src/Makefile.am | 2 1 + 1 - 0 !
1 file changed, 1 insertion(+), 1 deletion(-)

 fix build

ChangeLog | 2 1 + 1 - 0 !
libsox.3 | 2 1 + 1 - 0 !
libsox.txt | 2 1 + 1 - 0 !
src/fap.c | 2 1 + 1 - 0 !
src/paf.c | 2 1 + 1 - 0 !
src/wav.c | 2 1 + 1 - 0 !
6 files changed, 6 insertions(+), 6 deletions(-)

 spelling fixes

src/flac.c | 8 5 + 3 - 0 !
1 file changed, 5 insertions(+), 3 deletions(-)

 [patch] flac: fix crash on corrupt metadata (cve-2017-15371)

src/hcom.c | 5 5 + 0 - 0 !
1 file changed, 5 insertions(+)

 [patch] hcom: fix crash on input with corrupt dictionary
 (CVE-2017-11358)

src/wav.c | 2 1 + 1 - 0 !
1 file changed, 1 insertion(+), 1 deletion(-)

 [patch] wav: ima_adpcm: fix buffer overflow on corrupt input
 (CVE-2017-15370)

Add the same check bad block size as was done for MS adpcm in commit
f39c574b ("More checks for invalid MS ADPCM blocks").

src/wav.c | 5 5 + 0 - 0 !
1 file changed, 5 insertions(+)

 [patch] wav: fix crash if channel count is zero (cve-2017-11332)

src/wav.c | 6 6 + 0 - 0 !
1 file changed, 6 insertions(+)

 [patch] wav: fix crash writing header when channel count >64k
 (CVE-2017-11359)

src/wavpack.c | 8 8 + 0 - 0 !
1 file changed, 8 insertions(+)

 wavpack: check errors when initializing
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=881145

sox.1 | 2 1 + 1 - 0 !
1 file changed, 1 insertion(+), 1 deletion(-)

 fix - w: sox: manpage-has-errors-from-man usr/share/man/man1/sox.1.gz  file `<standard input>'

src/xa.c | 6 6 + 0 - 0 !
1 file changed, 6 insertions(+)

 a corrupt header specifying zero channels would send read_channels()
into an infinite loop.  Prevent this by sanity checking the channel
count in open_read().  Also add an upper bound to prevent overflow
in multiplication.
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=881121

src/adpcm.c | 8 7 + 1 - 0 !
src/adpcm.h | 3 3 + 0 - 0 !
src/wav.c | 5 4 + 1 - 0 !
3 files changed, 14 insertions(+), 2 deletions(-)

 adpcm: fix stack overflow with >4 channels (cve-2017-15372)

src/aiff.c | 2 1 + 1 - 0 !
1 file changed, 1 insertion(+), 1 deletion(-)

 this fixes a use after free and double free if an empty comment
chunk follows a non-empty one.

src/vorbis.c | 8 6 + 2 - 0 !
1 file changed, 6 insertions(+), 2 deletions(-)

 [patch] handle vorbis_analysis_headerout errors

This is related to

    https://github.com/xiph/vorbis/pull/34

but could also happen today with on other errors in the called function.
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=882236

src/effects_i_dsp.c | 2 1 + 1 - 0 !
1 file changed, 1 insertion(+), 1 deletion(-)

---

src/Makefile.am | 2 1 + 1 - 0 !
src/xmalloc.c | 10 10 + 0 - 0 !
src/xmalloc.h | 6 4 + 2 - 0 !
3 files changed, 15 insertions(+), 3 deletions(-)

---

src/fft4g.c | 18 18 + 0 - 0 !
src/fft4g.h | 2 2 + 0 - 0 !
2 files changed, 20 insertions(+)

---

src/effects_i_dsp.c | 3 3 + 0 - 0 !
1 file changed, 3 insertions(+)

---