44 files changed, 1756 insertions, 239 deletions

diff --git a/meta-oe/recipes-multimedia/audiofile/audiofile_0.3.6.bb b/meta-oe/recipes-multimedia/audiofile/audiofile_0.3.6.bb
index a09f84381e..50df31c7b9 100644
--- a/meta-oe/recipes-multimedia/audiofile/audiofile_0.3.6.bb
+++ b/meta-oe/recipes-multimedia/audiofile/audiofile_0.3.6.bb
@@ -13,8 +13,12 @@ SRC_URI = " \
     file://0001-fix-negative-shift-constants.patch \
     file://0002-fix-build-on-gcc6.patch \
     file://0003-fix-CVE-2015-7747.patch \
+    file://0004-Always-check-the-number-of-coefficients.patch \
+    file://0005-clamp-index-values-to-fix-index-overflow-in-IMA.cpp.patch \
+    file://0006-Check-for-multiplication-overflow-in-sfconvert.patch \
+    file://0007-Actually-fail-when-error-occurs-in-parseFormat.patch \
+    file://0008-Check-for-multiplication-overflow-in-MSADPCM-decodeS.patch \
 "
-SRC_URI[md5sum] = "235dde14742317328f0109e9866a8008"
 SRC_URI[sha256sum] = "ea2449ad3f201ec590d811db9da6d02ffc5e87a677d06b92ab15363d8cb59782"
 
