Skip to content

Conversation

@dev-mend-for-github.zerozr99.workers.dev

This PR contains the following updates:

Package Type Update Change
james-heinrich/getid3 (source) require patch 1.9.15 -> 1.9.21

By merging this PR, the issue #54 will be automatically resolved and closed:

Severity CVSS Score Vulnerability Reachability
Medium Medium 6.1 CVE-2021-40926

Release Notes

JamesHeinrich/getID3 (james-heinrich/getid3)

v1.9.21: -202109171300

Compare Source

1.9.21: [2021-09-22] James Heinrich :: 1.9.21-202109171300
» add support for RIFF.guan
¤ add ID3v1 genres 148-191
¤ torrent files easy access key

  • bugfix #​342 demo.mysqli.php XSS
  • bugfix #​340 default quicktime.ReturnAtomData=false
  • bugfix #​338 improved transliterated tag merging
  • bugfix #​337 PHP 8.1 compatibility
  • bugfix #​335 PHP 8.1 compatibility
  • bugfix #​330 QuicktimeContentRatingLookup 'rtng'
  • bugfix #​328 throw exception if a resource seek fails
  • bugfix #​326 improved temporary path detection
  • bugfix #​325 INF/NAN constants instead of float/string
  • bugfix #​324 Nikon-specific atoms in QuickTime
  • bugfix #​321 prevent errors on corrupt JPEGs
  • bugfix #​319 prevent error in ZIP contents MIME detect
  • bugfix #​315 ID3v2 USLT check for data length
  • bugfix #​308 silence libxml deprecation warning
  • bugfix #​304 undefined index: comments
  • bugfix #​299 decbin type error in PHP8
  • bugfix #​298 error scanning WAV via file pointer
  • bugfix #​294 replace IMG_JPG with IMAGETYPE_JPEG
  • bugfix #​292 PDFs take long time to parse
  • bugfix #​291 divzero QuickTime with no playable content
  • bugfix #​290 detect ID3v1 on minimal example files
  • bugfix #​289 avoid crash on invalid TIFF
  • bugfix #​287 mp3 CBR detected as VBR
  • bugfix #​286 corrupt mp3 can cause slow scanning
  • bugfix #​284 allow "0" as a value in tags
  • bugfix #​283 array offset on value of type int
  • bugfix #​277 ID3v2 add new Turkish Lira TRY
  • bugfix #​270 demo.mysqli.php LONGBLOB
  • bugfix #​266 fix possible endless loop on PNG
  • bugfix #​257 undefined variables
  • bugfix #​207 improved LAME version string parsing

v1.9.20

Compare Source

1.9.20: [2020-06-30] James Heinrich :: 1.9.20-202006061653
» add support for DSDIFF audio
» add support for TAK lossess audio
» add support for IVF video
» add detection support for EPUB files
» add detection support for HPK archives
» add demo.mysqli.php, remove demo.mysql.php
¤ QuickTime.uuid now returned as an array (may contain multiple entries)
¤ improved PDF support, including page count
* bugfix (#​247) array_min incorrect return value
* bugfix (#​242) filepointer analysis errors
* bugfix (#​238) comments_html may not match comments
* bugfix (#​235) prevent disclosing paths when accessing modules directly
* bugfix (#​233) Quicktime duplicate attached images
* bugfix (#​229) Quicktime timestamps easy access
* bugfix (#​228) master.zip did not contain demos
* bugfix (#​227) Quicktime check subatoms data length
* bugfix (#​226) uuid parsing based on UUID
* bugfix (#​225) use comments_html content already generated by modules
* bugfix (#​223) ID3v2 slashed genre names
* bugfix (#​222) demo.browse filesystem character encoding
* bugfix (#​221) option_tags_html=false ignored
* bugfix (#​219) Quicktime.UUID now parsed more discriminately for XML and other data types
* bugfix (#​218) QuickTime not copying covr to comments
* bugfix (#​217) mp3 array offsets of type bool
* bugfix (#​216) ID3v2.write allow WMP rating in POPM
* bugfix (#​210) PHP 7.4 deprecated get_magic_quotes
* bugfix: Quicktime detect null-terminated strings used where Pascal strings should be
* bugfix: Quicktime GPS uninitialized array keys

