!25 [sync] PR-24: fix CVE-2024-10573

From: @openeuler-sync-bot 
Reviewed-by: @dou33 
Signed-off-by: @dou33

mpg123.spec

@@ -1,37 +1,72 @@
-Name:           mpg123
-Version:        1.25.10
-Release:        2
-Summary:        Real time MPEG 1.0/2.0/2.5 audio player/decoder for layers 1, 2 and 3
+%global enable_jack 1
+%global enable_portaudio 1
+%global _description \
+Real time MPEG 1.0/2.0/2.5 audio player/decoder for layers 1, 2 and 3 (most \
+commonly MPEG 1.0 layer 3 aka MP3), as well as re-usable decoding and output \
+libraries.
 
-License:        LGPLv2+
+Name:           mpg123
+Version:        1.29.3
+Release:        4
+Summary:        Real time MPEG 1.0/2.0/2.5 audio player/decoder for layers 1, 2 and 3
+License:        LGPL-2.1-or-later and GPL-2.0-or-later
 URL:            http://mpg123.org
 Source0:        http://mpg123.org/download/%{name}-%{version}.tar.bz2
+BuildRequires:  autoconf automake gcc libtool make pkgconfig(alsa)
+Requires:       %{name}-libs = %{version}-%{release}
 
-BuildRequires:      gcc make alsa-lib-devel
+Patch0001: 0001-libmpg123-separate-header-data-into-a-struct.patch
 
-Provides:           %{name}-libs = %{version}-%{release}
-Provides:           lib%{name} = %{version}-%{release}
-Obsoletes:          %{name}-libs < 1.25.10-2
-Obsoletes:          lib%{name} < 1.23.4-1
-
-
-%description
-Real time MPEG 1.0/2.0/2.5 audio player/decoder for layers 1, 2 and 3 (most
-commonly MPEG 1.0 layer 3 aka MP3), as well as re-usable decoding and output
-libraries.
+%description %{_description}
 
 %package plugins-pulseaudio  
 Summary:        Pulseaudio output plug-in for mpg123
 BuildRequires:  pulseaudio-libs-devel
+BuildRequires: 	pkgconfig(libpulse-simple)
 Requires:       %{name} = %{version}-%{release}
+Supplements: 	(mpg123 and pulseaudio)
 
 %description plugins-pulseaudio
 Pulseaudio output plug-in for mpg123.
 	
+%if 0%{?enable_jack}
+%package plugins-jack
+Summary:       JACK output plug-in for %{name}
+BuildRequires: pkgconfig(jack)
+Requires:      %{name} = %{version}-%{release}
+Supplements:   (mpg123 and jack-audio-connection-kit)
+Obsoletes:     %{name}-plugins-extras < 1.23.4-1
+ 
+%description plugins-jack %{_description} 
+JACK output plug-in.
+%endif
+ 
+%if 0%{?enable_portaudio}
+%package plugins-portaudio
+Summary:       PortAudio output plug-in for %{name}
+BuildRequires: pkgconfig(portaudio-2.0)
+Requires:      %{name} = %{version}-%{release}
+Supplements:   (mpg123 and portaudio)
+ 
+%description plugins-portaudio %{_description} 
+PortAudio output plug-in.
+%endif
+
+%package libs
+Summary:      %{_summary}
+Provides:     lib%{name} = %{version}-%{release}
+Provides:     lib%{name} = %{version}-%{release}
+Obsoletes:    lib%{name} < 1.23.4-1
+ 
+%description libs %{_description}
+
 %package devel
 Summary:      Development files for %{name}
-Requires:           %{name} = %{version}-%{release}
-BuildRequires:      doxygen
+BuildRequires:doxygen
+Requires:     %{name}-libs = %{version}-%{release}
+Provides:     lib%{name}-devel = %{version}-%{release}
+Obsoletes:    lib%{name}-devel < 1.23.4-1
+Obsoletes:    %{name}-libs-devel < 1.23.8-3
 
 %description devel
 Development files for decoding and output libraries for mpg123.
@@ -42,8 +77,9 @@ Development files for decoding and output libraries for mpg123.
 %autosetup -n %{name}-%{version} -p1
 
 %build
-%configure --with-audio=alsa,pulse,oss
-%disable_rpath
+autoreconf -vfi
+%configure --enable-modules=yes --with-default-audio=portaudio \
+  --with-audio=alsa,%{?enable_jack:jack},pulse,oss,%{?enable_portaudio:portaudio}
 %make_build
 pushd doc
   doxygen doxygen.conf
@@ -52,16 +88,10 @@ popd
 %install
 %make_install
 %delete_la
-
-%pre
-%preun
-%post -p /sbin/ldconfig
-%postun -p /sbin/ldconfig
+%ldconfig_scriptlets libs
 
 %files
-%license COPYING
 %{_bindir}/*
-%{_libdir}/*.so.*
 %dir %{_libdir}/%{name}
 %{_libdir}/%{name}/output_alsa.*
 %{_libdir}/%{name}/output_dummy.*
@@ -70,6 +100,22 @@ popd
 %files plugins-pulseaudio
 %{_libdir}/%{name}/output_pulse.*
  
+%if 0%{?enable_jack}
+%files plugins-jack
+%{_libdir}/%{name}/output_jack.*
+%endif
+ 
+%if 0%{?enable_portaudio}
+%files plugins-portaudio
+%{_libdir}/%{name}/output_portaudio.*
+%endif
+ 
+%files libs
+%license COPYING
+%{_libdir}/lib%{name}.so.0*
+%{_libdir}/libout123.so.0*
+%{_libdir}/libsyn123.so.0*
+
 %files devel
 %{_includedir}/*
 %{_libdir}/*.so
@@ -79,7 +125,18 @@ popd
 %doc NEWS NEWS.lib%{name} doc/*
 %doc %{_mandir}/man1/*
 
-
 %changelog
+* Fri Nov 1 2024 Deyuan Fan <fandeyuan@kylinos.cn> - 1.29.3-4
+- fix CVE-2024-10573
+
+* Sat Jul 30 2022 wangkai <wangkai385@h-partners.com> - 1.29.3-3
+- Add portaudio and jack audio plugin to fix mpg123 xxx.mp3 error
+
+* Mon May 23 2022 tanyulong<tanyulong@kylinos.cn> - 1.29.3-2
+- Improve the project according to the requirements of compliance improvement
+
+* Tue Jan 18 2022 SimpleUpdate Robot <tc@openeuler.org> - 1.29.3-1
+- Upgrade to version 1.29.3
+
 * Thu Nov 28 2019 Qianbiao.NG <Qianbiao.NG@turnbig.net> - 1.25.10-2
 - Repackage for openEuler OS

mpg123.yaml

@@ -1,4 +1,4 @@
-version-ctrl: svn
+version_control: svn
 src_repo: http://mpg123.org/cgi-bin/scm/mpg123
-tag_prefix: v 
-seperator: .
+tag_prefix: "v" 
+seperator: "."