News Archive

2006-12-31, Суббота :: переполнение буфера в asmrp.c
размещено Roberto

Обзор

Код упомянутый в DSA 1244-1 присутствует и в MPlayer. Потенциальное переполнение буфера было найдено в коде, использующемся для обработки RealMedia RTSP потоков. При проверке на соответствие asm правилам, код сохраняет результаты в массиве фиксированного размера, но выход за пределы массива не проверяется. Это может привести к переполнению буфера, если пользователя обманом заставили соединиться с сервером злоумышленника. Поскольку атакующий не может писать произвольные данные в буфер, создание эксплоита очень сложно, но DoS атака легко осуществима.

Опасность

Высокая (DoS и возможное при соответствующих условиях удаленное выполнение кода с правами запустившего проигрыватель пользователя), при установке RTSP сессии с сервером злоумышленника, отсутствует, если вы этой возможностью не пользуетесь. На момент исправления ошибки с переполнением буфера эксплоитов замечено не было.

Решение

Исправление этой проблемы выло внесено в SVN Sun Dec 31 13:27:53 2006 UTC как r21799. Исправление затрагивает три файла: stream/realrtsp/asmrp.c, stream/realrtsp/asmrp.h и stream/realrtsp/real.c. Пользователям уязвимых версий следует скачать патч для MPlayer 1.0rc1 или обновиться до последней версии, если используют SVN.

Заметьте, что мы не выпускаем обновленный архив с исправлением, поскольку уже ведется работа над MPlayer 1.0rc2.
Если вам требуется оставаться с 1.0rc1, возьмите архив MPlayer 1.0rc1, наложите патч с исправлением и заново скомпилируйте MPlayer; в противном случае обновитесь до SVN.
Если вы поддерживаете бинарный пакет для MPlayer, назовите, пожалуйста, обновленную версию MPlayer 1.0rc1try2.

Уязвимые версии

MPlayer 1.0rc1 и SVN до r21799 (Sun Dec 31 13:27:53 2006 UTC). Возможно и предыдущие версии, но это не проверялось.

Версии, не подверженные уязвимости

SVN HEAD после r21799 (Sun Dec 31 13:27:53 2006 UTC)
MPlayer 1.0rc1 + патч безопасности

Команда MPlayer поздравляет вас с Новым Годом.

2006-10-22, Воскресенье :: Вышел MPlayer 1.0rc1
размещено release team

Мы хотим выразить благодарность проекту Google Summer of Code за спонсирование проекта FFmpeg. Спасибо программе SoC 2006, проект FFmpeg смог получить помощь студентов в реализации большего количества родных кодеков.

Ключевыми моменты этого релиза являются родное декодирование VC-1/WMV3, On2 VP5 и VP62 (используется в некоторых файлах Flash видео), работающее даже на не-Intel платформах, и SSA/ASS/цветные субтитры.

Более того, теперь возможна нативная работа на Intel Mac (вам надо всего лишь указать --disable-win32 --disable-mp3lib для configure), -endpos была окончательно добавлена в MPlayer, в Windows GUI также заметны некоторые улучшения.

Декодирование Vorbis, как и H.264, значительно ускорилось. Оптимизация H.264 все еще продолжается, но разница уже должна быть заметна.

И последнее, но не менее значимое: было найдено и исправлено множество ошибок с момента выхода pre8.

По соображениям безопасности (спасибо Rudolf Polzer, обнаружившему проблему) MPlayer 1.0rc1 более не загружает файл-ориентированные файлы конфигурации из каталога с воспроизводимым фильмом; если вы хотите восстановить старое поведение, добавьте опцию -use-filedir-conf.

Если у вас уже есть пакет бинарных кодеков от pre8, не нужно снова его скачивать: Обновленные пакеты 20061022 не содержат новых кодеков, оттуда просто убраны те, которые теперь нативно поддерживаются.

MPlayer 1.0rc1: "Кодовое имя намеренно оставлено пустым"

DOCS:

Драйверы:

Декодеры:

Демультиплексоры:

Потоки:

FFmpeg/libavcodec:

GUI:

Фильтры:

MEncoder:

Порты:

Другое:

MPlayer 1.0rc1 можно загрузить из следующих мест. Пожалуйста, пожалейте наш сервер и используйте одно из множества зеркал.

MPlayer 1.0rc1 также доступен через BitTorrent.

MD5SUM: 18c05d88e22c3b815a43ca8d7152ccdc
SHA1SUM: a450c0b0749c343a8496ba7810363c9d46dfa73c

2006-09-5, Tuesday :: A Call for Translators
posted by Diego

MPlayer and its documentation are available in many languages. Unfortunately not all translations are in good conditions. Many are outdated and incomplete. Therefore we need your help to get them back on track. Becoming a translator takes very little and is a great way to contribute or start contributing to free software. Without any sort of coding skills a small effort on your part can make a difference.

If you check out our documentation page you will see which translations are incomplete, outdated, in need of a helping hand or all of the above. So if you want to help us out with translations, read the translation HOWTO and join the MPlayer-DOCS and MPlayer-translations mailing lists.

Apart from the documentation another part of translating MPlayer are the console and GUI messages. We have them in Bulgarian, Czech, German, Danish, Greek, Spanish, French, Hungarian, Italian, Japanese, Korean, Macedonian, Dutch, Norwegian, Polish, Brazilian Portuguese, Romanian, Russian, Slovenian, Swedish, Turkish, Ukranian, traditional Chinese and simplified Chinese. Most of these are also outdated and badly in need of updating.

2006-09-11, Monday :: Windows GUI
posted by Diego

Experimental builds of the new Windows GUI can be found on the download page. Enjoy and tell your Windows-using friends about it.

2006-06-11, Sunday :: MPlayer 1.0pre8 released
posted by the release team

It's been more than one year since our last release and yes, we are still alive! Like always, the length of the ChangeLog clearly shows we have been lazy to release but not lazy to code.

First off, we have uncovered some new security bugs in the AVI, Real and MOV code so we urge you to upgrade in any case.

Given how old pre7 is by now, it's strongly recommended to upgrade. We also recommend users to test and use the Subversion version when possible in order to both benefit from latest development, and report/fix bugs. Contrary to running a development kernel, it won't eat your data or make your cat pregnant, but it will help us improve the overall quality of MPlayer.

Among the many features that have been added, it should be noted that libavformat now supports a greater variety of files. If you have a hard time playing some files, please try demuxing with libavformat (-demuxer lavf). MEncoder can also take advantage of libavformat, in order to, for example, create Flash videos.

There have also been many enhancements to the H.264 decoder to make it a lot faster and more error-resilient. More audio and video codecs are supported. Audio/Video synchronisation has been further improved, especially on Real streams and Vorbis.

And that's not it yet! We have some more tricks for you up our sleeves for upcoming versions of MPlayer: experimental DVDnav (DVD menus) support and an experimental graphical user interface for our Windows port. Please join in the testing effort so that these features don't remain experimental ;-).

MPlayer 1.0pre8: "NeuTeam strikes back"

Security:

Documentation:

Drivers:

Decoders:

Demuxers:

Streaming:

FFmpeg/libavcodec:

GUI:

Filters:

MEncoder:

Ports:

Others:

MPlayer 1.0pre8 can be downloaded from the following locations. Please be kind to our server and use one of our many mirrors.

MPlayer 1.0pre8 is also available on BitTorrent.

MD5SUM: f82bb2bc51b6cd5e5dd96f88f6f98582

2006-06-06, Monday :: Subversion repository online
posted by Diego

The CVS to Subversion conversion is finally finished. You can access the MPlayer Subversion repository at 

  svn checkout svn://svn.mplayerhq.hu/mplayer/trunk/

or browse it online. Development will now continue normally with next-generation revision control technology.

2006-05-23, Tuesday :: MPHQ is dead
posted by Roberto

Our old server mphq died on Friday afternoon. Probably it won't come back online.

While many services were already moved to the new server natsuki, CVS repositories and mailing lists were still hosted on the old machine.

The mail system was set up in no time (thanks to our sysadmin team), and the lists are back online since Monday. The CVS server won't be moved: We are converting the repositories to Subversion (as already planned), and the development will continue using Subversion. But this will take some time. FFmpeg will be first (a testing only repository is already available to developers), then MPlayer will be converted.

The latest MPlayer and FFmpeg CVS snapshots are available. [snapshots removed, get MPlayer and FFmpeg with Subversion]

2006-05-04, Thursday :: MPlayer interview
posted by Diego

Alex, Oded and myself were interviewed by cruocitae for http://itreviews.blogspot.com/. To get a peek into our minds read the interview.

2006-05-01, Monday :: MPlayer at LinuxTag 2006
posted by Diego

LinuxTag logo

The multimedia booth at LinuxTag is starting to become an institution. If you decide to come to Wiesbaden this year you can meet some members of the MPlayer and FFmpeg teams there.

As a special feature this year we will attempt to fix any broken samples you deliver to our booth. If you have a problematic file, bring it to us, we will categorize it and try to find a fix and/or workaround for your problem. We can make no promises about the success, but we will give it our best shot.

2006-03-08, Wednesday :: LinuxQuestions.org Members Choice Award
posted by Diego

2005 LinuxQuestions.org Members Choice Award

The polls have just closed on the annual Members Choice Award by LinuxQuestions.org and MPlayer has won in the category Video Multimedia Application of the Year.

568 people (46.94%) voted for MPlayer. The second place went to xine with 365 votes (30.17%) and the third place was taken by VLC with 117 (9.67%).

A big thank you to our many fans.

2006-02-27, Monday :: server operational
posted by Diego

If you can read this, the new server is already serving web pages.

Due to various circumstances it has taken us far longer than expected to get the machine set up and transported to its final hosting location. Right now it's already serving web pages and FTP as well as experimental Subversion repositories. Please bear with us for a little longer until we have the mirror network up and running, continue the transition from CVS to Subversion and move over the mailing lists.

Again, many thanks to the many donors that have made this wish a reality.

2006-02-15, Wednesday :: heap overflow in demuxer.h
posted by Roberto

Summary

A potential buffer overflow was found in the ASF demuxer, and further analysis showed that the bug was in some more generic code in demuxer.h, used to create and resize buffers. You can read the original bug report here media-video/mplayer ASF File Parsing Integer Overflow (CAN-2006-0579) on Gentoo Bugzilla.

Severity

High (arbitrary remote code execution under the user ID running the player) when streaming an ASF file from a malicious server, medium (local code execution under the user ID running the player) if you play a malicious ASF file locally. At the time the buffer overflow was fixed there was no known exploit.

Solution

A fix for this problem was committed to CVS on Sun Feb 12 09:28:09 2006 UTC, and enhanced in versions 1.89 and 1.90. Users of affected MPlayer versions should download a patch for MPlayer 1.0pre7try2 or update to the latest version if they're using CVS.

Please note that we are not releasing an updated tarball with this fix at this moment. Since MPlayer 1.0pre7 is very old, we encourage you to upgrade to the CVS version.
If you need to stay with 1.0pre7, get the MPlayer 1.0pre7try2 tarball, apply the patch with the fix and recompile MPlayer.
If you mantain a binary package for MPlayer, please name the updated version MPlayer 1.0pre7try3.

Affected versions

MPlayer 1.0pre7, MPlayer 1.0pre7try2 and CVS before Sun Feb 12 09:28:09 2006 UTC. Older versions are probably affected, too, but they were not checked.

Unaffected versions

CVS HEAD after Sun Feb 12 09:28:09 2006 UTC
MPlayer 1.0pre7try2 + security patch

2005-12-23, Friday :: HUP Readers' Choice Award 2005
posted by Diego

HUP Readers' Choice Award 2005

Over in Hungary MPlayer appears to remain popular and has won the Readers' Choice Award of the Hungarian Unix Portal in the "favorite video player of the year" category for the third time in a row.

MPlayer got 539 votes (84%), placing it before VLC 58 (9%) and last year's runner-up xine 42 (7%). If you can read Hungarian, check out the HUP award page.

2005-09-02, Friday :: TUX 2005 Readers' Choice Award
posted by Diego

TUX 2005 Readers' Choice Award

Good news everyone!

It appears that MPlayer is as popular as ever. We have just been notified that TUX magazine has announced the winners of its first annual Readers' Choice Award and MPlayer has come out on top in the category Favorite Media Player.

Thanks for all your support, it's really appreciated!

2005-08-26, Friday :: heap overflow in ad_pcm.c
posted by Attila

There is a bug which, depending on configuration, can lead to a heap overflow. If and under which circumstances this is exploitable is unclear to us as of now. We are aware that at least one person was able to write a working exploit on his system using an AVI file with uncompressed PCM audio. We have found a file that is supposed to exploit it but could not make it work, still we do not want to put you at risk by waiting longer to publish this.

Solution

A fix for this problem was committed to CVS on Thu Aug 25 19:46:20 2005 UTC. You can download a patch for MPlayer 1.0pre7 here.

Adding ac=-pcm, (notice the trailing ',') to your configuration file is a quick fix that should keep you safe as long as you don't use the -ac option on the command line. It will prevent you from playing uncompressed audio, though.

We also prepared a new tarball for the pre7 release with the fix applied. Please note that this is not a new MPlayer release, if you want to have all the new features introduced after pre7 you should use the CVS version.

Affected versions

MPlayer 1.0pre7 and before
Up to now the only version where an exploit was demonstrated is MPlayer 1.0pre7, but the bug is present in all previous versions.

Unaffected versions

MPlayer 1.0pre7try2 and after
CVS HEAD after Thu Aug 25 19:46:20 2005 UTC

MPlayer 1.0pre7try2 can be downloaded from the following locations. Please be kind to our server and use one of our many mirrors.

MD5SUM: aaca4fd327176c1afb463f0f047ef6f4

2005-08-17, Wednesday :: thanks
posted by Alex

Firstly, we would like to thank all donors for the generous contributions we have received in the last weeks. We had never dreamed the call for donations would be so successful. Now we have ordered a much better server than expected, which opens the path for us to offer more and better services. We can even afford a backup solution! The server is expected to arrive in four weeks, but we will need a few more weeks for stress-testing and completing the setup.

The list of donors can be found on the donations page. Please mail me if you would like to have your name removed. Also due to some bank transfer conditions, some names are missing or wrongly spelled. Mail if you need correction!

Next updates will contain more in-depth information about the hardware and services. To be continued...

2005-08-16, Tuesday :: vesautils
posted by Alex

I merged the VESA efforts of MPlayer and MPlayerXP. Together with some utilities from svgalib and vbetool this forms vesatools. Starting with the next MPlayer release, this library will be used for the VESA video output. This adds support for FreeBSD, NetBSD and OpenBSD.

2005-08-05, Friday :: new server wanted
posted by Alex

What happened?

As you may have noticed, we had a server failure due to an air-conditioning breakdown. The server's filesystem got corrupted, affecting our CVS repository. This has finally prompted us to look for a different hosting solution and maybe refresh the hardware in the process. We have an opportunity to host our server at a real hosting company with reliable air conditioning and power supply, but they only have space for a 1U rackmount case, while we have a standard tower case.

There are three options:

After reviewing our requirements closely we would much prefer to get a new server that will suffice for some years to come. We were offered virtual hosting, but we really need a dedicated server. Also note that the FFmpeg project is hosted on the same server and other projects like xine rely on us to distribute codec packages for them, so this machine is really central for free software multimedia.

