutoConnection to be consitent
    with the rest of the code base. The Bonjour code should
    always be invoked from the main thread, so in this case
    Qt::AutoConnection will always mean Qt::DirectConnection.
    
    Why does this happen?  Qt seems to process events before
    invoking queued slot invocations.  If the Qt event loop
    finds that the file descriptor that our QSocketNotifier
    is providing notification for is ready for reading, it
    queues up an invocation of the activated() slot for the
    next event loop iteration (because we use a QueuedConnection).
    
    As mentioned above, because Qt seems to poll() FDs before
    invoking queued-up slots, the end result is that an
    invocation of the activated() slot for a given
    QSocketNotifier's file descriptor can be queued up in
    the very same event loop iteration that a read() is
    performed for the exact same file descriptor.
    
    After performing the read(), the queued-up activated()
    slot invocation is no longer valid, and can wreak havoc,
    which in our case causes a deadlock in the Avahi libdns_sd
    code.
    
    The flow below describes the event loop iterations
    in more detail:
    
    1st event loop iteration