 inherit autotools lib_package pkgconfig
diff --git a/meta-oe/recipes-multimedia/audiofile/files/0004-Always-check-the-number-of-coefficients.patch b/meta-oe/recipes-multimedia/audiofile/files/0004-Always-check-the-number-of-coefficients.patch
new file mode 100644
index 0000000000..17a97163f5
--- /dev/null
+++ b/meta-oe/recipes-multimedia/audiofile/files/0004-Always-check-the-number-of-coefficients.patch
@@ -0,0 +1,46 @@
+From c48e4c6503f7dabd41f11d4c9c7b7f8960e7f2c0 Mon Sep 17 00:00:00 2001
+From: Antonio Larrosa <larrosa@kde.org>
+Date: Mon, 6 Mar 2017 12:51:22 +0100
+Subject: [PATCH] Always check the number of coefficients
+
+When building the library with NDEBUG, asserts are eliminated
+so it's better to always check that the number of coefficients
+is inside the array range.
+
+This fixes the 00191-audiofile-indexoob issue in #41
+
+Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
+
+CVE: CVE-2017-6827
+CVE: CVE-2017-6828
+CVE: CVE-2017-6832
+CVE: CVE-2017-6833
+CVE: CVE-2017-6835
+CVE: CVE-2017-6837
+CVE: CVE-2020-18781
+Upstream-Status: Inactive-Upstream [lastrelease: 2013]
+Signed-off-by: Peter Marko <peter.marko@siemens.com>
+---
+ libaudiofile/WAVE.cpp | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/libaudiofile/WAVE.cpp b/libaudiofile/WAVE.cpp
+index 0e81cf7..61f9541 100644
+--- a/libaudiofile/WAVE.cpp
++++ b/libaudiofile/WAVE.cpp
+@@ -281,6 +281,12 @@ status WAVEFile::parseFormat(const Tag &id, uint32_t size)
+ 
+                        /* numCoefficients should be at least 7. */
+                        assert(numCoefficients >= 7 && numCoefficients <= 255);
++                       if (numCoefficients < 7 || numCoefficients > 255)
++                       {
++                               _af_error(AF_BAD_HEADER,
++                                               "Bad number of coefficients");
++                               return AF_FAIL;
++                       }
+ 
+                        m_msadpcmNumCoefficients = numCoefficients;
+ 
+-- 
+2.11.0
+
diff --git a/meta-oe/recipes-multimedia/audiofile/files/0005-clamp-index-values-to-fix-index-overflow-in-IMA.cpp.patch b/meta-oe/recipes-multimedia/audiofile/files/0005-clamp-index-values-to-fix-index-overflow-in-IMA.cpp.patch
new file mode 100644
index 0000000000..00bb7e597e
--- /dev/null
+++ b/meta-oe/recipes-multimedia/audiofile/files/0005-clamp-index-values-to-fix-index-overflow-in-IMA.cpp.patch
@@ -0,0 +1,43 @@
+From 25eb00ce913452c2e614548d7df93070bf0d066f Mon Sep 17 00:00:00 2001
+From: Antonio Larrosa <larrosa@kde.org>
+Date: Mon, 6 Mar 2017 18:02:31 +0100
+Subject: [PATCH] clamp index values to fix index overflow in IMA.cpp
+
+This fixes #33
+(also reported at https://bugzilla.opensuse.org/show_bug.cgi?id=1026981
+and https://blogs.gentoo.org/ago/2017/02/20/audiofile-global-buffer-overflow-in-decodesample-ima-cpp/)
+
+Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
+
+CVE: CVE-2017-6829
+Upstream-Status: Inactive-Upstream [lastrelease: 2013]
+Signed-off-by: Peter Marko <peter.marko@siemens.com>
+---
+ libaudiofile/modules/IMA.cpp | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/libaudiofile/modules/IMA.cpp b/libaudiofile/modules/IMA.cpp
+index 7476d44..df4aad6 100644
+--- a/libaudiofile/modules/IMA.cpp
++++ b/libaudiofile/modules/IMA.cpp
+@@ -169,7 +169,7 @@ int IMA::decodeBlockWAVE(const uint8_t *encoded, int16_t *decoded)
+                if (encoded[1] & 0x80)
+                        m_adpcmState[c].previousValue -= 0x10000;
+ 
+-               m_adpcmState[c].index = encoded[2];
++               m_adpcmState[c].index = clamp(encoded[2], 0, 88);
+ 
+                *decoded++ = m_adpcmState[c].previousValue;
+ 
+@@ -210,7 +210,7 @@ int IMA::decodeBlockQT(const uint8_t *encoded, int16_t *decoded)
+                        predictor -= 0x10000;
+ 
+                state.previousValue = clamp(predictor, MIN_INT16, MAX_INT16);
+-               state.index = encoded[1] & 0x7f;
++               state.index = clamp(encoded[1] & 0x7f, 0, 88);
+                encoded += 2;
+ 
+                for (int n=0; n<m_framesPerPacket; n+=2)
+-- 
+2.11.0
+
diff --git a/meta-oe/recipes-multimedia/audiofile/files/0006-Check-for-multiplication-overflow-in-sfconvert.patch b/meta-oe/recipes-multimedia/audiofile/files/0006-Check-for-multiplication-overflow-in-sfconvert.patch
new file mode 100644
index 0000000000..ec21b09f30
--- /dev/null
+++ b/meta-oe/recipes-multimedia/audiofile/files/0006-Check-for-multiplication-overflow-in-sfconvert.patch
@@ -0,0 +1,79 @@
+From 7d65f89defb092b63bcbc5d98349fb222ca73b3c Mon Sep 17 00:00:00 2001
+From: Antonio Larrosa <larrosa@kde.org>
+Date: Mon, 6 Mar 2017 13:54:52 +0100
+Subject: [PATCH] Check for multiplication overflow in sfconvert
+
+Checks that a multiplication doesn't overflow when
+calculating the buffer size, and if it overflows,
+reduce the buffer size instead of failing.
+
+This fixes the 00192-audiofile-signintoverflow-sfconvert case
+in #41
+
+Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
+
+CVE: CVE-2017-6830
+CVE: CVE-2017-6834
+CVE: CVE-2017-6836
+CVE: CVE-2017-6838
+Upstream-Status: Inactive-Upstream [lastrelease: 2013]
+Signed-off-by: Peter Marko <peter.marko@siemens.com>
+---
+ sfcommands/sfconvert.c | 34 ++++++++++++++++++++++++++++++++--
+ 1 file changed, 32 insertions(+), 2 deletions(-)
+
+diff --git a/sfcommands/sfconvert.c b/sfcommands/sfconvert.c
+index 80a1bc4..970a3e4 100644
+--- a/sfcommands/sfconvert.c
++++ b/sfcommands/sfconvert.c
+@@ -45,6 +45,33 @@ void printusage (void);
+ void usageerror (void);
+ bool copyaudiodata (AFfilehandle infile, AFfilehandle outfile, int trackid);
+ 
++int firstBitSet(int x)
++{
++        int position=0;
++        while (x!=0)
++        {
++                x>>=1;
++                ++position;
++        }
++        return position;
++}
++
++#ifndef __has_builtin
++#define __has_builtin(x) 0
++#endif
++
++int multiplyCheckOverflow(int a, int b, int *result)
++{
++#if (defined __GNUC__ && __GNUC__ >= 5) || ( __clang__ && __has_builtin(__builtin_mul_overflow))
++       return __builtin_mul_overflow(a, b, result);
++#else
++       if (firstBitSet(a)+firstBitSet(b)>31) // int is signed, so we can't use 32 bits
++               return true;
++       *result = a * b;
++       return false;
++#endif
++}
++
+ int main (int argc, char **argv)
+ {
+        if (argc == 2)
+@@ -323,8 +350,11 @@ bool copyaudiodata (AFfilehandle infile, AFfilehandle outfile, int trackid)
+ {
+        int frameSize = afGetVirtualFrameSize(infile, trackid, 1);
+ 
+-       const int kBufferFrameCount = 65536;
+-       void *buffer = malloc(kBufferFrameCount * frameSize);
++       int kBufferFrameCount = 65536;
++       int bufferSize;
++       while (multiplyCheckOverflow(kBufferFrameCount, frameSize, &bufferSize))
++               kBufferFrameCount /= 2;
++       void *buffer = malloc(bufferSize);
+ 
+        AFframecount totalFrames = afGetFrameCount(infile, AF_DEFAULT_TRACK);
+        AFframecount totalFramesWritten = 0;
+-- 
+2.11.0
+
diff --git a/meta-oe/recipes-multimedia/audiofile/files/0007-Actually-fail-when-error-occurs-in-parseFormat.patch b/meta-oe/recipes-multimedia/audiofile/files/0007-Actually-fail-when-error-occurs-in-parseFormat.patch
new file mode 100644
index 0000000000..38294ca200
--- /dev/null
+++ b/meta-oe/recipes-multimedia/audiofile/files/0007-Actually-fail-when-error-occurs-in-parseFormat.patch
@@ -0,0 +1,46 @@
+From a2e9eab8ea87c4ffc494d839ebb4ea145eb9f2e6 Mon Sep 17 00:00:00 2001
+From: Antonio Larrosa <larrosa@kde.org>
+Date: Mon, 6 Mar 2017 18:59:26 +0100
+Subject: [PATCH] Actually fail when error occurs in parseFormat
+
+When there's an unsupported number of bits per sample or an invalid
+number of samples per block, don't only print an error message using
+the error handler, but actually stop parsing the file.
+
+This fixes #35 (also reported at
+https://bugzilla.opensuse.org/show_bug.cgi?id=1026983 and
+https://blogs.gentoo.org/ago/2017/02/20/audiofile-heap-based-buffer-overflow-in-imadecodeblockwave-ima-cpp/
+)
+
+Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
+
+CVE: CVE-2017-6831
+Upstream-Status: Inactive-Upstream [lastrelease: 2013]
+Signed-off-by: Peter Marko <peter.marko@siemens.com>
+---
+ libaudiofile/WAVE.cpp | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/libaudiofile/WAVE.cpp b/libaudiofile/WAVE.cpp
+index 0e81cf7..d762249 100644
+--- a/libaudiofile/WAVE.cpp
++++ b/libaudiofile/WAVE.cpp
+@@ -326,6 +326,7 @@ status WAVEFile::parseFormat(const Tag &id, uint32_t size)
+                        {
+                                _af_error(AF_BAD_NOT_IMPLEMENTED,
+                                        "IMA ADPCM compression supports only 4 bits per sample");
++                               return AF_FAIL;
+                        }
+ 
+                        int bytesPerBlock = (samplesPerBlock + 14) / 8 * 4 * channelCount;
+@@ -333,6 +334,7 @@ status WAVEFile::parseFormat(const Tag &id, uint32_t size)
+                        {
+                                _af_error(AF_BAD_CODEC_CONFIG,
+                                        "Invalid samples per block for IMA ADPCM compression");
++                               return AF_FAIL;
+                        }
+ 
+                        track->f.sampleWidth = 16;
+-- 
+2.11.0
+
diff --git a/meta-oe/recipes-multimedia/audiofile/files/0008-Check-for-multiplication-overflow-in-MSADPCM-decodeS.patch b/meta-oe/recipes-multimedia/audiofile/files/0008-Check-for-multiplication-overflow-in-MSADPCM-decodeS.patch
new file mode 100644
index 0000000000..857ed78c59
--- /dev/null
+++ b/meta-oe/recipes-multimedia/audiofile/files/0008-Check-for-multiplication-overflow-in-MSADPCM-decodeS.patch
@@ -0,0 +1,126 @@
+From beacc44eb8cdf6d58717ec1a5103c5141f1b37f9 Mon Sep 17 00:00:00 2001
+From: Antonio Larrosa <larrosa@kde.org>
+Date: Mon, 6 Mar 2017 13:43:53 +0100
+Subject: [PATCH] Check for multiplication overflow in MSADPCM decodeSample
+
+Check for multiplication overflow (using __builtin_mul_overflow
+if available) in MSADPCM.cpp decodeSample and return an empty
+decoded block if an error occurs.
+
+This fixes the 00193-audiofile-signintoverflow-MSADPCM case of #41
+
+Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
+
+CVE: CVE-2017-6839
+Upstream-Status: Inactive-Upstream [lastrelease: 2013]
+Signed-off-by: Peter Marko <peter.marko@siemens.com>
+---
+ libaudiofile/modules/BlockCodec.cpp |  5 ++--
+ libaudiofile/modules/MSADPCM.cpp    | 47 +++++++++++++++++++++++++++++++++----
+ 2 files changed, 46 insertions(+), 6 deletions(-)
+
+diff --git a/libaudiofile/modules/BlockCodec.cpp b/libaudiofile/modules/BlockCodec.cpp
+index 45925e8..4731be1 100644
+--- a/libaudiofile/modules/BlockCodec.cpp
++++ b/libaudiofile/modules/BlockCodec.cpp
+@@ -52,8 +52,9 @@ void BlockCodec::runPull()
+        // Decompress into m_outChunk.
+        for (int i=0; i<blocksRead; i++)
+        {
+-               decodeBlock(static_cast<const uint8_t *>(m_inChunk->buffer) + i * m_bytesPerPacket,
+-                       static_cast<int16_t *>(m_outChunk->buffer) + i * m_framesPerPacket * m_track->f.channelCount);
++               if (decodeBlock(static_cast<const uint8_t *>(m_inChunk->buffer) + i * m_bytesPerPacket,
++                       static_cast<int16_t *>(m_outChunk->buffer) + i * m_framesPerPacket * m_track->f.channelCount)==0)
++                       break;
+ 
+                framesRead += m_framesPerPacket;
+        }
+diff --git a/libaudiofile/modules/MSADPCM.cpp b/libaudiofile/modules/MSADPCM.cpp
+index 8ea3c85..ef9c38c 100644
+--- a/libaudiofile/modules/MSADPCM.cpp
++++ b/libaudiofile/modules/MSADPCM.cpp
+@@ -101,24 +101,60 @@ static const int16_t adaptationTable[] =
+        768, 614, 512, 409, 307, 230, 230, 230
+ };
+ 
++int firstBitSet(int x)
++{
++        int position=0;
++        while (x!=0)
++        {
++                x>>=1;
++                ++position;
++        }
++        return position;
++}
++
++#ifndef __has_builtin
++#define __has_builtin(x) 0
++#endif
++
++int multiplyCheckOverflow(int a, int b, int *result)
++{
++#if (defined __GNUC__ && __GNUC__ >= 5) || ( __clang__ && __has_builtin(__builtin_mul_overflow))
++       return __builtin_mul_overflow(a, b, result);
++#else
++       if (firstBitSet(a)+firstBitSet(b)>31) // int is signed, so we can't use 32 bits
++               return true;
++       *result = a * b;
++       return false;
++#endif
++}
++
++
+ // Compute a linear PCM value from the given differential coded value.
+ static int16_t decodeSample(ms_adpcm_state &state,
+-       uint8_t code, const int16_t *coefficient)
++       uint8_t code, const int16_t *coefficient, bool *ok=NULL)
+ {
+        int linearSample = (state.sample1 * coefficient[0] +
+                state.sample2 * coefficient[1]) >> 8;
++       int delta;
+ 
+        linearSample += ((code & 0x08) ? (code - 0x10) : code) * state.delta;
+ 
+        linearSample = clamp(linearSample, MIN_INT16, MAX_INT16);
+ 
+-       int delta = (state.delta * adaptationTable[code]) >> 8;
++       if (multiplyCheckOverflow(state.delta, adaptationTable[code], &delta))
++       {
++                if (ok) *ok=false;
++               _af_error(AF_BAD_COMPRESSION, "Error decoding sample");
++               return 0;
++       }
++       delta >>= 8;
+        if (delta < 16)
+                delta = 16;
+ 
+        state.delta = delta;
+        state.sample2 = state.sample1;
+        state.sample1 = linearSample;
++       if (ok) *ok=true;
+ 
+        return static_cast<int16_t>(linearSample);
+ }
+@@ -212,13 +248,16 @@ int MSADPCM::decodeBlock(const uint8_t *encoded, int16_t *decoded)
+        {
+                uint8_t code;
+                int16_t newSample;
++               bool ok;
+ 
+                code = *encoded >> 4;
+-               newSample = decodeSample(*state[0], code, coefficient[0]);
++               newSample = decodeSample(*state[0], code, coefficient[0], &ok);
++               if (!ok) return 0;
+                *decoded++ = newSample;
+ 
+                code = *encoded & 0x0f;
+-               newSample = decodeSample(*state[1], code, coefficient[1]);
++               newSample = decodeSample(*state[1], code, coefficient[1], &ok);
++               if (!ok) return 0;
+                *decoded++ = newSample;
+ 
+                encoded++;
+-- 
+2.11.0
+
diff --git a/meta-oe/recipes-multimedia/cdrkit/cdrkit_1.1.11.bb b/meta-oe/recipes-multimedia/cdrkit/cdrkit_1.1.11.bb
index 9fd91114d7..4b57957cfc 100644
--- a/meta-oe/recipes-multimedia/cdrkit/cdrkit_1.1.11.bb
+++ b/meta-oe/recipes-multimedia/cdrkit/cdrkit_1.1.11.bb
@@ -13,11 +13,11 @@ SRC_URI = "${DEBIAN_MIRROR}/main/c/${BPN}/${BPN}_${PV}.orig.tar.gz \
            file://0001-genisoimage-Add-missing-extern-definition.patch \
            file://0001-add-new-option-eltorito-platform.patch \
            file://0001-genisoimage-Add-checksum.h-and-md5.h-for-function-pr.patch \
+           file://fix-incompatible-pointer-type-error.patch \
            "
 SRC_URI:append:class-nativesdk = " \
            file://0001-install-netscsid-to-bin-for-nativesdk.patch \
 "
-SRC_URI[md5sum] = "efe08e2f3ca478486037b053acd512e9"
 SRC_URI[sha256sum] = "d1c030756ecc182defee9fe885638c1785d35a2c2a297b4604c0e0dcc78e47da"
 