We collected some donations at LinuxTag to cover expenses and have roughly 70EUR left, but that is barely enough for a single disk. Now we are searching for special discounts, monetary donations - or better - a complete configuration. Regarding monetary donations, we would like to spend the whole sum on the server to avoid the problem of having money lying around.

the configuration we are looking for

How to donate money

Paypal
(removed)
European bank account
Account name: Beregszaszi Alex (removed)
US cheques
Richard Felker (removed)
German bank account
Account name: Reimar Döffinger (removed)
Swiss bank account
Account name: Attila Dogan (removed)
French bank account
Account name: MR POIRIER GUILLAUME (removed)
Hungarian bank account
Account name: Beregszaszi Alex (removed)

It is important that you write MPlayer into the comment field. If you would not like to see your name on the donors list add anonymous.

We will report about financial status in at most a month. If you have any questions please contact us via the mplayer-dev-eng mailing list, IRC or privately.

2005-08-09 Failure Update

The disk with the ftp downloadable data (releases, codec packages, samples, skins, cvs snapshots, ...) failed again on Monday, and it's now offline. Please use one of our mirrors to get MPlayer. CVS is on a different disk and it's still available. Because of this failure online docs are no longer accessible, please refer to the documentation included in MPlayer tarball. Incoming directory is gone too.

2005-07-26, Tuesday :: video book
posted by Diego

book cover

Open Source Press has published an anthology about video under Linux. It gives a good overview of the current state of things in 19 chapters that cover the areas video playback, video editing and video streaming, with each chapter either covering software you can use to accomplish those tasks under Linux or giving an introduction to the many technical facets of video. The authors of the chapters are all project members or closely related to the projects they write about. Yours truly wrote - surprise - the chapter about MPlayer. The preface and table of contents are available online. The book is currently only available in German.

2005-07-11, Monday :: software patent directive rejected
posted by Diego

With a truly overwhelming majority the EU parliament has rejected the proposed software patent directive last week. This is a great victory for the movement against software patents and a relief for free software and all of the software industry in Europe and worldwide. It is also a great personal satisfaction for myself and other members of the MPlayer team that have been actively lobbying against software patents. Rejoice and be happy for this was a grand day indeed.

Nevertheless all that glistens is not gold and while we have won an important battle, this struggle is far from over. There are still thousands of software patents that have already been granted in Europe. Furthermore efforts to extend patentability towards software will now continue on the national level and probably return at the EU level in a few years. Thus we have to continue our fight to fend off software patents completely and worldwide. For this we need the help of all community members. You have to keep a watchful eye on your political representatives, inform them about the issues at stake and make sure they pass sensible legislation.

2005-06-19, Sunday :: MPlayer at LinuxTag 2005
posted by Diego

LinuxTag logo

It's that time of year again... The MPlayer team will be at the LinuxTag 2005 manning the multimedia booth. Roberto Togni, Alexander Strasser, Sascha Sommer, Dominik Mierzejewski, Reimar Döffinger, Diego Biurrun, Alex Beregszaszi, Luca Barbato will be present most of the time and we will be joined by Mike Melanson (FFmpeg / xine) and Måns Rullgård (FFmpeg / tcvp).

LinuxTag takes place in Karlsruhe, Germany from the 22nd to the 25th of June. Its motto is "Where .com meets .org." and it is a mix between a trade show and a conference where both companies and free software projects are present. Drop by if you wish to talk to us.

Video is one of the focal points of this year's LinuxTag. There will be a conference track dedicated to video on Thursday and Friday. The presentations in the video track are based on an anthology about video under Linux published by Open Source Press. Diego Biurrun will give a presentation about MPlayer on Thursday based on the book chapter he wrote.

2005-04-16, Saturday :: MPlayer 1.0pre7 released
posted by the release team

The patent Sword of Damocles nonwithstanding, MPlayer is still alive and the time is ripe for another release. Do you want to see more releases in the future? Please join us in our fight against the EU patent directive. The battle is not over and we might prevail if you help as well.

First off, we have uncovered some new security bugs in the MMST and RTSP streaming code so we urge you to upgrade in any case.

We are trying to release a little more often so the list of changes is not as huge as for pre6, but still formidable. Notable improvements have been made to MEncoder this time around. It can now output MPEG files that you can use to create (S)VCDs and DVDs. Support for even more container formats through libavformat has been added experimentally and you can encode multiple files at once. If you have not used MEncoder before, now would be a good time since we expanded and improved its documentation considerably.

We have added more codecs to the feature list, some native - most notable should be ALAC (Apple Lossless Audio Codec) - and some with the help of binary codecs - notable here are TwinVQ (VQF) and VMware video. Furthermore we have imported the Tremor Ogg/Vorbis decoder into MPlayer so Ogg files and Vorbis audio now work without the need for external libraries. MPlayer should now play more files than ever as with any new release. To get the most out of it, you should also install the latest codec packages.

Snow, the next-generation wavelet-based video codec has seen some improvement and considerable speedup, plus there is a bit of documentation for it now. Try it out and play with it, just remember it's experimental and what you encode today may well not be playable tomorrow.

A lot of internal cleanup was done to the audio layer. A directly visible result is the removal of the old audio plugins that were long deprecated by audio filters.

Last but not least, we made bug fixes everywhere, so MPlayer should work with fewer hiccups than ever.

And now enjoy those movies ...

Update

Somehow we forgot to mention that we added audio track switching during playback, one of the most requested features since ages. It only works for Matroska and MPEG containers for now and is still experimental, but it's a start. Press the "#" key on a file with multiple audio tracks to try it out.

MPlayer 1.0pre7: "PatentCounter"

Security:

DOCS:

Ports:

Drivers:

Decoders:

Demuxers:

Streaming:

FFmpeg/libavcodec:

GUI:

Filters:

MEncoder:

Others:

MPlayer 1.0pre7 can be downloaded from the following locations. Please be kind to our server and use one of our many mirrors.

MD5SUM: 5fadd6957d3aab989cd760ff38fb8fdf

2005-04-16, Saturday :: MMST heap overflow
posted by Roberto

Summary

A potential buffer overflow was found and fixed in code used to handle MMST streams.

Severity

High (arbitrary remote code execution under the user ID running the player) when streaming MMS/TCP data from a malicious server, null if you do not use this feature. At this time there is no known exploit.

Description

While enumerating streams from a server, MMST code stores stream IDs in a fixed length array, but there is no check to stop the process if too many stream IDs are received. A malicious server could announce more than 20 streams and overflow the array.

Solution

A fix for the vulnerability was checked into MPlayer CVS on Fri Apr 15 23:31:57 2005 UTC. Users of affected MPlayer versions should upgrade to an unaffected MPlayer version. Alternatively a patch is available that can be applied to the MPlayer source tree.

Affected versions

MPlayer 1.0pre6 and before (including pre6a)

Unaffected versions

MPlayer 1.0pre7 and after
CVS HEAD after Fri Apr 15 23:31:57 2005 UTC

2005-04-16, Saturday :: Real RTSP heap overflow
posted by Roberto

Summary

A potential buffer overflow was found and fixed in code used to handle RealMedia RTSP streams.

Severity

High (arbitrary remote code execution under the user ID running the player) when streaming RTSP data from a malicious server, null if you do not use this feature. At this time there is no known exploit.

Description

While getting lines from a server, Real RTSP code stores them in a fixed size array of MAX_FIELDS elements, but there is no check to stop the process if too many lines are received. A malicious server could send more than MAX_FIELDS lines and overflow the array. Since the array holds pointers to answer strings, an attacker cannot write arbitrary data into it, making an exploit more difficult.

Solution

A fix for the vulnerability was checked into MPlayer CVS on Fri Apr 15 23:30:44 2005 UTC. Users of affected MPlayer versions should upgrade to an unaffected MPlayer version. Alternatively a patch is available that can be applied to the MPlayer source tree.

Affected versions

MPlayer 1.0pre6 and before (including pre6a)

Unaffected versions

MPlayer 1.0pre7 and after
CVS HEAD after Fri Apr 15 23:30:44 2005 UTC

2005-04-10, Sunday :: a word about the last round of advisories
posted by Diego

Before anyone gets wrong impressions...

The last round of advisories from today is about vulnerabilities that were reported and fixed a long time ago, please look at the dates closely.

So you can blame me for being lazy and not writing the advisories earlier, but not the MPlayer team for reacting slowly to vulnerability reports.

2005-04-10, Sunday :: mpg123 buffer overflows
posted by Diego

Summary

Several potential buffer overflows were found in mpg123, an MP3 decoder library included with MPlayer in the mp3lib directory. You can read more details in the mpg123 advisory.

Severity

Medium (arbitrary code execution under the user ID running the player) when playing MP3 audio, should the buffer overflows be exploitable. It is unclear whether this is the case. At the time the buffer overflows were fixed there was no known exploit.

Solution

A fix for the vulnerability was checked into MPlayer CVS on Tue Sep 14 21:02:19 2004 UTC. Users of affected MPlayer versions should upgrade to an unaffected MPlayer version. Alternatively a patch is available that can be applied to the MPlayer source tree.

Affected versions

MPlayer 1.0pre5 and before

Unaffected versions

MPlayer 1.0pre5try2 and after

History

After being alerted to the potential buffer overflows a fix was checked into MPlayer CVS on Tue Sep 14 21:02:19 2004 UTC.

2005-04-09, Saturday :: PNM streaming buffer overflow vulnerabilities
posted by Diego

Summary

iDEFENSE found two buffer overflow vulnerabilities in the PNM streaming code of xine that also affects MPlayer. You can read the details in the iDEFENSE advisory and the xine advisory.

Severity

High (arbitrary remote code execution under the user ID running the player) when playing PNM streams. At the time the vulnerability was fixed there was no known exploit.

Solution

A fix for the vulnerability was checked into MPlayer CVS on Wed Dec 15 21:27:14 2004 UTC. Users of affected MPlayer versions should upgrade to an unaffected MPlayer version. Alternatively a patch is available that can be applied to the MPlayer source tree.

Affected versions

MPlayer 1.0pre5 and before

Unaffected versions

MPlayer 1.0pre5try2 and after

History

On Fri, 10 Dec 2004 xine developers were contacted by iDEFENSE who had found two remote buffer overflow vulnerabilities in the xine PNM streaming code. Since this code is shared between MPlayer and xine, xine informed us of the problem and a fix was checked into MPlayer CVS on Wed Dec 15 21:27:14 2004 UTC.

2005-04-09, Saturday :: RTSP streaming heap overflow vulnerability
posted by Diego

Summary

iDEFENSE found a heap overflow vulnerability in the RTSP streaming code. You can read the details in the iDEFENSE advisory.

Severity

High (arbitrary remote code execution under the user ID running the player) when playing RTSP streams. At the time the vulnerability was fixed there was no known exploit.

Solution

A fix for the vulnerability was checked into MPlayer CVS on Wed Dec 15 18:16:24 2004 UTC. Users of affected MPlayer versions should upgrade to an unaffected MPlayer version. Alternatively a patch is available that can be applied to the MPlayer source tree.

Affected versions

MPlayer 1.0pre5 and before

Unaffected versions

MPlayer 1.0pre5try2 and after

History

On Fri, 10 Dec 2004 MPlayer developers were contacted by iDEFENSE who had found a remote heap overflow vulnerability in the MPlayer RTSP streaming code. A fix was checked into MPlayer CVS on Wed Dec 15 18:16:24 2004 UTC.

2005-04-09, Saturday :: MMST streaming stack overflow vulnerability
posted by Diego

Summary

iDEFENSE found a stack overflow vulnerability in the MMST streaming code. You can read the details in the iDEFENSE advisory.

Severity

High (arbitrary remote code execution under the user ID running the player) when playing MMST streams. At the time the vulnerability was fixed there was no known exploit.

Solution

A fix for the vulnerability was checked into MPlayer CVS on Wed, Dec 15 19:12:46 2004 UTC. Users of affected MPlayer versions should upgrade to an unaffected MPlayer version. Alternatively a patch is available that can be applied to the MPlayer source tree.

Affected versions

MPlayer 1.0pre5 and before

Unaffected versions

MPlayer 1.0pre5try2 and after

History

On Fri, 10 Dec 2004 MPlayer developers were contacted by iDEFENSE who had found a remote stack overflow vulnerability in the MPlayer MMST streaming code. A fix was checked into MPlayer CVS on Wed, Dec 15 19:12:46 2004 UTC.

2005-04-09, Saturday :: vulnerability in the bitmap parser
posted by Diego

Summary

iDEFENSE found a heap overflow vulnerability in the BMP demuxer. You can read the details in the iDEFENSE advisory.

Severity

Theoretical, the BMP demuxer is proof of concept code. We are not aware of multimedia content needing it. At the time the vulnerability was fixed there was no known exploit.

Solution

A fix for the vulnerability was checked into MPlayer CVS on Wed Dec 15 18:52:38 2004 UTC. Since the bitmap demuxer serves no known purpose it was removed immediately afterwards. Users of affected MPlayer versions should upgrade to an unaffected MPlayer version. Alternatively a patch is available that can be applied to the MPlayer source tree.

Affected versions

MPlayer 1.0pre5 and before

Unaffected versions

MPlayer 1.0pre5try2 and after

History

On Fri, 10 Dec 2004 MPlayer developers were contacted by iDEFENSE who had found a remote heap overflow vulnerability in the MPlayer BMP parsing code. A fix was checked into MPlayer CVS on Wed, Dec 15 18:52:38 2004 UTC. Since the bitmap demuxer was written as proof of concept and is not needed for multimedia playback it was removed immediately afterwards.

2005-02-08, Tuesday :: LinuxQuestions.org Members Choice Award
posted by Diego

2004 LinuxQuestions.org Members Choice Award

We're proud to announce that LinuxQuestions.org has held its annual Members Choice Award and MPlayer has been voted Video Multimedia Application of the Year.

MPlayer received 487 votes (49.85%), beating xine with 304 (31.12%) and Totem with 77 (7.88%).

2005-02-05, Saturday :: Brokenbox Program of the Month
posted by Diego

Brokenbox Award 2005

Hey, we've won an award from Argentina... The Argentinian Linux software site brokenbox.com.ar has elected MPlayer 1.0pre6 "programa del mes" (program of the month). Thank you!

2004-12-29, Wednesday :: MPlayer 1.0pre6 re-released
posted by Roberto

The HTML version of the documentation is missing in the pre6 release tarball. MPlayer 1.0pre6a is a repackaging of MPlayer 1.0pre6 with the missing documentation added back. Except for the DOCS/HTML directory, the two files are identical.

MPlayer and MEncoder will report 1.0-pre6 as the version number, since there are no changes in the code.

If you still haven't got pre6, grab the new pre6a tarball. Else you don't need to download it, unless you're interested in HTML docs but you can't build them yourself from the XML sources.

MPlayer 1.0pre6a can be downloaded from the following locations. Please be kind to our server and use one of our many mirrors.

MD5SUM: a812d945b884c2e2fa7f90c57cd76bff

You can send truckloads of cola at my address :-)

2004-12-23, Thursday :: MPlayer 1.0pre6 released
posted by the release team

It's been five months since our last release and boy, does it show. This is the longest changelog ever, we've been hitting the keyboards hard. So we've decided to put this out at last and bestow an X-mas present upon the world. Since X-mas is tomorrow this means you'll have to wait one day to compile this. Opening presents before their time is out of the question! And no peeking, keep those tarballs compressed! If you send in bug reports or a comment prematurely we'll know you've been a nasty kid and unpacked your present early. And you know what happens to nasty kids...

The most important changes are support for a seemingly infinite number of new codecs and important fixes for some of the old ones. The experimental wavelet-based snow video codec by Michael Niedermayer deserves a special mention. It is very promising, maybe this is what the future of video encoding looks like. We also added support for encoding to H.264 with x264 and to MP2 through toolame.

Apart from that the unbelievable has happened and all the myriad of available options are finally documented. If you cannot find it in the documentation it simply does not exist, so RTFM! If you have a slow machine you should check out low resolution decoding with libavcodec (-vfm ffmpeg -lavdopts lowres=0-3). With some luck you should be able to play DVDs and MPEG-4 movies. Mac OS X has had some nice improvements with VCD and Real/Helix codec (get new codec packages) support among others. On Windows there is a shiny new DirectSound audio output and support for the -wid option should allow building browser plugins. If you use the polypaudio sound server there is now an audio output module for you. The remaining old audio plugins have been converted to audio filters so expect audio plugins to disappear in the next release. Already gone are the old alsa9 and alsa1x audio output drivers, use alsa instead.

As usual there were too many bug fixes to mention. They are all over the place, so MPlayer should run smoother and more stable than ever. A notable one is that length and position are now displayed for MOV files as well and that MPlayer's output is slowly becoming less verbose.

The changelog is relative to MPlayer 1.0pre5try2, so all recent security fixes are included.

Merry X-mas...

MPlayer 1.0pre6: "X-mas present"

DOCS

Ports

Drivers

Decoders

Demuxers

Streaming

FFmpeg/libavcodec

Filters

GUI

Encoding

Others

MPlayer 1.0pre6 can be downloaded from the following locations. Please be kind to our server and use one of our many mirrors.

MD5SUM: 4a628f87a7070e10ffea04a1598979a9

2004-12-22, Wednesday :: Brazilian Free Community Award 2004
posted by Diego

Brazilian Free Community Award 2004

Today seems to be award day... We were just notified that MPlayer has won another award, this time from the Brazilian Linux community at br-linux.org, the "Favoritos da Comunidade Livre brasileira em 2004" (Favourites of the Brazilian Free Community in 2004) in the category "Visualizador de Vídeo" (Video Player) with 1395 votes (48%), followed by xine and Kaffeine.

If you understand Portuguese you can read the details on the award page.

2004-12-22, Wednesday :: HUP Readers' Choice Award 2004
posted by Diego

HUP Readers' Choice Award 2004

We're proud to announce that MPlayer has won the Readers' Choice Award of the Hungarian Unix Portal in the "favorite video player of the year" as well as "favorite Hungarian project of the year" category.

In the video player category MPlayer got 473 votes (89%), xine 39 (7%) and VLC 10 (1%). It's the second year in a row for MPlayer to win this award. If you understand Hungarian you can read about it on the HUP award page.

2004-12-15, Wednesday :: MPlayer 1.0pre5try2 released
posted by Roberto

Multiple vulnerabilities were discovered in MPlayer by iDEFENSE, and more were found by us while reviewing the code:

All issues affect both MPlayer 1.0pre5 and current CVS versions. MPlayer 0.93 is obsolete and was not checked nor fixed. All problems were fixed, and the BMP demuxer was also disabled because it's useless and requires further analysis to be totally safe.

To be safe from harm users of MPlayer 1.0pre5 and below should upgrade to 1.0pre5try2 or apply this cumulative patch to 1.0pre5 and not play streams over the network in the meantime. CVS users can just 'cvs update'. An updated CVS build for Windows users is also available.

Detailed advisories will follow.

MPlayer 1.0pre5try2 can be downloaded from the following locations:

MD5SUM: 724c905a8dddb7e8ec9722fc585f833d

2004-10-30, Saturday :: Linux New Media Award 2004
posted by Diego

Linux New Media Award 2004

MPlayer has won the Linux New Media Award 2004 in the category "Best Media Player". The award is organized by the Linux New Media AG and the jury consists of about 150 respected community members.

MPlayer got 29.8% of the votes, beating xine (24.2%) and XMMS (23.4%) making this the second win in a row. Detailed results can be found on the German award page.

2004-09-02, Thursday :: MPlayer at SUCON '04
posted by Diego

The MPlayer team will be represented at SUCON '04 by at least Alex Beregszaszi, Roberto Togni, Jonas Jermann and Diego Biurrun. SUCON is the Swiss Unix Conference held September 2-4, 2004 at the Technopark in Zürich, Switzerland. From the description at their homepage:

SUCON is a emerging conference focused on topics related to the Unix operating system. Our goal is to bring together developers, system administrators and users in the field of Unix to foster projects, ideas and the knowledge of every individual.

Alex will give a talk about MPlayer on Friday, so if you are interested in MPlayer or would like to meet some of us and happen to be in the area, drop by.

Update

Also present are Mike Melanson from xine and Samuel Hocevar from VideoLAN. They will be giving presentations as well and we will all be holding a multimedia birds-of-a-feather session together on Saturday.

Update 2

Some recorded talks have been made available. The talks by Mike Melanson and Alex Beregszaszi are among them.

2004-07-23, Friday :: Hard drive donation needed
posted by Diego

One of the hard drives in our project server is failing and needs to be replaced. Since it is part of a RAID1 array and performance suffers a lot when running RAID1 with different geometry drives we need either the same model as replacement or two new IDE drives. The drive is an IBM IC35L040AVER07-0 40GB IDE drive.

If you have such a drive or a pair of new drives lying around or are willing to buy it for us, please contact our admin Arpad Gereöffy and send the drive to him.

Update

We have received a DTLA305040 in donation from Stefan Seyfried (Thank you!) and Sascha Sommer exchanged it for his IC35L040AVER07, which is now in the project server. Also many thanks to the other people who offered help.

2004-07-15, Wednesday :: MPlayer 1.0pre5 released
posted by the release team

Once again after a long delay we are proud and happy to present you our latest release. Tons of new features and bug fixes were included, many during a big hacking session at LinuxTag 2004. The pending patch queue has been greatly reduced and as usual we expect to make the next release in a more timely fashion ;-)

Since you already know about the name change the most important change is the security relevant string handling code audit. Read the details in the relevant advisory. If you haven't upgraded to a CVS snapshot already, upgrade to pre5 now.

Highlights of this release include improved Mac OS X and Windows support, improved seeking in Real files, better MEncoder documentation with an updated DVD ripping guide, streaming related bug fixes, fullscreen bug fixes, a new unified ao_alsa ALSA audio output driver to replace ao_alsa9 and ao_alsa1x, a JACK audio output driver and new icons for the GUI and menus. Of course we also did the usual stuff like support for more codecs, new video filters and bug fixes all over the place.

The codec packages have been updated and they now sport version numbers so you can easily tell whether you have the latest one or not. Grab them if you are interested in complete codec support.

Have fun...

MPlayer 1.0pre5: "LinuxTag release"

Name

Security

DOCS

Ports

Drivers

Decoders

Demuxers

Streaming

Filters

FFmpeg/libavcodec

Others

MPlayer 1.0pre5 can be downloaded from the following locations. Please be kind to our server and use one of our many mirrors.

MD5SUM: fbe6919eb025526e8ed129cd61a49969

2004-07-09, Wednesday :: MPlayer 0.93 released
posted by Diego

This is a security only update for our outdated stable branch. It contains a simple port of the fixes for the recent GUI remote buffer overflow vulnerabilities committed to the main MPlayer source tree. This was done without a complete audit of the 0.90 branch of our code base due to a lack of resources.

The 0.90 branch is long obsolete, there will be no further releases, probably not even security fix releases. Therefore we strongly recommend upgrading to MPlayer 1.0pre5 once it becomes available or a current CVS snapshot.

MPlayer 0.93

Security:

MPlayer 0.93 can be downloaded from the following locations:

MD5SUM: 2ddd395cd1bc56559006398ef5105710

2004-07-01, Thursday :: remote buffer overflow vulnerabilities in the GUI code
posted by Diego

Summary

Multiple string vulnerabilities have been found and fixed in the MPlayer GUI code, at least one of which was remotely exploitable.

Severity

High (arbitrary remote code execution under the user ID running the player) if using the GUI to play certain types of playlist files, none when using only the command line. The MPlayer GUI is optional and not built by default.

Solution

A fix for the vulnerability with the known exploit was checked into MPlayer CVS on Wed, 2 June 2004 12:40:41 +0000 (UTC). The result of a thorough code audit that uncovered further potentially exploitable bugs was checked into MPlayer CVS on Fri, 25 June 2004 16:49:52 +0000 (UTC). All of this will be included in MPlayer 1.0pre5. Users of affected MPlayer versions should upgrade to latest CVS or MPlayer 1.0pre5 once it becomes available. Alternatively a patch for the main and 0_90 MPlayer CVS versions is available that can be applied to the MPlayer source tree.

Affected versions

MPlayer 1.0pre4 and before
MPlayer 0.92.1 and before

Unaffected versions

none

History

On Tue, 1 June 2004 MPlayer developers were contacted by c0ntex who had found a string handling vulnerability in the MPlayer GUI code complete with an example exploit and a preliminary fix. That fix was checked into MPlayer CVS on Wed, 2 June 2004 12:40:41 +0000 (UTC).

When playing certain types of playlist files with extremely long entries a buffer overflow error occurs. This allows an attacker to overwrite memory with specially crafted playlist files and execute arbitrary code under the user ID running MPlayer.

Richard Felker started a general audit of the GUI code for further string handling problems and uncovered a host of potential bugs, some of which were probably exploitable. Nicholas Kain proceeded to do a full audit of the MPlayer code for insecure string handling, which was finished by Alexander Strasser. The result of this audit was checked into MPlayer CVS on Fri, 25 June 2004 16:49:52 +0000 (UTC).

Since the first quick review of the GUI code immediately revealed several potentially exploitable bugs we have refrained from publishing this advisory until a thorough audit of the whole code was finished.

On Thu, 1 July 2004 11:22:29 (UTC) a simple port of the fixes was committed to the 0_90 stable MPlayer source tree. This was done without a further audit of the 0_90 code base due to lack of resources. We have therefore dropped further support of the 0_90 tree and recommend upgrading to MPlayer 1.0pre5 or latest CVS.

Download

MPlayer 1.0pre5, 0.93 and CVS snapshots can be downloaded from the MPlayer homepage or one of its many mirrors as soon as they become available. Go to the MPlayer download page to get MPlayer 1.0pre5 source code or a CVS snapshot.

2004-06-25, Friday :: MPlayer name change
posted by Diego

No, it's still MPlayer ;-).

But since we run on so many different operating systems now we thought that

MPlayer - The Movie Player For Linux

is not really a fitting name any longer. So from now on it will be just

MPlayer - The Movie Player

The king is dead - long live the king!

2004-06-24, Thursday :: Software Patents
posted by Alex

Your video player is... PATENTED (in the USA)

Demonstration against Software Patents in Karlsruhe, the city of LinuxTag with some developers and advocates of MPlayer. Read more at the FFII page.

2004-06-02, Wednesday :: MPlayer at LinuxTag 2004
posted by Diego

LinuxTag logo

The MPlayer team will be represented at LinuxTag 2004 by at least Alex Beregszaszi, Sascha Sommer and Diego Biurrun. LinuxTag is a mix between trade show and conference about Linux and free software for both companies and projects. It is held in Karlsruhe, Germany, from the 23rd to the 26th of June. We will have a booth in the projects area and be present for the full four days. Hopefully we will also be able to hold a small conference with as many developers as possible. If you ever wished to have a chat with us, that would be the perfect opportunity.

2004-04-28, Wednesday :: Exploitable remote buffer overflow vulnerability in the Real RTSP streaming code
posted by Diego

Summary:

Multiple vulnerabilities have been found and fixed in the Real-Time Streaming Protocol (RTSP) client for RealNetworks servers, including a series of potentially remotely exploitable buffer overflows. This is a joint advisory by the MPlayer and xine teams as the code in question is common to these projects. The xine team has assigned ID XSA-2004-3 to this security announcement.

Severity:

High (arbitrary remote code execution under the user ID running the player) when playing Real RTSP streams. At this time, there is no known exploit for these vulnerabilities.

Prerequisites:

The players are only vulnerable when playing Real RTSP streams. There is no risk if Real RTSP (realrtsp) streaming is not employed.

Solution:

A fix was checked into MPlayer CVS on Sat, 24 Apr 2004 12:33:22 +0200 (CEST). This fix is included in MPlayer 1.0pre4. Users of affected MPlayer versions should upgrade to MPlayer 1.0pre4 or later. Alternatively a standalone patch is available that can be applied to the MPlayer source tree.

xine-lib fix was checked into CVS on Fri, Apr 23 21:59:04 2004 UTC. This fix is included in xine-lib 1-rc4. Users of affected xine-lib versions should upgrade to xine-lib 1-rc4 or later. If this upgrade is not feasible for some reason, the vulnerable code can be disabled by removing xine's RTSP input plugin, which is located at $(xine-config --plugindir)/xineplug_inp_rtsp.so. If installed with default paths, that is: /usr/local/lib/xine/plugins/1.0.0/xineplug_inp_rtsp.so This workaround disables RTSP streaming.

Affected versions:

MPlayer 1.0pre1-pre3try2
xine-lib 1-beta1 to 1-rc3c

Unaffected versions:

MPlayer 0.92.1 and below
MPlayer 1.0pre4 and above
MPlayer CVS HEAD

xine-lib 1-beta0 and below
xine-lib 1-rc4 and above
xine-lib CVS HEAD

History / Attack Vectors:

On Thu, 22 Apr 2004 Diego Biurrun found a crashing bug in the MPlayer realrtsp code that Roberto Togni confirmed to be a buffer overflow vulnerability later that day. The xine team was notified and independent code audits were performed by Miguel Freitas (xine) and Roberto Togni (MPlayer), revealing multiple vulnerabilities.

  1. Fixed length buffers were assigned for the URL used in server requests and the length of the input was never checked. Very long URLs could thus overflow these buffers and crash the application. A malicious person might possibly use a specially crafted URL or playlist to run arbitrary code on the user's machine.
  2. Not all strings returned from a Real server were checked for length. It might be possible to cause a buffer overflow during the RTSP session negotiation sequence. A malicious person could use a fake RTSP server to feed the client with malformed strings.
  3. Packets of RealNetworks' Real Data Transport (RDT) format were received using a fixed length buffer whose size was never checked. It might also be possible to exploit this by emulating a RealNetworks' RTSP server.
  4. On Wed, 14 Apr 2004 22:45:28 +0200 (CEST) a change was made to MPlayer CVS that removes the extension checking on RTSP streams. MPlayer now attempts to handle every RTSP connection as realrtsp first, falling back to live.com RTSP. CVS versions from that date to the time the fix was checked in are susceptible to the same problem when playing normal RTSP streams as well.
  5. At the time of the writing of this advisory no real exploits are known to the authors and we hope to be the first to stumble across this vulnerability. Since we believe that the bugs described in this advisory are exploitable we have released this proactive advisory.

Download:

MPlayer 1.0pre4 can be downloaded from the MPlayer homepage or one of its many mirrors. Go to the MPlayer download page to get MPlayer 1.0pre4 source code.

xine-lib 1-rc4 can be downloaded from the xine homepage.

2004-04-28, Wednesday :: MPlayer 1.0pre4 released
posted by the release team

A long time has passed without a release and really a lot has happened. Between the KiSS affair and the farewell of some developers one might almost get the impression that not much development has been taking place. Indeed there have been many internal changes. Alex Beregszaszi (who has been the maintainer since 0.90rc3) is now supported by a team of maintainers, making this the first real team release of MPlayer. To reflect that we are also presenting the site in a new design. If you thought about helping us out in building the fastest and most flexible video player, now would be the perfect moment to join our team, just come and join us on our mailing lists and IRC channels. We can use not only coders but also documenters and people that want to help us out with the many details that have to be taken care of to make such a big project a success. But if you thought MPlayer development was stalled, just have a look at the huge changelog.

We fixed a remotely exploitable security vulnerability in the Real RTSP code, please read our advisory for details. Many thanks go to the xine team for cooperating so well with us in the audit of this shared code. We also found a buffer overflow in the Matroska demuxer and in the CDDB code, so we strongly urge you to upgrade.

Apart from that there are so many changes it gets hard to pick out the highlights.

As usual the documentation has been improved and extended and our many ports have been improved. The BSDs are getting closer and closer to the Linux version, Mac OS X and PowerPC users will enjoy as much as a 100% speed improvement through many AltiVec optimizations and a native Quartz (Mac OS X) output driver. The Windows version of MPlayer is shaping up to be an equal contender to the Unix versions, grab and spread it.

If you had problems with streaming in the past this may be the release for you. We fixed tons of bugs and added support for SMIL playlist to Real streaming and now support Nullsoft Streaming Video (NSV)

With (experimental) AVI OpenDML read and write support we have knocked a longstanding item from the wishlist. Now is the time to play and create huge AVI files.

Our video filter system has been extended by no less than seven filters and is thus more flexible than ever.

If you are an oldschool text mode addict and like ASCII art output you can now enjoy it in full color with the caca output driver.

On the codec front we now support XviD 1.0, VP5 and VP6 and the existing codecs have been improved and optimized. Accordingly the codec package has been extended by a few DLLs, don't forget to grab a new one.

As usual we would be nothing without FFmpeg and the many native codecs they provide. FLAC among others has joined their long list of supported codecs and the rest has seen notable speed and quality improvements.

Enjoy...

MPlayer 1.0pre4: "YAML Counter"

Security:

DOCS:

Ports:

Demuxers:

Streaming:

Decoders:

Filters:

Drivers:

FFmpeg/libavcodec:

Others:

MPlayer 1.0pre4 can be downloaded from the following locations:

MD5SUM: 83ebac0f05b192516a41fca2350ca01a

Grab the Windows port from here: http://www.mplayerhq.hu/MPlayer/releases/win32/

Also don't forget to visit the downloads page for the updated codec pack!

2004-04-26, Monday :: New ways of communication
posted by Alex

Since a while, MPlayer has two official IRC channels on the freenode network:

2004-04-23, Friday :: Resurrection
posted by Alex

After two (nowadays not so active, but valuable) developers leaving the project (both of them posting an unneeded news article about it), one could think it's almost dead now. This assumption is false, other developers are still active, but busy with work.

Be prepared for a new tech release!

Just for clarification: I say 'unneeded news article', because many developers left already without news entries and more joined the project after them.

2004-04-23, Friday :: Say NO to software patents - Bruxelles 2004
posted by Alex

The FFII has organized a demo this year just like the one in 2003.

The MPlayer project is proud to be a part of the conferences: Diego Biurrun and myself have been there and talked about patents and the KiSS issue with known and great authorities, such as Alan Cox and George Greve (President of FSF Europe).

As a report, read this post from Diego.

2004-04-23, Friday :: Leaving
posted by Gabucino

I've decided to leave the MPlayer project. Personal thanks go to:

Farewell.

2004-03-30, Tuesday :: Exploitable remote buffer overflow vulnerability in the HTTP parser
posted by Gabucino

Severity:

HIGH (if playing HTTP streaming content)
LOW (if playing only normal files)

Description:

A remotely exploitable buffer overflow vulnerability was found in MPlayer. A malicious host can craft a harmful HTTP header ("Location:"), and trick MPlayer into executing arbitrary code upon parsing that header.

affected MPlayer versions:

MPlayer 0.90pre series
MPlayer 0.90rc series
MPlayer 0.90
MPlayer 0.91
MPlayer 1.0pre1
MPlayer 1.0pre2
MPlayer 1.0pre3

unaffected MPlayer versions:

MPlayer releases before 0.60pre1
MPlayer 0.92.1
MPlayer 1.0pre3try2
MPlayer 0_92 CVS
MPlayer HEAD CVS

Notification status:

Developers were notified on 2004-03-29 (by "blexim")
Fix was commited into HEAD CVS at 2004-03-30 12:58:43 CEST
MPlayer 0.92.1 (vuln-fix-only release) was released on 2004-03-30 16:45:00 CEST
MPlayer 1.0pre3try2 (vuln-fix-only release) was released on 2004-03-30 16:51:00 CEST

Patch availability:

A patch for all vulnerable versions is available.

Suggested upgrading methods:

MPlayer 1.0pre3 users should upgrade to latest CVS.
MPlayer 0.92 (and below) users should upgrade to 0.92.1 or latest CVS.

MPlayer 0.92.1 (PGP signature) (MD5 checksum) can be downloaded from the following sites:

MPlayer 1.0pre3try2 (PGP signature) (MD5 checksum) can be downloaded from the following sites:

2004-03-26, Friday :: Leaving MPlayer
posted by A'rpi

I (A'rpi) already left MPlayer G1 a year ago, when 0.90 was released. This is not YAML (Yet Another Mplayer Leaving :)), I left G1 dev to work on MPlayer G2. Now I'm leaving the whole MPlayer project, including G2 development and all the rest, except for MPHQ server administration (for technical reasons). I did not read mplayer lists (any) since months (except for a few mails pointed to me), and I lost the rest of my interest towards MPlayer development.

About G2, my primary reason of giving up on it was the dual licensing issues, discussed recently on the g2-dev list. My opinion about GPL was proven again, ie. it doesn't protect us against code stealing (see the KiSS issue for example), while it keeps project sponsors and companies away. I wanted to make G2 to be usable by any program as the standard linux media lib/API, but GPL is too strict for this, and all other license options were immediately refused by all other (potential) G2 developers. Of course G2 can be written as free GPL software (free as RMS:)) too, but it will took long, and I have no interest to participate.

What's now with me? I'm back to some of my old projects, like AMC, and I've started a new project about heuristic email virus scanning, called pymavis.

2004-03-10, Wednesday :: Radio interview with Pontscho
posted by Gabucino

The hungarian Tilos Radio's Speedlight program has made a live interview with Zoltán Ponekker (Pontscho), one of the MPlayer founders who has developed significant parts of MPlayer, most notably the GUI (Graphical User Interface).

Download the interview here (Hungarian): 1. part | 2. part | 3. part |

2004-03-06, Saturday :: Softonic Multimedia Award Won
posted by Gabucino

Softonic Award 2003

Thanks to our fellow users, we've won another award, this time it is Softonic's "Mejor Reproductor de Vídeo" trophy.

Thanks for the support!

2004-01-26, Monday :: MPlayerHQ server update: moved to SCSI disks
posted by Arpi

Thanks to the great donations by Charlie (Adaptec 29160 controller) and Lupin III (2 x 36GB 10krpm disks), we could finally move OS and data (mailing lists, cvs, web etc) to SCSI base, hopefully solving the continous stability issues we had with those old IBM IDE disks since December. It should also improve speed and reaction time of the server.

Anyway we still have a small problem: the disks have 80-pin (SCA) connectors, and the 80-to-68pin converters I could buy here don't work in LVD mode, thus limiting bandwith to 40Mb/sec (SE mode). It should be enough for our current needs, but if you have 2 pieces of spare LVD-capable 80/68 converters, don't hesitate to donate! :)

2004-01-19, Monday :: HUP Reader's Choice Awards 2003
posted by Alex

HUP Reader's Choice Awards 2003

2003 seems to be the year of MPlayer. Yet another award we got!

The Hungarian Unix Portal - the biggest Hungarian free software site - promoted it's first Reader's Choice Awards in November 2003. Members could vote starting on 19th November 2003 until the 20th December 2003.

For the people, who don't speak Hungarian, here are the results:

  1. MPlayer (96%)
  2. xine (2%)
  3. VideoLan and avifile - head to head

The Hungarian speaking minority could visit the portal: article about the winners.

2004-01-18, Sunday :: LinuxQuestions.org Members Choice Award
posted by Diego

2003 LinuxQuestions.org Members Choice Award

LinuxQuestions.org has finished voting for its LinuxQuestions.org Members Choice Award and MPlayer has been voted Multimedia application of the Year.

MPlayer received 44.61% of the votes, beating XMMS with 27.90% and xine with 17.40%.

2004-01-15, Thursday :: Mailing lists problem
posted by Arpi

Thanks to the serie of IDE HDD crashes we've got in past weeks, some of the mailman config/user databases got corrupted.

Especially the MPlayer-G2-dev list, which is uncorrectable, so I've re-created the list today, and subscribed everyone again, at least who subscribed until Aug 15 this year. I have no info about member (un)subscribes past that date, as I've disabled the notification. Please verify your membership and settings!

Since the MPlayer-users list also got somehow corrupted, several people reported that they either stop receiving mail or begin to receive them again despite of their are no longer member (they've already unsubscribed). Anyway this list has over 1500 members, many of them with broken (bouncing) addresses.

Update:

So, to clean things up, I've created an mplayer-newusers list, but Attila Kinali suggested a better method: send a mail asking everyone at mplayer-users to subscribe again, mass unsubscribe everyone, and then re-create the list.
So, you have to subscribe again, even if you were already subscribed: SUBSCRIBE.

2004-01-10, Saturday :: Radio interview: KiSS VS MPlayer
posted by Gabucino

The Danish National Radio (http://dr.dk) has made an interview with me (as MPlayer representative), and KiSS Technology's managing director Peter Wilmar Christensen.

It is going to be broadcasted tonight at 20:35, but it is also downloadable from the Internet right now:

A written article is also available, in Danish.

We have made a rough english translation of the session (thanks to Anders Rune Jensen). Our commentaries can be found at the bottom.

Speaker:
The development of MPlayer was started by a little group of Hungarian programmers 3 years ago.
Speaker:
We needed a program that could play media files under Linux and were so unsatisfied with the existing choices that we started making a better alternative - said Gabucino, the spokesperson for the MPlayer programmers.
Speaker:
MPlayer has reached a wide recognition in the Open Source community. Gabucino emphasizes the program's stability and ability to play many different movie formats as some of the obvious advantages.
Speaker:
The trouble with KiSS technology started recently when one of the MPlayer developers was shopping for a new DVD player and went for a product by the Danish company. For fun the programmer started looking at the software in the Danish DVD player, the so called firmware, and compared it with MPlayer's own code. There were enough similarities to take a closer look at the case and make the MPlayer team angry - Gabucino said.
Speaker:
The specific part of the code in which the similarities are found is the one controlling the subtitles when playing movies. The reality is that the code doesn't contain anything really brilliant. On the contrary, it's very simple. So Gabucino is puzzled why anyone would even bother using the code instead of writing it themselves. He suggests that it could be laziness on the programmer's side.
Speaker:
I think it's actually a very normal thing that programmers borrow Open Source code because they are too lazy to write it themselves. There have been some cases prior to this which have caused quite a lot of trouble. I think there are hundreds of examples like this that we just don't hear about - Gabucino said.
Speaker:
The MPlayer team has published the accusation of the code theft on their website and has tried to document it by listing the strings in the code which are identical in the two pieces of software. According to Gabucino, there are so many similarities that it's unthinkable that this might be a coincidence.
Speaker:
Normally this type of code is different depending on who implemented it, so, when there are so many identical strings, it's obvious that we're dealing with theft, the Hungarians believe.
Speaker:
GPL or General Public License which MPlayer is licensed under is a very widely used Open Source license, which gives the users certain rights and certain duties. Long story short, it is okay to take the code from MPlayer and develop it further, as long as the result is given back to the community. In this specific example Gabucino and the other Hungarians therefore demand that KiSS Technology should release the software used in its DVD players. And makes it clear that it is not a matter of getting some money from the Danish company, but a matter of fulfilling the requirements of the GPL and releasing the software.
Speaker:
KiSS Technology at first didn't react to the Hungarians' inquiry, but after the story began to get large publicity in the different net-medias and forums the company began to investigate the case this week. There are two main questions: whether code from MPlayer really is inside the KiSS software and how the licenses of Open Source software should be interpreted and applied. Apart from being accused of taking code from MPlayer, KiSS Technology has also been accused of using other Open Source software, but managing director Peter Wilmar Christensen denies all accusations with small requisitions. The DVD player from KiSS uses a modified version of Linux as its operating system and that part of the software has been released in accordance with the licenses. But KiSS proclaims that the programs used in the machines on top of the operating system, which enables them to play video and music files are the company's own and therefore are not required to be released, the managing director Peter Christensen explains.
Peter:
I would say that the is no truth to the accusations. In large there has been some interest regarding our applications recently and around GPL, which is the software used in the Open Source community which requires you to publish the source code if you use it. And there has been some interest in some of the programs used on our DVD players. Something called libmad and libjpg and than this Hungarian company MPlayer. On our DVD players we run Linux which is licensed under the GPL, we have on our webpage published the operating system so that people can download the improved version of Linux that we use. The application layer on top of Linux is proprietary and is not based on any GPL code. We doesn't use MPlayer, we use our own player, a player like we know from Real Player, Microsoft Media Player is the application used to display movies. It is a fundamental thing for our player, because it's what we are known for, being able to play a wide range of different formats.
Speaker:
The documentation the Hungarians has presented on their website is parts from your code. By simply comparing the strings line for line and concludes that they are so identical that this can be no coincidence. What is your comment on this?
Peter:
We are currently investigating exactly that specific part, how that can be and if it's really true what they say. Currently we have not investigated it enough to be sure whether or not they are right or wrong in their accusations. What is important is that we do not use their application (Of course, only the subtitle reader! - Gabucino). Should there be cases where the code is very much alike, we have to look at how that could have happened. But we doubt that there is any truth to the accusations. There are a lot of things that could have happened, one could imagine that code from our community has spread to other communities included the Open Source and code originating from our player could accordingly be a part of MPlayer, if in fact there are any similarities. It can be hard to tell how those similarities have supposedly appeared. What is important is that we do not use their application. If there are a few identical lines then one might ask themselves how that has happened. But it could have just as well come from one side as from the other. In any case, we are under no circumstances of the opinion that we have borrowed code.
Speaker:
Whoever made the code for subtitles in the Hungarian software and in the Danish DVD players can be thought of as a minor issue in today's world. But what is important is the matter of principles in this specific issue and what private companies can allow themselves when they use Open Source and on the other hand what the Open Source community can expect from the companies. Because of the current case, managing director Peter Wilmar Christensen has had a closer look at the GPL license and evaluated its legal status.
Peter:
We have confirmed what we already knew, that when using code licensed under the GPL then we have to publish any derivative work. This means that the legal foundation is very thin and there is no place in the world that I know of where the GPL has been tested in court. So from a business perspective I would say that the license is relatively weak. This doesn't change the fundamental spirit in the Open Source community which I think - all in all - is positive. But it is clear that as a commercial company living off selling its product, can not and will not release its proprietary code. It is naturally so that one should not use GPL code in proprietary systems.
Speaker:
According to Gabucino, the Hungarian software developers of MPlayer are glad that their accusation against the Danish company has reached the media.
Speaker:
As he said, there are no big economical options for dragging the case to court. Instead they hope that the Open Source community will put so much pressure on KiSS Techonology that they will be forced to release all its software.
Speaker:
But that is completely out of the question, said the managing director Peter Wilmar Christensen, even though he is very keen on staying good friends with the Open Source community.
Peter:
We don't have any intentions of working against or in another way make enemies with the people in this community. We try to tell what we use and what guidelines we follow. Have we made any error, such as making incorrect descriptions in our manuals then we will of course fix those things. It is not so that we in any way want confrontation, but we have to make a clear statement that our software will not be released as Open Source.
Speaker:
What is your conclusion of this case, what will it be after this?
Peter:
The conclusion will be that the licenses in this area are a good description of how one ought to operate within this community. They're more of a tool to describe how to operate than a set of rules that can be used in court. And I think that the Open Source circles uses far too much energy on hunting down private companies like us for instance, because it's so obvious that one as a private company simply can't release your source code. We appreciate the Linux community very much and see it as a good thing for the industry. Generally that there is an alternative to the Microsoft community. But we think that the community should respect the companies who use Linux and not hunt them because I don't think that's beneficial for anyone.

END OF TRANSLATION

Gabucino's comments: I find it quite disgusting to read so much plain lies. It's obvious how companies like KiSS or SCO treat open source. Let's read these particular sentences again:

Peter:
...There are a lot of things that could have happened, one could imagine that code from our community has spread to other communities included the Open Source and code originating from our player could accordingly be a part of MPlayer, if in fact there are any similarities. It can be hard to tell how those similarities have supposedly started. What is important is that we do not use their application. If there are a few identical lines then one might ask themselves how that has happened.

It's quite clear that they've never read our News section, because we hurried to state they've even stolen our own subtitle file format MPsub (see our specifications).

Its idea was mine, then I asked laaz if he would be so kind as to implement it in MPlayer. Then in 2001 October 12 at 13:51:58 he commited the support, as can be seen here. The format was never spotted in the wild.

Several things can be concluded:

  1. Mr. Christensen never took the time to read our announcements.
  2. Mr. Christensen suggest they've implemented our subtitle format way before we did it ourselves. The KiSS firmwares are all made in 2003, which is - as far as I know - a way later year than 2001.
  3. Mr. Christensen doesn't have the slightest clue about what software his company is using.
  4. KiSS Technology has strange interpretation problems with some sentences, like "...We don't have any intentions of working against, or in another way make enemies with the people in this (Open Source) community."

Actually we can picture a quite nice representation of their viewpoint, especially after seeing their unwillingness to start a conversation with us in E-Mail. KiSS Technology's views are:

  1. "...making our source open to public is out of question"
  2. Pressing Microsoft (or Bush)-style PR, like repeating their own lies, emphasized again and again: "What is important is that we do not use their application."
  3. Spreading FUD: "It can be hard to tell how those similarities have supposedly started." Ever heard of version control systems?
  4. Holding good communiqe with the Open Source community: "If there are a few identical lines then one might ask themselves how that has happened. But it could have just as well come from one side as from the other..." The pitful aspect of this is that it implies a totally ignorant viewpoint, like 'our sources are ours, it's completely obfuscated, but yes, our claims are the truth, yours are plain lies'

How come companies like KiSS cant'be punished by Law?

2004-01-07, Wednesday :: Update on KiSS Technology
posted by Gabucino

The binaries in KiSS Technology's newer firmwares doesn't seem to contain our strings at the first sight. First we though they are encrypted, or obfuscated in some other way, like an executable packer. Actually these new files are simply compressed with gzip. Decompressing them is very simple:

dd if=fileplayer.bin bs=64 skip=1 | gunzip > fileplayer.bin.decomp

The strings are still there. Nothing has changed.

Downloads:

2004-01-03, Saturday :: Another stolen software in KiSS firmware
posted by Gabucino

It has been brought to my attention, that the now famous KiSS Technology - already in violation of the GNU General Public License - has been confirmed stealing another program which is also completely under the GPL license.

The software in question is the high-quality MPEG audio codec, MAD (libmad). This codec is used by a lot of other audio players, like mpg321, a command line MP3 player found in most Linux distributions - including Debian.

The strings from the KiSS firmware (matching libmad sources), can be viewed - but you can also check it for yourself, it's really easy.

And if you do: don't be surprised when you run into more strings - which match libjpeg's.

2004-01-03, Saturday :: KiSS Tech comment
posted by Gabucino

Before I get another 10 mails about this: the GPL.ZIP file which they offer for download on their site contains only the Linux kernel and busybox sources, not MPlayer's!

Thanks.

2004-01-02, Friday :: Another GPL violation: KiSS Technology
posted by Gabucino

Basically KiSS Technology is specialized in particular kinds of media hardware, namely DVD and MPEG-4 players, set-top-boxes, and such.

There is nothing wrong with that.

However, if a careless user initiates a string search in one of their firmwares:

$ strings KiSS_DP-508_FW2.7.4_PAL.iso | grep -A 3 -B 6 MPSub
Microdvd
Subrip
Subviewer
Sami
Vplayer
Unknown
MPSub
Subviewer 2.0
Subrip 0.9
Jacosub

Running the same command on the MPlayer binary:

$ strings /usr/bin/mplayer | grep -B 8 mpsub -A 4
<...>
L>microdvd
subrip
subviewer
sami
vplayer
dunnowhat
mpsub
subviewer 2.0
subrip 0.9
jacosub
<...>

You can also check the subreader.h or the subreader.c files in MPlayer sources.

As you can see, the KiSS firmware contains the subtitle formats in the very same order as we do. The thing that really catches the eye is the MPSub format, which is our own subtitle format, which hasn't been used anywhere else so far.

Another nice nit is the "dunnowhat" AKA "unknown" subtitle format, whose name remains unknown for us - thus the naming. It's the same in KiSS' files.

This of course is hardly enough for a proof. What really makes it a one hundred percent stealing is quite obvious: the sscanf() calls which contains the patterns of the subtitle formats known to the subtitle parser, in order to identify the chosen subtitle file.

Let's take an easy example: 


$ strings fileplayer.bin
<...>
<SAMI>
%d:%d:%d.%d %d:%d:%d.%d
@%d @%d
%d:%d:%d:
%d:%d:%d
Dialogue: Marked
%d,%d,"%c
FORMAT=%d
FORMAT=TIM%c
-->>
<...>


$ strings subreader.o
<...>
<SAMI>
%d:%d:%d.%d %d:%d:%d.%d
@%d @%d
%d:%d:%d:
%d:%d:%d
Dialogue: Marked
Dialogue:
%d,%d,"%c
FORMAT=%d
FORMAT=TIM%c
-->>
<...>

These are the patterns we use to identify a SAMI subtitle file. We have one more pattern in our parser, which was commited on 2003 July 20, in effect of supporting a new subtitle format, called "ASS". KiSS Tech's files are missing this one, so they must have lifted our code before that date.

Let's see another:

$ strings fileplayer.bin
<...>
<%*[tT]ime %*[bB]egin="%d.%d" %*[Ee]nd="%d.%d"%*[^<]<clear/>%n
<%*[tT]ime %*[bB]egin="%d.%d" %*[Ee]nd="%d:%d.%d"%*[^<]<clear/>%n
<%*[tT]ime %*[bB]egin="%d:%d" %*[Ee]nd="%d:%d"%*[^<]<clear/>%n
<%*[tT]ime %*[bB]egin="%d:%d" %*[Ee]nd="%d:%d.%d"%*[^<]<clear/>%n
<%*[tT]ime %*[bB]egin="%d:%d.%d" %*[Ee]nd="%d:%d.%d"%*[^<]<clear/>%n
<...>

$ strings subreader.o
<...>
<%*[tT]ime %*[bB]egin="%d.%d" %*[Ee]nd="%d.%d"%*[^<]<clear/>%n
<%*[tT]ime %*[bB]egin="%d.%d" %*[Ee]nd="%d:%d.%d"%*[^<]<clear/>%n
<%*[tT]ime %*[bB]egin="%d:%d" %*[Ee]nd="%d:%d"%*[^<]<clear/>%n
<%*[tT]ime %*[bB]egin="%d:%d" %*[Ee]nd="%d:%d.%d"%*[^<]<clear/>%n
<%*[tT]ime %*[bB]egin="%d:%d.%d" %*[Ee]nd="%d:%d.%d"%*[^<]<clear/>%n
<...>

These are the patterns we use to identify an RT subtitle file.

Every single one of their patterns match ours! This is not coincidence. This is stealing GPL code into a proprietary product! KiSS Technology failed to answer our inquiry for their source files (which they are obligated to provide), so this news entry is posted.

Downloads:

2003-12-19, Friday :: MPlayer with libcaca
posted by Gabucino

libcaca is basically a colored variant of aalib. Although being alpha, it looks very nice. Some better output drivers, and optimizing is needed, tho.

libcaca screenshot
Shot from "Üvegtigris"

MPlayer is yet to support libcaca directly, but with the following patch, the -vo sdl:caca MPlayer option will enable caca video output (if it's monochrome, check the TERM enviroment variable).

The patch for the vanilla SDL 1.2.6 can be downloaded here: patch-SDL-1.2.6-deb-caca.diff.bz2

2003-12-18, Thursday :: MPlayerHQ OS change to Slackware
posted by Gabucino

From December 17 14:30 until early this morning, our main server has undergone an OS reinstall (not winXP). The Debian Woody to Slackware transition did not have much effect on the CVS service, but the HTTP, FTP and mail services have suffered slight downtimes. We had several reasons for the reinstall:

  1. MPlayerHQ was cracked on November 16 17:50, but noticed 10 minutes later due to some hidden traps. Possibly due to recent lame Linux kernel vulnerability (greetz to kernel devs for not publishing details much earlier).
  2. The old OS was installed 3 years ago, so time to clean up the mess
  3. Debian sucks - that's the opinion of most of the core developers
  4. Mailing migrated from sendmail+qmail combination to a single postfix installation

For further information, read the mail of A'rpi.

2003-12-09, Tuesday :: MPlayer 1.0pre3 second try
posted by Alex

A huge bug slipped into the release. Pre3 won't compile on big-endian machines (such as ppc, sparc and m68k).

Timeline:

2003-12-09 05:24 GMT: the bug was discovered
2003-12-09 09:15 GMT: committed the fix into CVS
2003-12-09 10:00 GMT: our FTP site contains the updated tarballs

Grab the tarballs from the usual locations, only users of big-endian machines should update.

MD5SUM: 998becb79417c6a14d15c07e85188b82 MPlayer-1.0pre3.tar.bz2

2003-12-09, Tuesday :: MPlayer 1.0pre3 "The Real Counter" released
posted by Gabucino

Well it's been a while, and we're back in business with a (guess what) new prerelease. Now with Windows Media Player skin support. Ok just joking. But the ChangeLog is still very long, actually just thinking about inserting it and writing all those HTML tags feels tiresome.

I'd like to emphasize our newest reverse engineered codec: RealVideo 2.0 (RV20), with B frames support! Time to move on to RV30.. ;)

SiS video card users are going to be very pleased with the new sis_vid Vidix driver! Check out the documentation! Oh, and by the way: the nvidia_vid driver also got hell a lot of bugfixing, doublebuffer support for Geforce2, etc etc...

No doubt many ppl will celebrate one of the new MEncoder features: the ability to encode the output audio stream with libavcodec!

Don't hold your breath for even another moment, ChangeLog falls upon thee from the heavens:

MPlayer 1.0pre3: "The Real Counter"

DOCS:

Ports:

Codecs and demuxers:

Filters:

FFmpeg/libavcodec:

Drivers:

SWScaler:

Others:

MEncoder:

MPlayer 1.0pre3 can be downloaded from the following locations:

2003-11-25, Tuesday :: Linux New Media Award 2003
posted by Diego

Linux New Media Award 2003

MPlayer has just been voted best multimedia software in this year's Linux New Media Award 2003 (German) by a jury of Linux New Media AG editors and community members.

MPlayer got 25.8% of the total votes, positioning it slightly ahead of xine (24.2%).

2003-10-11, Saturday :: FFmpeg CVS moved to MPlayerHQ
posted by Gabucino

Due to the continuing degradation of Sourceforge services' quality, the decision was made to move FFmpeg CVS to mplayerhq.hu.

MPlayer "oldtimer" users may remember the ages when libavcodec (the codec part of FFmpeg) was developed right inside the MPlayer CVS tree. The development was moved back to the Sourceforge server, so other projects - and the main FFmpeg of course - could take advantage of our developments. But let's get back to our current topic.

The FFmpeg CVS tree on Sourceforge will cease to exist shortly! Other services will stay on SF for now, but it's highly possible we'll move the mailing list too.

To checkout the new FFmpeg tree, the following command must be issued: 

cvs -z9 -d:pserver:anonymous@mplayerhq.hu:/cvsroot/ffmpeg co ffmpeg

To update an existing checkout, issue the following commands: 

cd ffmpeg
cvs -z9 update

2003-10-05, Sunday :: MPlayer 1.0pre2
posted by Gabucino

The next beta prerelease of 1.0. Test it or leave it.

NVidia users are going to be pleased with our (rather Sascha Sommer's) newest breakthrough: the nvidia_vid VIDIX driver. It is still in beta stage, but it is known to work on at least TNT2 and Geforce2.

You may or may not need to first initialize your card with the closed-source binary (?) XFree86 NVidia drivers.

If aye can give ye a hint: assuming you have an NVidia card, try playing a DIV3 (DivX 3.11) file with the following commandline: 

$ mplayer filename.avi -vc divxds -vo cvidix -vf format=uyvy

!!SPOILER!!: Yes, you'll experience REAL graphics video playing, on a REAL text console. Kinda neat, eh?

Let's see the ChangeLog:

MPlayer 1.0pre2

Security:

DOCS:

Ports:

Codecs and demuxers:

Filters:

FFmpeg/libavcodec:

Faad2:

Drivers:

Others:

MPlayer 1.0pre2 can be downloaded from the following locations:

2003-09-25, Thursday :: Exploitable remote buffer overflow vulnerability in MPlayer
posted by Gabucino

Severity:

HIGH (if playing ASX streaming content)
LOW (if playing only normal files)

Description:

A remotely exploitable buffer overflow vulnerability was found in MPlayer. A malicious host can craft a harmful ASX header, and trick MPlayer into executing arbitrary code upon parsing that header.

MPlayer versions affected:

MPlayer 0.90pre series
MPlayer 0.90rc series
MPlayer 0.90
MPlayer 0.91
MPlayer 1.0pre1

MPlayer versions unaffected:

MPlayer releases before 0.90pre1
MPlayer 0.92
MPlayer HEAD CVS

Notification status:

Developers were notified on 2003-09-24 (by Otero Hernan)
Fix was commited into HEAD CVS at 2003-09-25 02:36:36 CEST
MPlayer 0.92 (vuln-fix-only release) was released on 2003-09-25 12:00:00 CEST

Patch availability:

A patch is available for all vulnerable versions here.

Suggested upgrading methods:

MPlayer 1.0pre1 users should upgrade to latest CVS
MPlayer 0.91 (and below) users should upgrade to 0.92 OR latest CVS.

MPlayer 0.92 can be downloaded from the following sites:

2003-09-01, Monday :: MPlayer 1.0pre1 released
posted by Gabucino

This pre-release is the first piece of the pre-1.0 bugfixing series, leading straight towards the upcoming 1.0 final version. Please note: this tarball is NOT developed from the obsoleted 0.90 or 0.91 series, but from the HEAD development branch, which was forked from the 0.90rc4 pre-release.

Please test it as much as you can, and report any bugs you stumble upon!

We're looking for people who could maintain (not just momentarily translate) Polish, Norwegian, Romanian, Dutch and Turkish documentation.

Let's see the Changelog. Pretty small, ain't it..?

MPlayer 1.0pre1 -- "Development" on the beach

DOCS:

Big/Structural changes:

Ports:

Codecs/demuxers support:

FFmpeg/libavcodec:

Drivers:

Others:

MPlayer 1.0pre1 can be downloaded from the following locations:

2003-08-14, Thursday :: Some progress on 1.0
posted by Alex

As you already know, we are planning to release MPlayer 1.0pre1. This won't be a normal release, at least it won't be similar to the older ones. It's special because it's intended to help the bug hunting and provide a technology preview, to show what we can do now.

Now all of you probably ask what we can do?

You can view the current ChangeLog in CVS here

And what about that bug hunting you mentioned?

We plan switching on all the problematic parts of the source, so we can find most of the bugs which were hidden so far. For example the command line / config parsing routines have had some features switched off because they weren't tested yet.

Ohh, before I forget, have I mentioned that we are planning to organize a bug hunting party?

We await lots of coders, you can join the thread on the mailing list, it starts here.
And I want to ask all of you, dear users, to send real bug reports to the mplayer-users mailing list (after reading the documentation and the bug reports section, which you can find here). Add [BUG] to the subject line, if you want to get your bug really fixed! This applies to all the bugs that were reported in the last weeks, which haven't been fixed yet.

And now, all I can say is: long live MPlayer!

2003-08-13, Wednesday :: MPlayer 0.91 released!
posted by Gabucino

This is a surprise release. If you've payed attention to the MPlayer news, you know that we've been continuously maintaining the 0.90 codebase, backporting fixes from the 'main' branch.

This is the last release from that branch. We don't have the manpower to maintain it any longer, nor has it any sense. This release does not contain recent new features of the 'main' branch, like opensource Sorenson 3, and others!!! Consider this as a bugfix release for MPlayer v0.90, and be ready for MPlayer v1.0pre1 in just a few days!!!

The ChangeLog:

DOCS:

Fixes:

Porting:

MPlayer 0.91 can be downloaded from the following locations:

2003-08-09, Saturday :: MPlayer G1 news
posted by Gabucino

Everyone is obsessed about MPlayer G2. But what about our good old companion, MPlayer G1? Well, not much. Honestly. If you have ever listened to what we were saying you know that there are currently two G1 branches:

  1. 0_90 - which is the 0.90 version, plus critical bug fixes. This is probably our most stable version at the present, however it is also the most featureless. It doesn't even include Sorenson 3. A new release from this particular branch has already been scheduled since months, but it was always delayed in the end. My opinion is: it doesn't even worth a release.

    Currently the maintainers and release coordinators for this branch are me, and Diego Biurrun (yo diego!;). Expect MPlayer 0.91 to born from here.

  2. main - the ordinary head development branch. Most features. Most unstable. Least A'rpi :) Definitely a must-use branch. So. We don't have even the slightest idea about this branch. No release timeframe, not even a common agreement on version numbering.

    Alex is the maintainer of this branch, however he says he's away all the summer, going out with girlz to the beach, so mostly Diego and I are helping him in introducing new 10l bugs all the time. Maybe it will be 0.99 (but Alex prefers a lower number). Keep reading this news in the following days to get informed.

2003-08-06, Wednesday :: Debian follows SuSE? Please do NOT package crippled MPlayer!
posted by A'rpi

According to the latest DWN (Debian Weekly News), Debian people are again considering packaging MPlayer. Since they are even more paranoid than SuSE, they will "of course" cripple it by removing most of the native codecs (starting with libavcodec) and also most files with no nice GPL header included, rendering the player unusable.

SuSE warning

I think that including an unusable build of an application is even worse than not packaging it at all. It is not only valueless for the users (they will have to remove it and compile the source of the original version), but it gives the application a bad reputation, i.e. advertising it as a useless player being incapable of even playing a simple small file, or an unencrypted DVD (with AC3 sound)... Unfortunately most users won't notice the small comments in distribution specific files (like README.SuSE, or README.Debian) and will tell their friends, magazines (which occasionally write distro reviews) and post on portals/forums that it is a very bad, broken, unusable application.

We keep receiving bug reports from users telling us MPlayer on SuSE is unable to play file XYZ but for example his friend can play the same file on Red Hat. It's boring to explain to them over and over again, that SuSE (and soon Debian) comes with a crippled MPlayer, and they have to completely delete the package, and compile it from the original source, if they want to play any files...

Note, that they also patch MPlayer code to hell, resulting in new bugs and side-effects we are unable to reproduce (with the original source). They should send the patches to us, so we can review and apply the correct fixes and tell them about the problems with the rest.

I (A'rpi) want to ask all of those distributions to consider dropping MPlayer packages completely instead of shipping unusable crippled files! Our motto: if you can't do it right, you better don't do it at all! Users can still download the sources and compile them at their own responsibilty. We do know the legal issues well, but since the whole multimedia industry is completely covered by various patents, it's impossible to create a decent free multimedia player without breaking most of these patents. I'm even considering patenting my A-V sync algorithms used in MPlayer G2, to prevent unwanted crippled distribution of the next generation code, but I hope they will recognize their fault in time, and I won't have to do so.

2003-08-06, Wednesday :: MPlayer G2 pre-39 update
posted by Gabucino

Two updates on the recently released G2 tech preview:

  1. Unfortunately it prefers XSHM output before XV, thus it won't use hardware acceleration, and will be slow.
    Solution: use -vo xv command line option to use XV.
  2. The cool new fbdev video output driver - which features triple buffering - uses /dev/fb1 framebuffer by default.
    Solution: use -vo fbdev=/dev/fb0 command line option.

Have A Nice Experience Of Generation Two!

2003-08-03, Sunday :: MPlayer G2 pre-39 (tech preview) released!
posted by A'rpi

MPlayer G2 is the next generation of MPlayer, developed from scratch, by reusing good parts of the "old" code, but built over a new, clean design. The old project is not dead, we're just focusing more to the G2 code, which was almost invisible to users, until now.

G2 screenshot
MPlayer G2 in action

Recently there were big changes in G2 code, to get it ready for the first, brave testers :)

You can expect:

What you won't get yet:

If you feel you're brave enough to give it a try (don't worry, it won't burn your house or eat your cat, at least i hope so :)), get it here! You should NOT report bugs, but if you have file it can't play correctly (and it's one of the supported formats mentioned above), upload to ftp://ftp.mplayerhq.hu, and mention G2 in the attached .txt!

Download URLs:

2003-07-01, Tuesday :: European Software Patents
posted by Gabucino

The European Union is just about to vote total control over software patents! If you want to avoid the police harassing you, please read the summary here, then sign two petitions at http://petition.eurolinux.org and http://petition.ffii.org.

If you think all these efforts are in vain, then please tell your nearest EU representative about the matter.

2003-06-08, Sunday :: Selectable homepage themes
posted by Gabucino

I made some of the older homepage designs available, each is dynamically generated and contains the same content. I don't guarantee too much backward compatibility, but I see no reason for any big breakage. Choose the one for your liking :)

2003-05-26, Monday :: MPlayer O'Reilly article
posted by Gabucino

Kivilcim Hindistan has written an O'Reilly article about MPlayer. Click here to read!

2003-05-13, Tuesday :: Media world news
posted by Gabucino

2003-04-06, Sunday :: Finally! MPlayer 0.90 released!
posted by Gabucino

459 days have passed since we released our last "stable" release: MPlayer 0.60 "The RTFMCounter".

As usual, I'm sitting in front of my 15" CRT display, trying to create a news entry that would.. just do it. And the only thing that comes to me is that I should hit the bed as soon as possible. Let's make this quick then.

The most important thing: A'rpi is leaving project maintainership at the moment 0.90 is released. You can read his first and second mails on this subject (from the mplayer-dev-eng mailing list).

It's unclear if there'll be another "leader" for the project, and if yes, who will it be. I'm sure of one thing: the CVS will be very unstable in the next weeks/months/eons. Don't worry: 0.90 is stable for everyday usage (has some known bugs though - but if we waited for a fix for each of them, we wouldn't have a release in the next few aeons). If you aren't pleased with 0.90, please check the 'main' CVS tree if it fits your needs. Send patch, it might get incorporated into a 0.91, or like.

One more thing before I fall off my chair unconscious: we have results on the skin competition.

  1. Blue - Franciszek Wilamowski (Xenomorph)
    the new default skin for MPlayer GUI
  2. Orange - Ognian Vasilev
  3. krystal - Gary Whitmore, Jr.

MPlayer 0.90 "CounterCounter" can be downloaded from the following locations:

2003-03-17, Monday :: Oh no! MPlayer 0.90rc5 out for testing!
posted by Gabucino

Oh yes yes, no need to remind be: I promised rc4 would be the last prerelease. Well A'rpi had other ideas in his mind - as usual. However dear user, don't be alarmed! 0.90rc5 contains only important/critical backports from the main CVS branch. So please test and report bugs, blah-blah.

The ChangeLog for MPlayer v0.90rc5 "BackportCounter"

DOCS:

Features:

Porting:

Fixes:

2003-03-15, Saturday :: Legal stuff on other media projects
posted by Gabucino

Lately I've been pursuing some projects which are using ffmpeg and/or MPlayer, and are only partly or not at all complying with the (L)GPL license.

2003-03-11, Tuesday :: MPlayer Finetuning HOWTO
posted by A'rpi

Fine tuning MPlayer, the movie player for Linux
[written by Arpad Gereoffy (A'rpi), author/ex-maintainer of MPlayer, for freshmeat.net]

Click here to see the article!

2003-02-26, Wednesday :: Skin Design Compo
posted by Pontscho

I'd like to propose a Skin Design Compo. We think the time passed on the default skin. It's up to you to design a new, default skin.

Conditions:

You can read about skins here, and take a look at the default skin for examples.

Unfortunately we can't give a prize, but the winner can boast that a program with several hundred thousands of users starts with his/her skin. And we'll also advertise it.

Please send inquiries and skins to pontscho at kac.poliod.hu

Thankfully,

Pontscho / fresh!mindworkz

2003-02-09, Sunday :: MPlayer 0.90rc4 released
posted by Gabucino

So this is going to be the last RC release before the final 0.90. This one is called

MPlayer 0.90rc4 "FlameCounter"

DOCS:

Fixes:

Features:

Leech from

MPlayer vs Debian? - 2003-01-27.
posted by Gabucino

We've started a thread on the debian-devel mailing list, trying to get an answer on why xine is allowed to include libavcodec in Debian, and why MPlayer isn't. Also, why does debian-legal think they know what is GPL and what is not better than MPlayer and XAnim authors.

This discussion (on both lists mentioned above) is a must-read.

The thread begins here.

MPlayer v0.90rc3 is out - 2003-01-19.
posted by Gabucino

Here is it: the result of 3 weeks of heavy bug-hunting (and cola-drinking:)), code cleanup and docs updating!

Let's see the longest ChangeLog:

MPlayer v0.90rc3 "BugfixCounter"

DOCS:

Important fixes:

Fixes:

Features:

Gui:

Leech from

Some statistics - 2003-01-01.
posted by Gabucino

The people visited my presentation at the Hungarian GNU/Linux Conference already know an earlier version of this graph. It shows the number of the WEB (FTP was not counted) downloads of release tarballs, and the other curve shows the number of lines added to (or changed) the code in CVS, summarized per month.

statistics

MPlayer v0.90rc2 is out - 2002-12-24.
posted by Gabucino

Another Xmas, another MPlayer release... enjoy rc2.

I'm (A'rpi) prepared for the final commits for the final 0.90 - get ready!

Let's see the ChangeLog now:

MPlayer v0.90rc2: "Xmas 2002 Edition"

General:

VO:

Codecs:

Leech from

MPlayer v0.90rc1 is out - 2002-12-07.
posted by Gabucino

We've began preparations for the real release: this pre-release is the RC1. There are quite some features about it which make it the player supporting all modern codecs of the world today. No other player can boast with support for all of RealAudio/Video 9, Windows Media Audio/Video 9, Quicktime Sorenson 3, QDesign Music Audio. This is a peak improvement, and I'm not talking PR now. I'm watching TV with MPlayer even now. I could do so even on my EGA or Hercules display. Quite touching isn't it.

al3x has started a weekly "forum" for MPlayer: the MPlayer Weekly News. Its issues can be downloaded.

Let's quote the ChangeLog.

MPlayer v0.90rc1: "CodecCounter"

Docs:

Codecs:

GUI:

Others:

Leech from

WMV9/WMA9 is also supported now - 2002-12-04.
posted by Gabucino

Yes, now even MPlayer can play Windows Media Video 9 (WMV9) and WMA9 files. Get the CVS and fire it. I'm going to sleep.

Sorenson playback complete - 2002-11-19.
posted by Gabucino

A'rpi and Al3x marvelously hacked the built-in Win32 loader to load the QuickTime codecs (Sorenson 3, QDesign Music Audio). You don't need the libwine hack, mentioned in the previous news entry. Just follow the New QT Howto, download the codecs and start MPlayer.

Now the only remaining important codecs are WMV9 and WMA9. Guess what, the avifile project already got them working :) If you didn't know: those codecs use Micro$oft's new API: DMO (its predecessor was DirectShow). The funny thing is that these codecs are still "Release Candidate" according to Micro$oft :))

Please be patient until we finish porting the DMO interface from avifile.

How To Enable QuickTime Codecs In MPlayer - 2002-11-19.
posted by Gabucino

A'rpi whipped up a small text which describes how to use closed-source QuickTime codecs (Sorenson, QDesign Audio, etc) in MPlayer. The process is a bit difficult, but currently the only solution. Be patient, we are working on a better implementation.

It is important to emphasize the fact that although this method includes usage of the windows emulator Wine, this is NOT just like using the QuickTime Player. Wine is only used for the decoder, thus from MPlayer's viewpoint it looks just like any other codec: you can use xmga, aalib, vidix, whatever to display the movie. And, you can even encode it with for example DivX, with MEncoder.

The instructions can be found in DOCS/tech/qt-libwine-howto.txt. Good luck!

Introducing MPlayer OSD Menu - 2002-11-19.
posted by Gabucino

Alban Bedel has commited his first complete OSD Menu support. It is just awesome :) You can adjust most of the playing options runtime, with your selected font, displayed right on the used video output. There is a file browser, help text displayer, preferences, but the most unbelievable feature is the Console: basically it's like a terminal emulator, running in MPlayer :) Check the following screenshot, I executed some Unix commands :)

OSD menu
Click on the picture to zoom

MPlayer plays Sorenson SVQ3 + QDM2 MOVs! - 2002-11-11.
posted by Gabucino

Oops... We did it again :) So you can play your favourite brand-new quicktime movie trailers with mplayer! Oops... you cannot yet... at least the code is working, and was uploaded to CVS, but it needs some hacking to get it work... (not so bad, you need some DLLs from QT5 player and sdk, and libwine from wine-20020310 and some config.h editing) - okay, we'll work on getting this more user-friendly... :) so be patient, it'll be available in next (pre)release for sure!

SVQ3
Click on the image for a larger version!

Until then here is a screenshot, playing 2 well-known qt videos, the original sorenson 3 codec demo file and the 'Ellen Feiss about Windows' MOVs.

MPlayer 0.90-pre10 "BirthdayCounter" released - 2002-11-11
posted by Gabucino

MPlayer is 2 years old today! It's worth to check MPlayer v0.01, it has evolved a lot since then :) Anyway, this prerelease has both major bugfixes and new features, just like pre9 had...

The long CHANGELOG:

Docs:

Fixes:

Features:

Filters:

Leech from

now! :)

Opensource WMA v1, v2 (Windows Media Audio) decoder in ffmpeg - 2002-10-29
posted by Gabucino

The well-known ffmpeg project has made its new WMA decoder available. WMA is an audio codec from Micro$oft, which tries to compete MP3 (however, just try to encode the sound of the rain:). Just to remind you: ffmpeg already can decode the WMV7 video codec from M$ (amongst all other MPEG4 variants).

