speex 1.2.1 speexdsp

[martyj19]

Upstream now at

https://gitlab.xiph.org/xiph/speex
https://gitlab.xiph.org/xiph/speex/-/releases

Needs an autoreconf.

[Bruce Dubbs]

It's interesting that this version of speex is not at ​https://downloads.xiph.org/releases/speex/.

The previous release was December 2016. This package has a weird file name: speex-Speex-1.2.1.tar.bz2

Release notes:

    Check for _WIN32 instead of WIN32 in preprocessor checks
    wav_io: check for EOF when seeking in wav (fixes hang discovered by fuzzing)
    CI: add gitlab CI integration
    fixed-point: make left shift macros use unsigned to avoid undefined behaviour
    math_approx: use unsigned int for LCG pseudorandom generator 
      (avoids integer overflow)
    oss-fuzz: add integration and fuzzing target
    speexenc: guard against invalid channel numbers
    speexdec: make left shift macros use unsigned to avoid undefined behaviour
    autotools: do not use deprecated macros

[martyj19]

Correct about the odd tarball names.

From xiph.org, "Development" and "speex"/"speexdsp" leads you to gitlab. From xiph.org "Downloads" and "speex" leads you to a broken link. ​https://github.com/xiph/speex has the announcement "Speex voice codec mirror - THIS IS A MIRROR, DEVELOPMENT HAPPENS AT ​https://gitlab.xiph.org/xiph/speex" The mailing list makes no announcement.

I should have also called out

https://gitlab.xiph.org/xiph/speexdsp/-/releases

Arch had the new release which is what led me to discover the apparent move.

[Xi Ruoyao]

I've raised ​https://gitlab.xiph.org/xiph/speex/-/issues/2040 and the maintainer says they "will announce on speex.org and the speex-devel mailing list when the release is officially out (and tarballs are up)".

[Bruce Dubbs]

I'm not sure if we should update this now or not. The 1.2.1 tarballs for both speex and speexdsp are available at ​https://downloads.xiph.org/releases/speex/, but the web site still says 1.2.0 and I can't find the mailing lit archives.

[Xi Ruoyao]

Release announced at ​https://www.speex.org/downloads/. Release note is also available here.

[Douglas R. Reno]

Contains fixes for CVE-2020-23903 and CVE-2020-23904

[Douglas R. Reno]

Fixed at 193a4fff698aec6b7673c24099ca7d0ebd29c189

Security Advisories to come later (once I have completed the others)