 inherit cmake
@@ -62,3 +62,8 @@ do_install:append() {
 }
 
 BBCLASSEXTEND = "native nativesdk"
+
+# http://errors.yoctoproject.org/Errors/Details/766905/
+# cdrkit/1.1.11/cdrkit-1.1.11/genisoimage/eltorito.c:399:41: error: passing argument 1 of 'set_721' from incompatible pointer type [-Wincompatible-pointer-types]
+# cdrkit/1.1.11/cdrkit-1.1.11/genisoimage/eltorito.c:422:25: error: passing argument 1 of 'set_721' from incompatible pointer type [-Wincompatible-pointer-types]
+CFLAGS += "-Wno-error=incompatible-pointer-types"
diff --git a/meta-oe/recipes-multimedia/cdrkit/files/fix-incompatible-pointer-type-error.patch b/meta-oe/recipes-multimedia/cdrkit/files/fix-incompatible-pointer-type-error.patch
new file mode 100644
index 0000000000..887a54f7f2
--- /dev/null
+++ b/meta-oe/recipes-multimedia/cdrkit/files/fix-incompatible-pointer-type-error.patch
@@ -0,0 +1,44 @@
+Fix incompatible pointer type error when gcc option '-Wincompatible-pointer-types' set:
+
+cdrkit-1.1.11/genisoimage/eltorito.c:399:41: error: passing argument 1 of 'set_721' from incompatible pointer type [-Wincompatible-pointer-types]
+  399 |                                 set_721(&last_section_header->entry_count, nentries);
+      |                                         ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+      |                                         |
+      |                                         char (*)[2]
+In file included from cdrkit/1.1.11/cdrkit-1.1.11/genisoimage/eltorito.c:39:
+cdrkit-1.1.11/genisoimage/genisoimage.h:507:21: note: expected 'char *' but argument is of type 'char (*)[2]'
+  507 | extern void set_721(char *, unsigned int);
+      |                     ^~~~~~
+
+Upstream-Status: Inactive-Upstream [lastrelease: 2010]
+
+[1]: https://en.wikipedia.org/wiki/Cdrkit
+
+Signed-off-by: Kai Kang <kai.kang@windriver.com>
+
+---
+ genisoimage/eltorito.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/genisoimage/eltorito.c b/genisoimage/eltorito.c
+index a804988..e48d58c 100644
+--- a/genisoimage/eltorito.c
++++ b/genisoimage/eltorito.c
+@@ -396,7 +396,7 @@ get_torito_desc(struct eltorito_boot_descriptor *boot_desc)
+                            (arch != newarch) ||
+                            (current_boot_entry->type & ELTORITO_SECTION_HEADER)) {
+                        if (last_section_header)
+-                               set_721(&last_section_header->entry_count, nentries);
++                               set_721((char *)(&last_section_header->entry_count), nentries);
+                        nentries = 1;
+                        last_section_header = (struct eltorito_sectionheader_entry *)
+                                                        (de2->table + offset);
+@@ -419,7 +419,7 @@ get_torito_desc(struct eltorito_boot_descriptor *boot_desc)
+        }
+ 
+        if (last_section_header) {
+-               set_721(&last_section_header->entry_count, nentries);
++               set_721((char *)(&last_section_header->entry_count), nentries);
+                last_section_header->header_id[0] = EL_TORITO_SHDR_ID_LAST_SHDR;
+        }
+ 
diff --git a/meta-oe/recipes-multimedia/faad2/faad2_2.11.1.bb b/meta-oe/recipes-multimedia/faad2/faad2_2.11.2.bb
index bec9b75ebd..83fcaa248d 100644
--- a/meta-oe/recipes-multimedia/faad2/faad2_2.11.1.bb
+++ b/meta-oe/recipes-multimedia/faad2/faad2_2.11.2.bb
@@ -10,8 +10,7 @@ LICENSE_FLAGS = "commercial"
 PV .= "+git"
 
 SRC_URI = "git://github.com/knik0/faad2.git;branch=master;protocol=https"
-SRCREV = "216f00e8ddba6f2c64caf481a04f1ddd78b93e78"
+SRCREV = "673a22a3c7c33e96e2ff7aae7c4d2bc190dfbf92"
 