v1.9.19

Compare Source

1.9.19: [2019-12-17] James Heinrich :: 1.9.19-201912131005

  • add placeholder support for WTV (Windows Recorded TV Show)
  • bugfix (#​210) PHP 7.4 deprecated get_magic_quotes
  • bugfix (#​207) improved LAME version string parsing
  • bugfix (#​206) inverted logic in CopyTagsToComments
  • bugfix (#​203) use getimagesizefromstring if available
  • Quicktime decode 'uuid' atom for 360fly cameras

v1.9.18

Compare Source

1.9.18: [2019-07-24] James Heinrich :: 1.9.18-201907240906

  • bugfix (#​198) use native hash functions instead of obsolete external binaries
  • bugfix (#​194) PHP 7.4 compatibility: fix deprecated curly brace array access
  • bugfix (#​191) unsupported operand types module.audio.ac3.php:763
  • bugfix (#​189) false UTF-16 and no termination strings
  • bugfix (#​188) add support for DS2 v8
  • bugfix (#​187) RIFF.WAVE.scot parsing
  • bugfix (#​184) invalid regex pattern (ID3v1)
  • bugfix (#​183) reduced information for GIF files with $option_extra_info=false
  • bugfix (#​175) mp4 max buffer size
  • bugfix (#​174) TIFF parsing improvements
  • bugfix (#​121) trailing nulls in ID3v2 strings
  • standardize "track" -> "track_number"

v1.9.17

Compare Source

1.9.17: [2019-02-07] James Heinrich :: 1.9.17-201902071234

  • bugfix (#​178) HandleAllTags should skip "picture"
  • bugfix (#​177) error checking for reading more than PHP memory_limit
  • bugfix (#​176) improved mp3 detection in remote-file demo
  • bugfix (#​173) Add filepointer option to analyze/openfile function
  • bugfix (#​170) Add support for WXXX (URL) and APIC (attached picture) subframes inside ID3v2 chapters
  • bugfix: write.id3v2 year field
  • bugfix: mp3.APE permit optional " dB" in ReplayGain tags
  • placeholder support for .xz file format

v1.9.16

Compare Source

1.9.16: [2018-10-17] James Heinrich :: 1.9.16-201810171314

  • bugfix (#​168) Ogg FLAC not parsed
  • bugfix (#​163) invalid MP3 header error on VBR
  • bugfix (#​162) prevent writing multiple ID3v2 versions
  • bugfix (#​161) MP3 VBR header duration
  • bugfix (#​160) OggOpus duration sometimes incorrect
  • bugfix (#​157) quicktime GPS invalid argument
  • bugfix (#​148) MPEG-2 aspect ratio
  • bugfix (#​147) Quicktime fourcc codec name lookup
  • bugfix (#​147) Quicktime audio/video bitrate guessing
  • bugfix (#​145) incompatible variable types
  • bugfix (#​139) Quicktime islt subatoms >5
  • bugfix (#​137) ID3v2 semi-numeric genres
  • bugfix (#​136) ID3v2 unsynchronised typo
  • bugfix (#​2514) FLAC zero-byte block header
  • bugfix (#​2488) MIME types (FLAC, WAV, gzip)
  • bugfix (#​2468) Quicktime video rotation
  • bugfix (#​2207) metaflac + attached pictures
  • bugfix (#​2151) improved demo UNC filename support
  • bugfix (#​1966) fread fail when PHP memory_limit -1
  • bugfix (#​1908) Quicktime rotation detection (using matrix values)
  • bugfix (#​1908) Quicktime "rcif" and "dscp" atoms
  • bugfix (#​1900) demo.joinmp3 cut from end
  • security: avoid disabled demo reflection
  • TIFF: expand list of named tags, expose as 'tag_name' key for all entries
  • Quicktime: parse some GoPro-specific data
  • helperapps (Windows): updated vorbiscomment.exe, metaflac.exe to v1.3.2
  • add more image formats supported by getimagesize()

  • If you want to rebase/retry this PR, check this box

@dev-mend-for-github.zerozr99.workers.dev dev-mend-for-github.zerozr99.workers.dev bot added the security fix Security fix generated by Mend label Oct 31, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

security fix Security fix generated by Mend

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant