Makefile.in | 2 1 + 1 - 0 !
configure | 3 1 + 2 - 0 !
configure.ac | 1 0 + 1 - 0 !
3 files changed, 2 insertions(+), 4 deletions(-)

 debian directory does not have makefile.{am,in}.

oggdec/oggdec.c | 2 1 + 1 - 0 !
1 file changed, 1 insertion(+), 1 deletion(-)

 don't corrupt stdout

Bug-Debian: https://bugs.debian.org/595104

oggenc/oggenc.c | 6 3 + 3 - 0 !
1 file changed, 3 insertions(+), 3 deletions(-)

 floating point comparison fails.

ogg123/status.c | 2 1 + 1 - 0 !
1 file changed, 1 insertion(+), 1 deletion(-)

 fix format error blocking compilation with hardening

vorbiscomment/vorbiscomment.1 | 2 1 + 1 - 0 !
1 file changed, 1 insertion(+), 1 deletion(-)

 fix url in manpage

oggenc/oggenc.c | 9 9 + 0 - 0 !
1 file changed, 9 insertions(+)

 add sampling rate sanity check to avoid crash.

Bug-Debian: https://bugs.debian.org/716613

ogg123/buffer.c | 26 23 + 3 - 0 !
1 file changed, 23 insertions(+), 3 deletions(-)

 fix ogg123 freeze when interrupting at end-of-stream.

Bug-Debian: https://bugs.debian.org/307325

ogg123/cmdline_options.c | 2 1 + 1 - 0 !
ogg123/ogg123.1 | 3 2 + 1 - 0 !
2 files changed, 3 insertions(+), 2 deletions(-)

 make it clear in documentation that -f needs a previous -d.

Bug-Debian: https://bugs.debian.org/359948

oggenc/oggenc.c | 4 2 + 2 - 0 !
1 file changed, 2 insertions(+), 2 deletions(-)

 fix oggenc crash on closing raw input files

ogg123/status.c | 23 23 + 0 - 0 !
1 file changed, 23 insertions(+)

 truncate long status lines on small terminals

If the status line is longer than the number of columns of the terminal
that stderr prints to, line-wrapping occurs and the mechanisms to
overwrite the current line don't work any longer, thus filling the
terminal with status lines. This can be avoided by checking the
available size and truncating the line, if necessary. The truncation
is indicated to the user via suspension points.

Bug-Debian: https://bugs.debian.org/239073

ogg123/speex_format.c | 8 5 + 3 - 0 !
1 file changed, 5 insertions(+), 3 deletions(-)

 fix ogg123 speex stereo: initialize stereo info data structure

The ogg123 executable wasn't able to correctly play stereo speex
files that don't contain any inband intensity stereo signals at
all or whose first inband intensity stereo signal arrives after
the stream has already started. This was due to the stereo
information data structure not being initialized properly before
the first inband intensity stereo signal arrived. So in the
mentioned cases the speex decoder used uninitialized float
values for the stereo decoding. This patch fixes the problem by
using the proper initialization and deallocation functions from
libspeex.

Bug-Debian: https://bugs.debian.org/312185

ogg123/speex_format.c | 14 13 + 1 - 0 !
1 file changed, 13 insertions(+), 1 deletion(-)

 fix ogg123 speex playback: initialize channel matrix

The speex decoder didn't initialize the channel matrix,
which caused libao to print the cryptic error message
'" in channel matrix ""' and occasionally (depending on
the output device) to abort audio output.

Bug-Debian: https://bugs.debian.org/772766

oggdec/oggdec.c | 15 11 + 4 - 0 !
1 file changed, 11 insertions(+), 4 deletions(-)

 fix oggdec crash/hang: don't ignore stream errors

oggdec treats all negative return values coming from ov_read
as OV_HOLE errors and therefore as recoverable. So even in the
case of fatal errors it keeps on calling ov_read, which may
either crash (libvorbis' data structures may be uninitialized)
or simply not progress and therefore trap oggdec in an
infinite loop.

Fix this by distinguishing between recoverable and
non-recoverable errors. In the case of fatal errors, exit
gracefully with an error message. The error string is
"borrowed" from ogg123 and therefore already translated into
several languages.

Bug-Debian: https://bugs.debian.org/772978
Bug-Ubuntu: https://bugs.launchpad.net/ubuntu/+source/vorbis-tools/+bug/629135

oggdec/oggdec.c | 5 5 + 0 - 0 !
1 file changed, 5 insertions(+)

 use translations in oggdec

The "oggdec" executable uses the "_" (underscore) macro for
internationalization and has translations of the relevant strings
available in the .po files, but nevertheless outputs everything
in English. This was due to a lack of initialization of the
internationalization modules in that executable.

Bug-Debian: https://bugs.debian.org/772976

oggenc/audio.c | 10 5 + 5 - 0 !
1 file changed, 5 insertions(+), 5 deletions(-)

 oggenc: fix large alloca on bad aiff input (cve-2015-6749).

oggenc/audio.c | 18 16 + 2 - 0 !
1 file changed, 16 insertions(+), 2 deletions(-)

 oggenc: validate count of channels in the header (cve-2014-9638 &
 CVE-2014-9639)

oggdec/oggdec.c | 27 16 + 11 - 0 !
1 file changed, 16 insertions(+), 11 deletions(-)

 oggdec: write to stdout instead of "-.wav" when reading from stdin
 and not output file name is given.

In bug #263762 it was reported that the behavior of oggdec was inconsistent
with its documentation: According to the man page, "oggdec" should write to
stdout, when reading its input from stdin and no output file name is given.
The "oggdec" executable writes to "-.wav" instead.

I adjusted the behavior of "oggdec" instead of adjusting the documentation
because it seems more sensible to write to stdout than to write to a file
called "-.wav". The code changes themselves are simple enough to be
self-explanatory.

Bug-Debian: https://bugs.debian.org/263762

ogg123/ogg123.1 | 2 1 + 1 - 0 !
1 file changed, 1 insertion(+), 1 deletion(-)

 ogg123: mention flac capabilities in man page.

Bug-Debian: https://bugs.debian.org/572491
Bug: https://trac.xiph.org/ticket/1681

po/fr.po | 1914 820 + 1094 - 0 !
1 file changed, 820 insertions(+), 1094 deletions(-)

 updated french translation

vcut/vcut.c | 2 1 + 1 - 0 !
1 file changed, 1 insertion(+), 1 deletion(-)

 vcut: fix segmentation fault because of out-of-range index in header
 writing

Bug-Debian: https://bugs.debian.org/818037
Bug: https://trac.xiph.org/ticket/2264