This new decoder's speed is the same as of M$'s decoder, but it's yet to be optimized.

This decoder finally enables you to decode these audio streams on non-x86 platforms.

MPlayer is the first player to support this feature.

End (?) of XBox Media Player debacle - 2002-10-29
posted by Gabucino

After some mails (the thread could be followed on the mplayer-users mailing list), XBPlayer developers opened their Media Player's source: it is available by CVS on http://xbplayer.sf.net.

Their reasoning: the Win32 version that is/was available for download at http://xboxmediaplayer.de was an older version which didn't contain ffmpeg or xvid, and has non-GPL license, equipped with a DivX3 decoder which was 20-30% faster (!) than ffmpeg. Well that's what they say. Unfortunately, the source of that version was lost (??!!).

They also insist on us providing an apology. For what? They nuked any topic on their forum which was discussing GPL. The homepage did not contain enough information about licenses - only the success story of porting ffmpeg and xvid..

And the "losing" of the old source.. Either way, let's hope they are more tolerant to (L)GPL licenses now.

MPlayer 0.90-pre9 released - 2002-10-24
posted by Gabucino

Hey. Here is pre9 and we're still not "stable" enough... This prerelease has both major bugfixes and new features :)

The (longest ever) CHANGELOG:

Docs:

Cleanup:

Fixes:

Features:

Libavcodec:

Leech from

now! :)

X-Box media player issue #2 - 2002-10-11
posted by Gabucino

The XBMP developers issued an article telling they didn't make official releases, therefore they are not obliged to release source code. So I guess they can say: "Oh, you have an XBMP binary? It must have been leaked, we are soo sorry."

That's a lie. Seeing their download area, there is a Win32 binary (amongst many else), obviously with GPL license. Please send the source to gabucino at mplayerhq.hu, which you are obliged to do.

X-Box media player infringing GPL - 2002-10-04
posted by Gabucino

Some win32 guys made a media player for Micro$oft's well-known "console", the X-box. Unfortunately they used FFMPEG and XVID sources in their closed-source product, and failed to make their sources - and changes to the used GPL codebase - available either in public, or by request - as the GPL license forces them to do so. They can't be contacted because they don't publish their E-Mail addresses due to an expectable threat from M$, or whatever their reasons are.

This violates GPL.

As we currently cannot move against them (not that we want to do so, in the first place), we can only warn the open-source community to

STAY AWAY FROM THIS PIECE OF PIRATED SOFTWARE!

It's a pity that so much people don't give a shit about the tireless work of FFMPEG/XVID creators.

MPlayer 0.90-pre8 released - 2002-09-18
posted by Gabucino

Hmm. It seems that pre7 was the most buggier pre-release ever... So time to release a bugfix/hotfix one now.

CHANGELOG:

Docs:

Cleanup:

Fixes:

Features:

Leech from

now!

MPlayer 0.90-pre7 released - 2002-09-05
posted by Gabucino

Hmm. Yet another month and we're at pre7... instead of the 0.90 stable... People just cannot insist commiting fixes and features :)

cleanup:

code:

gui:

Leech from

now!

XVID open source MPEG-4 codec stolen! - 2002-08-24
posted by Gabucino

XVID is a leading open source MPEG-4 video codec, covered by the GNU General Public License (GNU GPL). At the beginning of July 2002, XVID learned that their codec was entirely stolen by Sigma Designs (the manufacturer of DXR3/H+ hardware MPEG2 decoder cards), and is distributed with the name REALmagic MPEG-4 Video Codec, under Sigma Designs' own license (not GPL).

The XVID people immediately contacted Sigma Designs, who confirmed the violation, and promised to remove all violating code. On August 9th, Sigma released version 1.1 of "their" codec, which turned out to be still containing XVID, but it was disguised by programming and compiling tricks. As Sigma didn't show any sign of cooperation since, the XVID project leaders decided to close the project, until the matter is settled. Or forever...

This is a brief snippet of the story available at www.xvid.org. Please take the time and read it!

I think the Sigma guys are lamers, they didn't notice that icc (Intel's C compiler) inserts the source's filenames and the used compiler options into the binary, thus it was easy to spot.

The reasons we support XVID in this peril:

MPlayer in 256 bytes - 2002-08-09
posted by Gabucino

Flag 2002 party

The great Flag 2002 party was held in Budapest, Hungary on July 12-14th with some MPlayer team members present, including A'rpi, Pontscho and me (Gabucino). Don't be alarmed, I won't write a party report, but only put a note about a 256 byte compo entry that A'rpi coded just for fun: MPlayer256. It does OSD and noise filter in only 256 bytes :) Unfortunately it didn't get a single vote :)

Also, big thanx to the organizers for a great party!

MPlayer 0.90-pre6 released - 2002-08-06
posted by Gabucino

Hmm. After about 2 months of "testing" pre6 is out... It should be named v1.00 rather than v0.90-pre6, due to the many new features and major bugfixes - but it's pre6 now.
The crippled list of changes:

Leech from

now! :)

Just about recent changes - 2002-06-27
posted by Gabucino

You will have to use the CVS version! Current snapshot can be downloaded from these locations:

Donations page created - 2002-06-12
posted by Gabucino

I've put a donations page up, in case someone would need only this to start donating... Click here -> DONATIONS PAGE

Please think about donating. MPlayer is a non-profit program, and we don't ask for too expensive things.

MPlayer 0.90pre5 released - 2002-06-08
posted by Gabucino

Here comes a brand new pre-release of MPlayer 0.90: pre5. Below you can find a short list of changes, compared to the pre4 version.

Documentation changes:

Code changes:

Display:

Miscellaneous fixes:

Download:

Matrox's new card: Parhelia - 2002-06-04
posted by Gabucino

The well-known video card maker Matrox has released its new card continuing the Gxx series: Parhelia. Unfortunately mga_vid won't support it, unless someone sends us some of this baby. We mailed Matrox some weeks ago, but - sadly - haven't received any answer.

Donations are welcome.

MPlayer 0.90pre4 released - 2002-05-13
posted by Gabucino

I can't think of any introduction text. So: the new pre-release 0.90-pre4 of the most popular movie player is out. List of main changes:

Download:

MPlayer 0.90pre3 released - 2002-05-03
posted by Gabucino

This prerelease contains some serious bugfixes, and no big new features. We promised various big things in pre2 announcement, but they are delayed to pre4 now, as we want to release these fixes ASAP. The most important fixes were:

You can download it from the following places:

And please check the Freshmeat popularity statistics, it has Linux kernel on 100%, second place is MPlayer with 94.61% and increasing. The third is cdrecord with 47.41% :)

MPlayer 0.90pre2 released - 2002-04-30
posted by Gabucino

This is the second pre-release intended for public testing. We'd like to make a totally bugfree 0.90 later, so please try this out and report problems! We've got many bugreports since 0.90-pre1, most of these have been fixed.

Known problems, with top priority on our TODO (scheduled for pre3):

List of changes, without being complete :

Everyone is welcome to test, and don't forget to REPORT BUGS! You can download MPlayer 0.90pre2 here.

MPlayer 0.90pre1 released - 2002-04-21
posted by Gabucino

This is a pre-release intended for public testing. We'd like to make a totally bugfree 0.90 later, so please try this out and report problems!

List of enhancements, without being complete:

Everyone is welcome to test, and don't forget to REPORT BUGS! You can download MPlayer 0.90pre1 here.

MPlayerXP - 2002-03-18
posted by Gabucino

As some of you may have already noticed, there is a new project on Sourceforge, called MPlayerXP. This project has been started by Nick Kurshev - the author of Vidix, and origin of numerous MPlayer optimizations.

He forked because we didn't accept his patch: it brings unneeded threads into MPlayer - threadlessness is the main feature of MPlayer, compared to other Linux players like Xine and avifile. Nick writes his method gains 300% speed.. This is not true. His method gains not speed but smoothness - if you have a movie that runs slow with MPlayer, MPlayerXP will not help you. It helps only in some rare files on about ~400Mhz Intel speed category systems, but it won't be faster decode (total decoding time will be the same).

But you are free to try it! If you (don't) find that new core better than the normal one, mail Nick a full report. We don't support MPlayerXP..

[ this is Nick's original mail, it's became a nice thread since ]

Plus - 2002-03-16
posted by Gabucino

Whoops, left out the most important:

MPlayer new release coming soon - 2002-03-16
posted by Gabucino

We'll soon make a release again. The runtime CPU detection code seems to be working perfect, so time to be GPL. Until then, let's see some new features :

About latest development - 2002-03-04
posted by Gabucino

Here comes a little review of latest works in CVS:

And let's see some MEncoder-specific enhancements :

There will be some other new features announced here shortly..

Another joe barr article - 2002-01-28
posted by Gabucino

Yes, Linuxworld hasn't fired this guy yet. This time he examined Xine.. I do not (?:) intend to go ranting about the article, as it does not directly concern MPlayer. Instead, I'd like to point out on some things :

In the beginning of the article Joe baby quickly proclaims that his standard ./configure; make; make install procedure worked just fine, and got "video that rivaled anything he's ever seen". Later in the article he adds that he had to visit and download "a number of related sites and projects" so he could fill in Xine's missing parts. The interesting part is that he had to do the same to MPlayer, and he became angry about it.

Another interesting part is when he "was impressed by the level of detail and information provided by the (configure) scripts". Well you know how a standard ./configure script's output looks like :

  checking whether the C compiler works... yes

I'm impressed by the "level of detail". BTW, that script runs for 5 times more time than ours.. Well, it simply rocks.

Let's continue reading this fabulous article: Joe quickly froze Xine by changing to an other skin than the default. I expected he'd go furious but, no, instead he advises us to "keep in mind this is beta software".. He didn't say this when testing MPlayer, yet he used Xine 0.9.7, and he MPlayer's development CVS version.. He must have forgot it, doesn't matter. But he doesn't know that Xine is planning to release 1.0 very soon...

Next advantage of Xine is "you can set just about anything". Let's see what is anything : from paths to device names to the "demuxer selection strategy" . Now, THAT's what I call variety ;)) But seriously, MPlayer is MUCH more customizable than Xine. If you don't believe it, you've never seen MPlayer, or never cared to read the documentation. So what do we have in the end? Joe Man is FUD'ing again.. This guy is impressive :) If I knew english as much as he does, I too would be able to manipulate the masses this easy :)

Then he plays a DVD. Lucky for him, because Xine couldn't play any of mine, only when I downloaded DVDnav, and recompiled Xine for it :) But please disregard this paragraph, it's only my lameness. Or maybe it's his 1Ghz Athlon, and my 500Mhz K6/2 - which plays DVDs with almost no (!) framedrops (with mga_vid, which Xine doesn't have.. So Xine is unable to use my Matrox's TVout too..)

He also visits #xine, where he gets some hints.. Maybe configure; make; make install and Xine documentation wasn't enough? I never saw him on #MPlayer or on our mailing lists... Yet, according to him, our documentation is the biggest pile of shit :) Yare-yare, I must be crafting conspiration theories :)

So, these are my (Gabucino) comments on Mr. Barr's article.. My intention was to let the community see the other side of Barr's fuckings. My intention was NOT to disrespect Xine (I think it has nice GUI widgets) or Guenter Barsch, if he feels I did so, I apologize.

Vidix's mga_vid tested on FreeBSD - 2002-01-26
posted by Gabucino

...and it works! So currently MPlayer is the FASTEST movie player on FreeBSD, with Matrox G400 cards ! (G200 currently doesn't work with Vidix)

Introducing VIDIX technology - 2002-01-16
posted by Gabucino

VIDIX is an interface for the sole purpose of direct access to videocards' framebuffers, DGA and BES.

I don't have to introduce mga_vid to Matrox users, they already know the mighty speed and quality increase compared to the standard Xv driver in X11, not to mention the hardware accelerated TV out.

I also don't have to talk about radeon_vid which was first to produce TV output on Linux for ATI Radeons, and at the same time having the speed of mga_vid.

But I DO have to talk about the fact that VIDIX provides an interface for all these drivers. I mentioned that it also provides direct hardware access. And what does a standard interface for hardware access mean? It means that now it's very easy to write *_vid drivers for virtually EVERY videocard.

For those which don't have XVideo support in X11.

For NVidia users who have to mess with buggy drivers and incompatibilities. We already started writing nvidia_vid !

And this is absolutely not the whole story. I think you may be interested for VIDIX and its drivers (mga_vid, radeon_vid, nvidia_vid) are PLATFORM AND OS INDEPENDENT !
Ability to use for example mga_vid on BSD. On Windows. On......

Read about it.

New section: Unapplied patches - 2002-01-15
posted by Gabucino

I've just created a new section for patches that didn't make it to CVS, but may be interesting for some people. See the download page.

MPlayer site mirrored - 2002-01-15
posted by Gabucino

We've set up a mirror for the entire site (except the CVS). It can be reached at http://www2.mplayerhq.hu and ftp://ftp2.mplayerhq.hu.

MPlayer 0.60 RELEASED ! - 2002-01-02
posted by Gabucino

3 months have passed since 0.50, and we are pleased to announce that 0.60 is finally RELEASED ! While downloading, check out the "short" What's New list:

2001-12-01 :: December News
posted by Gabucino

<sigh> It's hard to start a news entry.
Should I write some lame jokes of mine? I think it's not the reason people read MPlayer news. And they DO read. In July, we had 23487 hits. In September, it was 49947. And now in November, it's 90601 ! Nice growth, I can say. MPlayer's features also grew the same way, so it's nearly time for a new release : 0.50 has grown very old, buggy and featureless (compared to the code in CVS now).

MPlayer team is looking for sponsors ! If you can and want to sponsor the Team's development either with (primarily) hardware or money, or just think that you can enhance the code, contact us! Thank you.

So, back to the new release : we're not sure about the version name, but it won't be 1.0 . As of now, it seems 1.0 will be fully GPL, and will include powerful CPU detection code to allow binary distribution. Be aware that this is like fortune tellings, so no warranties.

Apart from this, the main enhancement that will take place after this release, will be the completion of libvo2 and this time we'll really do it. It means

and many many other interesting stuff.

And now, something not-so-completely different : new features in current CVS.

If you feel the urge to try these, hurry and download ! Also, be sure to read the documentation about new features, and anyways. Enjoy!

2001-11-24 :: Enough of this already!
posted by A'rpi

Hi,

Ok. I see you still don't understand what happened and why were we so upset. So, let me explain:

The FACTS:

A russian "coder" has "ported" MPlayer (actually removed/disabled half of the code and added audio/video support using someone else's code, so actually hacked together 3 opensource projects at most ugliest way) to OS/2. It is not problem, it is even somehow good, but we would like more if he send patches for MPlayer instead of fork'ing development.

The PROBLEM:

He provided this stuff for download at os2.ru page. He provided no sources at all. He provided it as HIS OWN PRODUCT UNDER HIS NAME and he even not mentioned the MPlayer or ffmpeg or os/2 ao/vo lib authors nor any of these project names. We can call it only 'code stealing'. Tell me if you disagree, and please explain why.

Our REACTION:

As soon as we got informed about this, we sent some mails to their mailing list. The mails didn't arrived in few hours. We thought the list is moderated and they ignored them or the maillist simply does not exists/work. We sent mail to the website admins, asking them to provide us direct email contact of the "author", and remove the download link until he fixes credits. They didn't replied. Next day we were more upset and Gabucino put out that well-known NEWS entry. I've seen it and said "it's ok", I didn't think of such reaction. (yes, it was a bit(?) rude, but is code stealing a good thing???)

