2018-10-31 09:07 ph3-der-loewe * Update: Changed set of default headers * Improve compatibility with broken clients 2018-10-30 13:53 tbr * Win32 clean up * Removed all files related to the removed Windows UI * Added files needed by NSIS * Added batch file used to start icecast on Windows * Include icecast.bat into Makefile 2018-10-28 10:42 ph3-der-loewe * Fix: Worked around buffer overflows in URL auth's cURL interface 2018-10-27 17:42 ph3-der-loewe * Security fix: Fixed buffer overflows in URL auth code. * CVE-2018-18820 * Fix: Fixed a memory leak * Fix: Removed integer overflows 2018-10-27 11:59 ph3-der-loewe * Fix: Corrected possible bufferoverflows in format_prepare_headers() 2018-06-17 06:50 ph3-der-loewe * Fix: Do not shut down fserve engine if not started up * Fix: Corrected const for SSL_METHOD*. 2018-06-10 18:13 tbr * Release preparation for Icecast 2.4.4 2018-05-26 06:15 ph3-der-loewe * Fix: Fixed segfault in htpasswd auth if no filename is set 2018-05-08 07:24 ph3-der-loewe * Fix: Do not report hashed user passworts in user list. 2018-05-05 07:23 Marvin Scholz * Fix two mistakes in the default config's comments 2018-05-05 07:23 Marvin Scholz * Add log message for succesful streamlist requests 2018-05-05 07:23 JRS * Fix: update_from_master() for receiving HTTP/1.1 2018-05-05 07:23 tbr * Fix: Spelling, thanks to Ukikie 2018-05-05 06:41 ph3-der-loewe * Fix: Fixed a segfault when xsltApplyStylesheet() returns error 2018-04-21 10:30 ph3-der-loewe * Fix: Do not segfaul on bad Opus streams 2018-04-21 10:29 ph3-der-loewe * Fix: Corrected response and fixed TLS for 416 Request Range Not Satisfiable responses 2018-04-21 10:13 ph3-der-loewe * Fix: TLS for ICECAST_PROTOCOL_SHOUTCAST source clients 2018-04-16 13:42 Marvin Scholz * Fix: global listener count could be negative under certain circumstances Thanks a lot to Simeon Völkel (0xBD4E031CDB4043C9) for reporting and investigating the bug. 2018-04-13 13:46 ph3-der-loewe * Fix: Send "Content-Length: 0" on 100-continue 2018-04-13 11:18 ph3-der-loewe * Fix: Do not send 100-continue in plain over TLS sockets 2016-12-27 11:49 ph3-der-loewe * Fix: Added needed code to announce Opus streams as such to yp. This fixes the situation at least for Opus. It should be checked if the same problem applies to other codecs as well. If so, maybe a better solution should be considered for 2.5.x. 2016-12-07 18:42 ph3-der-loewe * Cleanup: Updated usage of global.running to be more clear 2016-12-07 18:38 ph3-der-loewe * Fix: Avoid invalid locking in signal handlers. 2016-10-29 11:42 ph3-der-loewe * Workaround: avoid libspeex printing warnings on Opus streams. 2016-08-15 11:51 ph3-der-loewe * Fix: Fixed regression introduced by r19250. This fixes the regression introduced by r19250 (461a537561580cb32dac327bae73f7e670188bd4). The fix checks if the source client is actually known before printing it's IP-Address. 2016-02-10 10:00 ph3-der-loewe * Fix: do not allow unescaped strings in XML output. 2015-12-24 00:38 ph3-der-loewe * RELEASE 2.4.3 * Windows security fix: remove trailing dots in URI This addresses CVE-2005-0837 (sic!), which was sadly ignored after ticket #635 got closed erroneously. * Linux/Unix installations were never affected, Windows only release! * Impact is low: most installations run default XSLT files and there is nothing to be learned in such a case. Also a majority of production Icecast servers don't run on Windows. 2015-04-08 10:07:42 dm8tbr * RELEASE 2.4.2 * apply fix for documentation (needed by distro packaging) 2015-04-08 09:09:26 ph3-der-loewe * Fix: Do not crash URL Auth is used with stream_auth and no credentials are given. This fixes a crash (NULL reference) in case URL Auth is used and stream_auth is trigged with no credentials passed by the client. Username and password is now set to empty strings and transmited to the backend server this way. See #2191 for more details and to keep track of the problem. Closes: #2191, DEB#782120 2015-04-08 09:02:20 ph3-der-loewe * Fix: Let util_url_escape() handle NULL parameter. This lets util_url_escape() handle NULL passed as parameter. In case the parameter is NULL it will also return NULL. This patch also does some cleanup of the code such as migration away from int and thus avoiding future failures. 2015-04-08 08:32:23 dm8tbr * update version number to 2.4.2 in preparation for release this will be a strict security release 2015-04-08 08:18:40 dm8tbr * applying curl fix for win32 from master 2014-11-19 13:42:23 dm8tbr * This is Spaaarrr^w Icecast 2.4.1! 2014-11-19 13:41:09 dm8tbr * Makefile.am and configure.in for new docs 2014-11-19 12:18:49 dm8tbr * Removing unmaintained RPM spec file 2014-11-19 11:30:58 ePirat * Set PATH_MAX to 4096 if not defined (patch by Svante Signell ) See: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=767542 2014-11-18 19:57:21 ePirat * Docs: 2.4.1 docs added 2014-11-18 10:17:16 ePirat * fix for memory errors when using a lot of headers 2014-11-18 08:51:03 dm8tbr * Comments in break things ATM. Moved the comment out to avoid this bug. Needs to be checked. 