mp3splt 2.6.2+20170630-2 source package in Debian

Changelog

mp3splt (2.6.2+20170630-2) unstable; urgency=medium

  * Properly zero the ogg and vorbis state structures after they are malloc'd.
    This fixes the second issue that was indicated in CVE-2017-11333, which
    isn't actually the fault of libvorbis.  It's caused by the libmp3splt ogg
    plugin unwinding when the error in the test file is detected, and calling
    vorbis_block_clear() on an uninitialised vorbis_block struct before the
    call to vorbis_block_init() occurs.  Similar things would go badly for the
    other uninitialised structs if this one didn't explode first.

 -- Ron Lee <email address hidden>  Wed, 27 Sep 2017 03:21:24 +0930