-S = "${WORKDIR}/git"
 
 inherit cmake
diff --git a/meta-oe/recipes-multimedia/id3lib/id3lib_3.8.3.bb b/meta-oe/recipes-multimedia/id3lib/id3lib_3.8.3.bb
index 379c7e1b63..7ae262345b 100644
--- a/meta-oe/recipes-multimedia/id3lib/id3lib_3.8.3.bb
+++ b/meta-oe/recipes-multimedia/id3lib/id3lib_3.8.3.bb
@@ -14,6 +14,8 @@ SRC_URI[archive.sha256sum] = "2749cc3c0cd7280b299518b1ddf5a5bcfe2d1100614519b687
 SRC_URI[patch.md5sum] = "997c764d3be11c9a51779d93facf1118"
 SRC_URI[patch.sha256sum] = "ac2ee23ec89ba2af51d2c6dd5b1b6bf9f8a9f813de251bc182941439a4053176"
 
+CVE_STATUS[CVE-2007-4460] = "patched: fix is included in debian patch"
+
 inherit autotools
 
 # Unlike other Debian packages, id3lib*.diff.gz contains another series of
diff --git a/meta-oe/recipes-multimedia/jack/a2jmidid_9.bb b/meta-oe/recipes-multimedia/jack/a2jmidid_9.bb
index bfdf26ed46..7f8988c3c3 100644
--- a/meta-oe/recipes-multimedia/jack/a2jmidid_9.bb
+++ b/meta-oe/recipes-multimedia/jack/a2jmidid_9.bb
@@ -16,7 +16,6 @@ SRC_URI = " \
     file://ppc_musl_ucontext.patch \
 "
 
-S = "${WORKDIR}/git"
 
 inherit meson pkgconfig
 
@@ -24,6 +23,6 @@ EXTRA_OEMESON = "-Db_lto=false"
 
 LDFLAGS:append:libc-musl = " -lexecinfo"
 
-export LINKFLAGS="${LDFLAGS}"
+export LINKFLAGS = "${LDFLAGS}"
 
 FILES:${PN} += "${datadir}/dbus-1/services"
diff --git a/meta-oe/recipes-multimedia/jack/jack-example-tools_4.bb b/meta-oe/recipes-multimedia/jack/jack-example-tools_4.bb
new file mode 100644
index 0000000000..58bbd8cac3
--- /dev/null
+++ b/meta-oe/recipes-multimedia/jack/jack-example-tools_4.bb
@@ -0,0 +1,33 @@
+DESCRIPTION = "JACK example tools and clients"
+SECTION = "libs/multimedia"
+
+LICENSE = "GPL-2.0-or-later"
+LIC_FILES_CHKSUM = "file://LICENSE;md5=4641e94ec96f98fabc56ff9cc48be14b"
+
+DEPENDS = "jack"
+
+SRC_URI = "git://github.com/jackaudio/jack-example-tools.git;branch=main;protocol=https"
+SRCREV = "33de8b4285fa5054af1b37fe0496c110604ed564"
+
+
+inherit meson pkgconfig
+
+PACKAGECONFIG ??= "alsa_in_out jack_rec"
+PACKAGECONFIG[alsa_in_out] = ",-Dalsa_in_out=disabled,alsa-lib"
+PACKAGECONFIG[jack_net] = ",-Djack_net=disabled"
+PACKAGECONFIG[jack_netsource] = ",-Djack_netsource=disabled,libopus"
+PACKAGECONFIG[jack_rec] = ",-Djack_rec=disabled"
+PACKAGECONFIG[opus_support] = ",-Dopus_support=disabled,libopus"
+PACKAGECONFIG[readline] = ",-Dreadline_support=disabled,readline"
+
+# ZALSA requires packages that are not available (libzita-alsa-pcmi and libzita-resampler)
+EXTRA_OECONF = "-Dzalsa=disabled"
+
+# jack recipe previously packaged jack-utils when these were part of the jack2 repository
+# keep using jack-utils package name to provide compatibility with old image recipes
+PACKAGES =+ "jack-utils"
+
+FILES:jack-utils = " \
+    ${bindir}/* \
+    ${libdir}/jack/*.so \
+"
diff --git a/meta-oe/recipes-multimedia/jack/jack_1.9.22.bb b/meta-oe/recipes-multimedia/jack/jack_1.9.22.bb
index bb844e4ff1..3b3ea85349 100644
--- a/meta-oe/recipes-multimedia/jack/jack_1.9.22.bb
+++ b/meta-oe/recipes-multimedia/jack/jack_1.9.22.bb
@@ -24,36 +24,26 @@ SRCREV = "4f58969432339a250ce87fe855fb962c67d00ddb"
 
 UPSTREAM_CHECK_GITTAGREGEX = "v(?P<pver>\d+(\.\d+)+)"
 
-S = "${WORKDIR}/git"
 
 inherit waf pkgconfig
 
 PACKAGECONFIG ??= "alsa"
 PACKAGECONFIG[alsa] = "--alsa=yes,--alsa=no,alsa-lib"
 # --dbus only stops building jackd -> add --classic
-PACKAGECONFIG[dbus] = "--dbus --classic,,dbus"
+PACKAGECONFIG[dbus] = "--dbus --classic,,dbus,python3-core"
 PACKAGECONFIG[opus] = "--opus=yes,--opus=no,libopus"
 