Their REACTION:

They immediately came out from the darkness, and started to flame us at every forums because of that news entry. Nothing about the code stealing. Just flamed us. Later they started to say: it is not MPlayer port, just 2 libs of MPlayer were used and it's a totally different project contributed by russian coders. They also mentioned that A-V sync code is not from MPlayer, it's their own new code.

My REACTION:

I told them that:

Their REACTION:

flame again about NEWS. Nothing about our "wishes". they started to send russian language mails for us and to their list. flame started on mplayer-users list and slashdot too.

Their REACTION Next day (friday afternoon):

they finally released the sources, and afaik (i couldn't check as it was OS/2 installer EXE) they fixed documentation of the project. there is a simple link to MPlayer site now, not mentioning how wvision based on MPlayer or related to it. bad, but it's ok for me, i doubt they will ever do more. also note that distributing MPlayer code in binary form is still prohibited...

Our REACTION:

as soon as we downloaded the source, we started to check what did he really do. he did what we thought before. ported MPlayer by removing/disabling half of code and hacking in os/2 audio/video out. he even keept my own A-V sync code from MPlayer (compare wvision.cpp to MPlayer.c) while stating everywhere that it's their code. he used the core of MPlayer, so it's much more than "just 2 libs from MPlayer".

OS2.ru guys:

A'rpi / Astral & ESP-team

2001-11-16 :: Word of warning
posted by Gabucino

If MPlayer CVS doesn't compile for you nowadays (you get error messages with quant_store_mpeg2 or so), please do a fresh checkout and try again. A slight inconsistency in the CVS backup caused these errors.

Also, MPlayer now compiles on QNX too. Note that it isn't ready for true usage yet, as the only video output working right now is the X11 one, and as you know QNX has a very slow X emulation. Check the screenshots (they also have CPU utilization percentage). If you have interest or experience in porting further, do so.

And here's the link for the recent interview with A'rpi (in hungarian!).

2001-11-13 :: removed
posted by Gabucino

This news entry contained some misinformations about GCC 2.96 and has been removed upon RedHat's request.

Updated version is here.

2001-11-06 :: Few words about GPL
posted by Gabucino

This (joke) news entry about Arpi vs GPL was removed for it caused misunderstanding.

2001-11-04 :: Press release
posted by Gabucino

Here I am to keep you informed again, for you ppl who don't download CVS snapshots or use CVS to keep track of MPlayer development progress. Obviously, you're mistaken. :) Other UNIX/Linux projects maybe don't even compile when downloaded from CVS. MPlayer always does. But whatever.
So, let's see the improvements:

XAnim codecs support
posted by Gabucino

MPlayer now can use XAnim codecs (even 3ivx!) for video decoding ! The documentation is already updated, check the new XAnim codecs section for installation/usage instructions !

ATTENTION: using some XAnim codecs with other software than XAnim is ILLEGAL!

MPlayer compiled on win32
posted by Gabucino

Atmosfear successfully compiled MPlayer on windows (on XP, but runs even on W95) It really rocks.. It needs SDL for video+audio output. Currently lacks Win32 codecs support, but features MPEG1, MPEG2, DivX/OpenDivX/DivX4 (ffmpeg/libavcodec) and MP2, MP3, AC3 support. Check the screenshots ! The binary is yet unreleased.

2001-10-08 :: MPlayer 0.50 released
posted by Gabucino

Just go and download.
New after 0.50-pre3: mostly build fixes for non-linux systems, docs updates.

Note: mov "support" disabled, if you want to play with it, then use CVS. (mov support is far from being finished. no seeking and only cvid video and raw audio are supported - so it's very useless)

Also, we moved the mplayer-users mailing list to our new server. If you weren't automatically resubscribed, you can do it here.

MPlayer 0.50pre3 released
posted by Gabucino

Just a few changes, hot-fixes:

2001-10-03 :: MPlayer 0.50pre2 released
posted by Gabucino

Just a few changes, hot-fixes:

MPlayer 0.50pre1 released
posted by Gabucino

Hmm. Release again. Tons of new features, beta Gui version, bugs fixed, new vo and ao drivers, ported to many systems, including opensource divx codec and much more. Try it!

Attack on USA
posted on 2001-09-11

Dear ppl,

We, MPlayer developers, condemn those that are involved in the creation of this senseless massacre, and would like to express our sincerest condolences to the relatives of all who died due to these terrosist attacks.
We hope that the masterminds of this attack will be apprehended and punished appropriately.

As a sidenote..
posted on 2001-09-01

Two more skins are available. I won't announce it anymore, so check the download section for updates.
About the GUI? Well, it's now nearly ready to be released. Just be a little more patient... Oh, and there are screenshots of the skins, just click on their names.

Ogg Vorbis support
posted on 2001-09-01

Atmosfear has commited support for the Ogg Vorbis audio format. You'll need libvorbis from http://www.xiph.org/downloads/ . Don't forget to update your codecs.conf !

Skins available
posted on 2001-08-30

Although the GUI is not yet fully merged/complete/working, I made a Skin download section in the Downloads page. Currently there are only 2 skins, a default, and a skin made by me (it's a conversion of a WinAMP/xmms skin of Rei Ayanami:). BTW it's really easy to develop a skin, just download a skin and read the ./skin file inside it. Self-explanatory.

Letter of the Year
posted on 2001-08-29

(whether this letter is real or not, it's ROTFL...)

LS,

can you help me ?

I want to start up my mplayer version 6.4 (I use NT) in full-screenmode(alt enter) is it possible ?
And : when my avi is finished I would like that my mplayer automatically closes (alt F4) ist it possible ?

Thank you very much for your attention !

Pim van As.

_______________________________________________
Mplayer-users mailing list
Mplayer-users@lists.sourceforge.net
http://lists.sourceforge.net/lists/listinfo/mplayer-users

mediaLib support in ffmpeg
posted on 2001-08-29

Juergen Keil added support of SUN's mediaLib into ffmpeg (libavcodec, to be exact). And thus MPlayer (since we use libavcodec to play DivX on SPARC platforms, see the documentation).
It does about at least 50-70% speedup on UltraSPARC CPUs (they support the VIS instruction set). Grab the cvs snapshot. Now VIS is supported in the following parts of MPlayer: libmpeg2, libvo, libavcodec.

FINALLY Real DVD playback
posted on 2001.08

As MPlayer now uses libdvdread (which relies on libcss), now we have nearly full DVD playback ability. Plus some more additional features:

Grab the current cvs snapshot (0.18-pre* are obsoleted and removed), and enter the world of Linux Multimedia !

WMV8 support
posted on 2001-08-15

Yeah. Update from cvs if you wish. Hmm what other news.. ffmpeg is even more faster, DivX4 is even more buggier. Update update update!

So you thought you knew everything about DivX..?
posted on 2001-07-24

..didn't you? Well, you were wrong. MPlayer now includes four (actually three) methods to play DivX movies. You can choose between:

For a big (resolution 528x368), and high bitrate (262 kbyte/s) DivX,
and a small (resolution 320x240), and low bitrate (65 kbyte/s) DivX :

HI-RESLO-RES
Win32 DShow DLL100%Win32 DShow DLL100%
ffmpeg105%ffmpeg107%
DivX4 (standard)112%DivX4 (standard)110%
DivX4 (YV12)140%DivX4 (YV12)130%

What. You aren't downloading yet??

Nowdays' enhancements
posted on 2001-06-30

Another boring weekend, another news entry.. ;) Keeping our habit, we delayed the release again. For the impatient, there is a 0.18preX prerelease available in the download section. Let's see some new features:

GUI preview screenshots available
posted on 2001-06-19

Pontscho's GUI has made another step towards being ready. Although the GUI code itself isn't fully perfect, nor publicly available (so don't ask for it), I've made 2 screenshots and put them up. It'll be merged with the main MPlayer SOON, have fun until then.
SKIN MAKERS are very welcome! Don't hesitate to write us!

Some stuff
posted on 2001-06-16

Hmm, let's see some info.. First, about the native AAlib driver. Its development is going slow, seems to be due to some problems IRL. It will be definitively released soon (hmm, but that's what we always say, isn't it?). Second, as you may have noticed, the release should've been released already. Well, it isn't. Good explanation? Oh well. The codebase is still in the killing bugs phase (not if there are any..), also some new features like -benchmark, -frames (play only n frames, then quit) have been implemented. The third thing that comes into my mind right now, is the GGI project. It seems that some of our developers have became inspired by it, and a vo_ggi driver is coming right away. Hope it'll be usable.

Code frozen!
posted on 2001-06-09

As of today evening, MPlayer code is frozen. The release will take place about monday-tuesday midnight (GMT+2).

Sourceforge is back to normal (?) again.

Recent changes in MPlayer
posted on 2001-06-06

Any much much more! Check out from CVS !

SourceForge is dying !
posted on 2001-06-06

SourceForge services run on their slow backup system for 2 weeks, so there are no crontab jobs (no automatic daily snapshots and homepage updates). Mailing lists are extremly slooooow and mails arrive in different order than sent so for example the cvslog lists is totally unusable. So, please be patient, and don't disturb(?) us with these. We hope that SF will recover (but I fear for they will never recover, two weeks on backup sys is too long...) or we can finally set up our new server in Hungary.

A'rpi

FreeBSD and Solaris support !
posted on 2001-06-06

Yes, some people (namely : Jürgen Keil and Marcus Comstedt) made it. MPlayer now compiles and works on Solaris 8, of course only on x86 machines, not Sparc (that would be hopeless, sorry). It even has VCD and DVD support, however the whole support is to be considered experimental. The FreeBSD support is done by Vladimir Kushnir. Update from CVS, or download a snapshot.

PROJECT mpg12play-portable STARTED!
posted on 2001-05-15

Many people asked about portability. Gernot Ziegler went so far that he tried to port mpg12play sources to IRIX operating systems. Now this project goes serious... The goal is to produce a portable MPEG1/MPEG2 player.

From A'rpi :

The project has been started...

  1. I've removed all win32/avi stuff from mpg12play (MPlayer-0.09 version) and imported to the CVS with module name mpg12play. It still has some x86 code, but most places it's disabled. remaining code must be #ifdefed (do not remove!) to get it compile on non-x86 arch.
  2. Created a mailing list called mplayer-mpg12play (yes, silly name, but SF doesn't allow other than mplayer-*) Please subscribe to the list, if you are interested, and aren't already subscribed by me!

MPlayer 0.17a is out...
posted on 2001-04-27

Hehh, we were so obsessed with our own deadline that just after IdegCounter was officially released, we noticed many things were missing, etc. Even its version number was 0.11-pre :)
Download the real thing.

MPlayer 0.17 "The IdegCounter" is RELEASED !!!
posted on 2001-04-27

After many months of daily 24 hours blood-sweating development, MPlayer 0.17 is here to kick some butt! Actually the version number should be much higher (in the view of the Hell-A-Lot-Of functions inside), but we're veeeery humble. That's why we don't say: "This is the best player available for Linux, go download download download it NOW!" So, we don't say it. Instead we'd like to thank for all our sponsors, namely: ... , ... and ... . Thanks for all the money ($0). Don't forget it's NEVER late to send (m)any!!!

Well, enough of crap talk. The Facts:

And lots lots lots lots lots of more! Head to the download section!!!

Tons of bugfixes and new features !
posted on 2001-04-21

This is a summary of some new stuff in MPlayer:

The Time of Release is coming in a few days... This is gonna be a big shot for real!

New codecs
posted on 2001-04-03

A lot of improvements have been made to the codec loader, and as a consequence many more codecs can be used with MPlayer than previously. A new w32codec.zip package is downloadable, and it is RECOMMENDED that you download it!

Subtitles (and OSD) support !
posted on 2001-03-30

I'll lend you some useful info to make it work and hope for the best.
First, download the font package.
Next, unzip it to $HOME/.mplayer/font .
Get latest CVS, compile it, use either Xv, MGA, X11 (only in 24bpp), or fbdev output, specify your sub file with the -sub option, and you're done!

Thanks to Laaz for the SUB reader, A'rpi for the great OSD+SUB displayer and Chass for the font(s)!

DirectShow support !
posted on 2001-03-21

A'rpi has finally added DirectShow support to MPlayer! Now it's possible to use postprocessing with DivX movies, of course you'll need a very strong CPU! You'll need the file divx_c32.ax from either Windows, avifile, or from here. Support for the other codecs is coming very soon!

New timer code
posted on 2001-03-18

A'rpi is experimenting with a much smoother timer code, called MPlayerHQ. It solved at least some problems with ALSA for me. Please try it and write if playing got smoother. Also try the new code snippets in the TOOLS dir, and post results to A'rpi.

CVS mailinglist
posted on 2001-03-15

There's a new list, which announces all changes in the CVS repository. Subscribe if you want to, but be warned! Its traffic is BIG!

OpenDivX 4.0 alpha48
posted on 2001-03-11

The new release of the OpenDivX codec is now supported. It introduces better quality, however the encoding speed is still slooow. Negative: the alpha47 codec isn't forward compatible, so you'll have to upgrade. (this code is in CVS)

New Matrox mailing list
posted on 2001-03-08

Since there are a lot of questions/bugs/discussions about the relationship between MPlayer and Matrox cards, A'rpi decided to make a new mailing list just for this topic. You can subscribe on it

Mailing lists moved
posted on 2001-03-07

The MPlayer-users and MPlayer-announce lists have been moved to Sourceforge. Subscription info is updated in the About section.

DGA driver
posted on 2001-02-27

Andreas Ackermann made a DGA driver for libvo. And he did a good work... It's about 60-80% faster than the X11 driver! Of course if you could do Xv output already, this isn't much of an improvement for you..
Also note that this code is alpha, and - at the time of writing this - exists only in CVS.

Moving to SourceForge!
posted on 2001-02-24

Yeah, we'll move to SourceForge.
I hope you'll like the CVS accessibility.

Prerelease versions
posted on 2001-02-23

No prerelease versions have came out since Feb 19. THAT'S really strange!
A'rpi must be working all day all night on the 0.11 release and 0.12 series. :)

A'rpi released information on upcoming 0.12 series
posted on 2001-02-20

On the MPlayer mailing list, A'rpi announced the proposed changes in the 0.12 series.

The biggest change will be the change from libvo to libxmm . libxmm aka XMMP is an abbrevation for "Linux MultiMedia Project", which is another multimedia layer for Linux.. However, in the light of its nasty features, no wonder A'rpi chose to use it! I suggest to download, install and get familiar with it now, since you'll soon have to do so anyway!

Another great stuff is ffmpeg , so A'rpi thought why not include it in MPlayer?
And so he did. ffmpeg is no less than a realtime video/audio encoder for Linux, so prepare your BTTV cards or any stuff you wanna record with, since now you'll be able to encode runtime to OpenDivX (or other formats).

The GUI code (by Pontscho) will be imported too, so you can finally show your Windows pals who has the better player!!! Actually with an encoder! :)
Anyways, we still need good skins! Graphicians, get a grip on yerself and write to Pontscho!

Those of you who missed DivX ;-) quality setting option, be delighted! DirectShow support will be added too! Of course this also means VoxWare support (audio codec).
I wonder who needs .mov support.. That'll be added very soon!

The mailing lists are ready!
posted on 2001-02-17

In order to lower the load on A'rpi :) the MPlayer-users mailing list was created. Thanks to Dariusz Pietrzak for the hosting!

The subscribing process is simple. Click here.