2014-11-17 19:20:57 ph3-der-loewe * subset of earlier patch so it can go into 2.4.1: disconnects stdio of scripts from server owned filehandles. * This is considered a security fix: if on-connect/on-disconnect scripts are used, file descriptors of the server process remain open and could be written to or read from. Most pressing STDIN, STDOUT, STDERR are handled. Further all file descriptors up to 1024 are closed. There is a remaining (much lower) risk in combination of either a malicious or susceptible script and FDs above 1024. 2014-11-10 10:46:55 ph3-der-loewe * patch to fix regression on header size with large headers introduced by support of and . This should ensure we have at least space for 2kB of extra headers. Depending on function and call we may have much more space. 2014-11-10 08:23:34 dm8tbr * Update minimal config to also contain ACAO * header 2014-11-10 06:25:15 dm8tbr * Update default config: SSL, headers, default-mount 2014-11-09 10:55:29 dm8tbr * Updated default openSSL cipher string * https://wiki.mozilla.org/Security/Server_Side_TLS#Intermediate_compatibility_.28default.29 * same Qualys result 2014-11-09 09:13:59 dm8tbr * Clean up default config 2014-11-08 16:23:26 dm8tbr * Applying patch by ph3-der-loewe, HTTP PUT requires content-type * In case of SOURCE we are lenient and thus quite some source clients don't send a proper content-type, especially if they only support mp3. * This was meant to be introduced in 2.4.0 already, sadly we missed it. * All source clients MUST send proper content-type after migrating to Icecast HTTP PUT protocol. 2014-11-08 13:34:45 ph3-der-loewe * Fixed regression introduced in r18356 (CVE-2011-4612): client duration time is now correctly logged. PRIu64 MUST NOT be used with log_write_direct() as depending on platform PRIu64 may be using something not supported by __vsnprintf() of log/log.c. 2014-11-08 12:28:17 ph3-der-loewe * make use of sizeof() not explicit magic numbers 2014-11-07 23:10:43 ph3-der-loewe * fixing some compiler warnings 2014-11-07 22:06:06 ph3-der-loewe * updated some copyright headers 2014-11-07 20:56:04 ph3-der-loewe * fix for %z on win*. hope it doesn't breaky anything else. 2014-11-07 19:14:28 ph3-der-loewe * added warnings on empty and default values of , , , and 2014-11-07 11:18:54 ph3-der-loewe * send errorlog (loglevel WARN) to stderr prior to opening the real logfiles. 2014-11-07 10:12:24 ph3-der-loewe * added support for type="" and status="" in
(subelement of ). 2014-11-07 02:55:57 ph3-der-loewe * Added support for within . Also support merging of headers (normal mount + default mount). 2014-11-07 01:40:28 ph3-der-loewe * handle empty strings in config file better. Now empty strings are handled in: accesslog, errorlog, logdir, webroot, adminroot and hopefully all kinds of port. 2014-11-07 00:56:02 ph3-der-loewe * initial patch to allow adding user defined headers 2014-11-06 23:55:58 ph3-der-loewe * coding style and typo correcion 2014-11-06 12:02:00 dm8tbr * Be more verbose in case of fileserve off 2014-11-05 10:09:07 dm8tbr * applied patch to update the default ciphers to be more secure * tested this successfully against https://www.ssllabs.com/ssltest/ 2014-11-03 19:34:10 ph3-der-loewe * applied patch to disable SSLv3 and SSL compression explicitly 2014-11-02 20:19:29 dm8tbr * fix JSON status API problems * Put the last item check into every filtered tag. * This way we shouldn't run into problems of this type anymore. * Also it should be easier to customize this way, if someone wants to filter differently. 2014-10-31 09:00:45 ph3-der-loewe * rename ICE_LISTEN_QUEUE, ICE_RUNNING and ICE_HALTING so they have a prefix of ICECAST_ 2014-10-31 08:46:58 ph3-der-loewe * LOG_{ERROR|WARN|INFO|DEBUG}() -> ICECAST_LOG_{ERROR|WARN|INFO|DEBUG}() * avoid collision with LOG_INFO that is defined as part of syslog. 2014-10-26 14:03:57 ph3-der-loewe * make in work if no is given. 2014-10-23 20:41:38 epirat * More detailed logging * Add source IP adress to startup and source exit logging * Add mountpoint to some log lines 2014-10-18 16:25:29 ph3-der-loewe * fix warnings, mostly related to win*-builds 2014-10-09 10:39:13 ph3-der-loewe * Replace the old logging macros with variadic argument macros. (patch by ePirat) 2014-07-23 16:55:57 dm8tbr * removed threadpool from example config it is long gone and unused 2014-07-23 10:20:47 dm8tbr * Fix autogen.sh to work properly on Mac OS * Applying patch by ePirat 2014-05-06 05:23:42 dm8tbr * This is Icecast 2.4.0! 2014-05-06 04:53:24 dm8tbr * SECURITY FIX - Override supplementary groups if 2014-05-05 05:16:44 dm8tbr * Added