 # portaudio is for windows builds only
 EXTRA_OECONF = "--portaudio=no"
 
-do_install:append() {
-        if ! ${@bb.utils.contains('PACKAGECONFIG', 'dbus', True, False, d)}; then
-                rm -f ${D}${bindir}/jack_control
-        fi
-}
-
-PACKAGES =+ "libjack jack-server jack-utils"
+PACKAGE_BEFORE_PN = "libjack jack-server"
 
 RDEPENDS:jack-dev:remove = "${PN} (= ${EXTENDPKGV})"
 
 FILES:libjack = "${libdir}/*.so.* ${libdir}/jack/*.so"
+
 FILES:jack-server = " \
     ${datadir}/dbus-1/services \
     ${bindir}/jackdbus \
     ${bindir}/jackd \
 "
-FILES:jack-utils = "${bindir}/*"
-
-FILES:${PN}-doc += " ${datadir}/jack-audio-connection-kit/reference/html/*"
-
diff --git a/meta-oe/recipes-multimedia/libass/libass_0.17.1.bb b/meta-oe/recipes-multimedia/libass/libass_0.17.4.bb
index 800ad1b15e..3165736981 100644
--- a/meta-oe/recipes-multimedia/libass/libass_0.17.1.bb
+++ b/meta-oe/recipes-multimedia/libass/libass_0.17.4.bb
@@ -7,9 +7,8 @@ LIC_FILES_CHKSUM = "file://COPYING;md5=a42532a0684420bdb15556c3cdd49a75"
 
 DEPENDS = "fontconfig freetype fribidi harfbuzz"
 
-SRC_URI = "git://github.com/libass/libass.git;protocol=https;branch=0.17.1-branch"
-SRCREV = "e8ad72accd3a84268275a9385beb701c9284e5b3"
-S = "${WORKDIR}/git"
+SRC_URI = "git://github.com/libass/libass.git;protocol=https;branch=master"
+SRCREV = "bbb3c7f1570a4a021e52683f3fbdf74fe492ae84"
 
 inherit autotools pkgconfig
 
diff --git a/meta-oe/recipes-multimedia/libcdio/libcdio-paranoia_10.2+2.0.1.bb b/meta-oe/recipes-multimedia/libcdio/libcdio-paranoia_10.2+2.0.1.bb
index 53404e54a8..42507051f6 100644
--- a/meta-oe/recipes-multimedia/libcdio/libcdio-paranoia_10.2+2.0.1.bb
+++ b/meta-oe/recipes-multimedia/libcdio/libcdio-paranoia_10.2+2.0.1.bb
@@ -9,6 +9,9 @@ DEPENDS = "libcdio"
 SRC_URI = "${GNU_MIRROR}/libcdio/${BP}.tar.bz2"
 SRC_URI[sha256sum] = "33b1cf305ccfbfd03b43936975615000ce538b119989c4bec469577570b60e8a"
 
+UPSTREAM_CHECK_URI = "https://github.com/rocky/libcdio-paranoia/releases"
+UPSTREAM_CHECK_REGEX = "release-(?P<pver>\d+(\.\d+)+\+\d+(\.\d+)+)"
+
 inherit autotools pkgconfig
 
 PACKAGES += "${PN}-utils"
diff --git a/meta-oe/recipes-multimedia/libcdio/libcdio_2.1.0.bb b/meta-oe/recipes-multimedia/libcdio/libcdio_2.1.0.bb
index 8562462cba..d986f90d72 100644
--- a/meta-oe/recipes-multimedia/libcdio/libcdio_2.1.0.bb
+++ b/meta-oe/recipes-multimedia/libcdio/libcdio_2.1.0.bb
@@ -9,7 +9,6 @@ SRC_URI = "${GNU_MIRROR}/${BPN}/${BP}.tar.bz2 \
            file://Drop-LIBCDIO_SOURCE_PATH-by-dropping-STRIP_FROM_PATH.patch \
            "
 
-SRC_URI[md5sum] = "aa7629e8f73662a762f64c444b901055"
 SRC_URI[sha256sum] = "8550e9589dbd594bfac93b81ecf129b1dc9d0d51e90f9696f1b2f9b2af32712b"
 
 inherit autotools pkgconfig
diff --git a/meta-oe/recipes-multimedia/libid3tag/libid3tag_0.15.1b.bb b/meta-oe/recipes-multimedia/libid3tag/libid3tag_0.15.1b.bb
index 850918d319..23487329fb 100644
--- a/meta-oe/recipes-multimedia/libid3tag/libid3tag_0.15.1b.bb
+++ b/meta-oe/recipes-multimedia/libid3tag/libid3tag_0.15.1b.bb
@@ -19,9 +19,8 @@ SRC_URI = "${SOURCEFORGE_MIRROR}/mad/libid3tag-${PV}.tar.gz \
 UPSTREAM_CHECK_URI = "https://sourceforge.net/projects/mad/files/libid3tag/"
 UPSTREAM_CHECK_REGEX = "/projects/mad/files/libid3tag/(?P<pver>.*)/$"
 
