* Fri Aug 15 2008 Rex Dieter <rdieter@fedoraproject.org> - 1.1.15-1

- xine-lib-1.1.15, plugin ABI 1.24 (rh#455752, CVE-2008-3231)
- Obsoletes: -arts (f9+)
- move -pulseaudio into main pkg

.cvsignore

@@ -1,2 +1,2 @@
-xine-lib-1.1.12-pruned.tar.bz2
+xine-lib-1.1.15-autotools.patch.bz2
-xine-lib-1.1.12-autotools.patch.bz2
+xine-lib-1.1.15-pruned.tar.bz2

sources

@@ -1,2 +1,2 @@
-3f918af93f52e486fb8fd4dfec04f98f  xine-lib-1.1.12-pruned.tar.bz2
+ffd74ec893a5f1167c69987a68f436fd  xine-lib-1.1.15-autotools.patch.bz2
-771565628e4dfcfc8657b1256b9f41ef  xine-lib-1.1.12-autotools.patch.bz2
+acdbdc024382afac111eb076304448ed  xine-lib-1.1.15-pruned.tar.bz2

xine-lib-1.1.12-CVE-2008-1878.patch

@@ -1,16 +0,0 @@
-diff -up xine-lib-1.1.12/src/demuxers/demux_nsf.c.CVE-2008-1878 xine-lib-1.1.12/src/demuxers/demux_nsf.c
---- xine-lib-1.1.12/src/demuxers/demux_nsf.c.CVE-2008-1878	2008-03-28 09:24:50.000000000 -0500
-+++ xine-lib-1.1.12/src/demuxers/demux_nsf.c	2008-04-24 06:52:45.000000000 -0500
-@@ -106,9 +106,9 @@ static int open_nsf_file(demux_nsf_t *th
- 
-   this->total_songs = header[6];
-   this->current_song = header[7];
--  this->title = strdup(&header[0x0E]);
--  this->artist = strdup(&header[0x2E]);
--  this->copyright = strdup(&header[0x4E]);
-+  this->title = strndup((char*)&header[0x0E], 0x20);
-+  this->artist = strndup((char*)&header[0x2E], 0x20);
-+  this->copyright = strndup((char*)&header[0x4E], 0x20); 
- 
-   this->filesize = this->input->get_length(this->input);
- 

xine-lib.spec

@@ -2,13 +2,10 @@
 # - libstk:  http://www.libstk.net/ - probably not, see 1.1.5 ChangeLog
 # - drop the opengl video out plugin?
 #   http://www.redhat.com/archives/fedora-legal-list/2007-August/msg00011.html
-# - move -pulseaudio to main package?
-#   http://fedoraproject.org/wiki/Releases/FeaturePulseaudio
-#   --> not yet:
-#    http://www.redhat.com/archives/fedora-devel-list/2007-August/msg01411.html
 # - external dvdnav - not compatible as of 1.1.11 and 4.1.1
+# - deprecate ESD support?
 
-%define         abiver      1.21
+%define         abiver      1.24
 %define         codecdir    %{_libdir}/codecs
 
 %ifarch %{ix86}
@@ -29,10 +26,14 @@
     %define     with_xcb    %{?_with_xcb:1}%{!?_with_xcb:0}
 %endif # Fedora
 
+%if 0%{?fedora} > 8
+%define _without_arts --without-arts
+%endif
+
 Summary:        Xine library
 Name:           xine-lib
-Version:        1.1.12
+Version:        1.1.15
-Release:        3%{?dist}
+Release:        1%{?dist}
 License:        GPLv2+
 Group:          System Environment/Libraries
 URL:            http://xinehq.de/
@@ -46,7 +47,6 @@ Source2:        %{name}-mk-autotools-patch.sh
 Patch0:         %{name}-%{version}-autotools.patch.bz2
 Patch1:         %{name}-1.1.4-optflags.patch
 Patch6:         %{name}-1.1.1-deepbind-939.patch
-Patch7:         %{name}-1.1.12-CVE-2008-1878.patch
 BuildRoot:      %{_tmppath}/%{name}-%{version}-%{release}-root-%(%{__id_u} -n)
 
 Provides:       xine-lib(plugin-abi) = %{abiver}
@@ -85,12 +85,18 @@ BuildRequires:  flac-devel
 BuildRequires:  libmodplug-devel
 BuildRequires:  esound-devel
 BuildRequires:  speex-devel
+%if 0%{?_without_arts:1}
+Obsoletes: %{name}-arts < %{version}-%{release}
+%else
 BuildRequires: arts-devel
+%endif
 BuildRequires:  alsa-lib-devel >= 0.9.0
 BuildRequires:  libmpcdec-devel
 BuildRequires:  wavpack-devel
 %if %{with_pa}
 BuildRequires:  pulseaudio-lib-devel
+Obsoletes: %{name}-pulseaudio < %{version}-%{release}
+Provides:  %{name}-pulseaudio = %{version}-%{release}
 %endif # pa
 BuildRequires:  jack-audio-connection-kit-devel
 # CDs
@@ -99,7 +105,11 @@ BuildRequires:  libcdio-devel
 BuildRequires:  pkgconfig
 BuildRequires:  gnome-vfs2-devel
 BuildRequires:  gtk2-devel
+%if 0%{?fedora} > 6 || 0%{?rhel} > 5
 BuildRequires:  libsmbclient-devel
+%else
+BuildRequires:  samba-common
+%endif
 
 %description
 This package contains the Xine library. Xine is a free multimedia player.
@@ -120,31 +130,22 @@ Requires:       zlib-devel
 %description    devel
 This package contains development files for xine-lib.
 
-# TODO: consider removing and/or marking as deprecated for F9+ -- Rex
 %package        arts
 Summary:        aRts plugin for xine-lib
 Group:          System Environment/Libraries
 Requires:       %{name} = %{version}-%{release}
+#Requires:      xine-lib(plugin-abi) = %{abiver}
 # -arts was split off the -extras subpackage at 1.1.7-3
 Obsoletes:      xine-lib-extras < 1.1.7-3
 
 %description    arts
 This package contains the aRts extra plugin for xine-lib.
 
-%package        pulseaudio
-Summary:        Pulseaudio plugin for xine-lib
-Group:          System Environment/Libraries
-Requires:       %{name} = %{version}-%{release}
-# -pulseaudio was split off -extras at 1.1.11.1-2
-#Obsoletes:     xine-lib-extras < 1.1.11.1-2
-
-%description    pulseaudio
-This package contains the pulseaudio plugin for xine-lib.
-
 %package        extras
 Summary:        Additional plugins for xine-lib
 Group:          System Environment/Libraries
 Requires:       %{name} = %{version}-%{release}
+#Requires:      xine-lib(plugin-abi) = %{abiver}
 
 %description    extras
 This package contains extra plugins for xine-lib:
@@ -177,7 +178,6 @@ touch -r m4/optimizations.m4 m4/optimizations.m4.stamp
 touch -r m4/optimizations.m4.stamp m4/optimizations.m4
 # Patch6 needed at least when compiling with external ffmpeg, #939.
 %patch6 -p1 -b .deepbind
-%patch7 -p1 -b .CVE-2008-1878
 
 # Avoid standard rpaths on lib64 archs:
 sed -i -e 's|"/lib /usr/lib\b|"/%{_lib} %{_libdir}|' configure
@@ -213,7 +213,7 @@ export SDL_CFLAGS="$(sdl-config --cflags)" SDL_LIBS="$(sdl-config --libs)"
 %if 0%{?_without_imagemagick:1}
     --without-imagemagick \
 %endif # imagemagick
-    --with-arts \
+    %{!?_without_arts:--with-arts} %{?_without_arts} \
     --with-wavpack \
     --with-real-codecs-path=%{codecdir} \
     --with-w32-path=%{codecdir}
@@ -286,6 +286,9 @@ rm -rf $RPM_BUILD_ROOT
 %{_libdir}/xine/plugins/%{abiver}/xineplug_ao_out_file.so
 %{_libdir}/xine/plugins/%{abiver}/xineplug_ao_out_none.so
 %{_libdir}/xine/plugins/%{abiver}/xineplug_ao_out_oss.so
+%if %{with_pa}
+%{_libdir}/xine/plugins/%{abiver}/xineplug_ao_out_pulseaudio.so
+%endif
 %{_libdir}/xine/plugins/%{abiver}/xineplug_decode_bitplane.so
 %{_libdir}/xine/plugins/%{abiver}/xineplug_decode_gsm610.so
 %{_libdir}/xine/plugins/%{abiver}/xineplug_decode_lpcm.so
@@ -355,14 +358,10 @@ rm -rf $RPM_BUILD_ROOT
 %{_libdir}/xine/plugins/%{abiver}/xineplug_vo_out_xxmc.so
 %{_libdir}/xine/plugins/%{abiver}/xineplug_wavpack.so
 
+%if 0%{!?_without_arts:1}
 %files arts
 %defattr(-,root,root,-)
 %{_libdir}/xine/plugins/%{abiver}/xineplug_ao_out_arts.so
-
-%if %{with_pa}
-%files pulseaudio
-%defattr(-,root,root,-)
-%{_libdir}/xine/plugins/%{abiver}/xineplug_ao_out_pulseaudio.so
 %endif
 
 %files extras
@@ -402,6 +401,11 @@ rm -rf $RPM_BUILD_ROOT
 
 
 %changelog
+* Fri Aug 15 2008 Rex Dieter <rdieter@fedoraproject.org> - 1.1.15-1
+- xine-lib-1.1.15, plugin ABI 1.24 (rh#455752, CVE-2008-3231)
+- Obsoletes: -arts (f9+)
+- move -pulseaudio into main pkg
+
 * Sun Apr 27 2008 Kevin Kofler <Kevin@tigcc.ticalc.org> - 1.1.12-3
 - rebuild for new ImageMagick (6.4.0.10)