-SRC_URI[md5sum] = "e5808ad997ba32c498803822078748c3"
 SRC_URI[sha256sum] = "63da4f6e7997278f8a3fef4c6a372d342f705051d1eeb6a46a86b03610e26151"
 
-S = "${WORKDIR}/libid3tag-${PV}"
+S = "${UNPACKDIR}/libid3tag-${PV}"
 
 inherit autotools pkgconfig
diff --git a/meta-oe/recipes-multimedia/libjxl/libjxl/0001-cmake-Do-not-use-mrelax-all-with-clang-on-RISCV64.patch b/meta-oe/recipes-multimedia/libjxl/libjxl/0001-cmake-Do-not-use-mrelax-all-with-clang-on-RISCV64.patch
new file mode 100644
index 0000000000..287dfc8ca8
--- /dev/null
+++ b/meta-oe/recipes-multimedia/libjxl/libjxl/0001-cmake-Do-not-use-mrelax-all-with-clang-on-RISCV64.patch
@@ -0,0 +1,56 @@
+From 0cf439c243dfdb6eee6133ee87172235a42e59c9 Mon Sep 17 00:00:00 2001
+From: Khem Raj <raj.khem@gmail.com>
+Date: Sat, 14 Sep 2024 22:04:06 +0000
+Subject: [PATCH] cmake: Do not use -mrelax-all with clang on RISCV64
+
+This option causes clang 19+ to crash on riscv64
+
+For RISC-V -mrelax-all causes the assembler stage to convert
+all conditional branches into
+
+  bcc reg, reg, tmplabel
+  jmp target
+tmplabel:
+
+Unconditional jmp can reach targets a lot further than a conditional branch.
+Unfortunately, jmp also has a limited range so sometimes needs to be
+converted to an indirect jump which requires a scratch register.
+We do all branch relaxation early for RISC-V during the compilation
+stage so we can allocate the scratch register.
+
+If the assembler also does branch relaxation it will increase the size
+of the function and may cause unconditional jmps to go out of range.
+If this happens, linking will fail.
+
+Upstream-Status: Submitted [https://github.com/libjxl/libjxl/pull/3826]
+Signed-off-by: Khem Raj <raj.khem@gmail.com>
+---
+ CMakeLists.txt | 2 +-
+ CONTRIBUTORS   | 1 +
+ 2 files changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/CMakeLists.txt b/CMakeLists.txt
+index 8b2ccb57..39bee096 100644
+--- a/CMakeLists.txt
++++ b/CMakeLists.txt
+@@ -335,7 +335,7 @@ else ()
+ 
+   # Machine flags.
+   add_compile_options(-funwind-tables)
+-  if (CMAKE_CXX_COMPILER_ID MATCHES "Clang")
++  if (CMAKE_CXX_COMPILER_ID MATCHES "Clang" AND NOT CMAKE_SYSTEM_PROCESSOR MATCHES "riscv")
+     add_compile_options("SHELL:-Xclang -mrelax-all")
+   endif()
+   if (CXX_CONSTRUCTOR_ALIASES_SUPPORTED)
+diff --git a/CONTRIBUTORS b/CONTRIBUTORS
+index 848096f9..a88c6157 100644
+--- a/CONTRIBUTORS
++++ b/CONTRIBUTORS
+@@ -10,6 +10,7 @@ Iulia-Maria Comșa
+ Jan Wassenberg
+ Jon Sneyers
+ Jyrki Alakuijala
++Khem Raj
+ Krzysztof Potempa
+ Lode Vandevenne
+ Luca Versari
diff --git a/meta-oe/recipes-multimedia/libjxl/libjxl_0.10.2.bb b/meta-oe/recipes-multimedia/libjxl/libjxl_0.10.3.bb
index eced6c7726..2405126e5c 100644
--- a/meta-oe/recipes-multimedia/libjxl/libjxl_0.10.2.bb
+++ b/meta-oe/recipes-multimedia/libjxl/libjxl_0.10.3.bb
@@ -8,17 +8,17 @@ inherit cmake pkgconfig mime
 
 DEPENDS = "highway brotli"
 
-SRC_URI = "gitsm://github.com/libjxl/libjxl.git;protocol=https;nobranch=1"
+SRC_URI = "gitsm://github.com/libjxl/libjxl.git;protocol=https;nobranch=1 \
+           file://0001-cmake-Do-not-use-mrelax-all-with-clang-on-RISCV64.patch \
+           "
 
-SRCREV = "e1489592a770b989303b0edc5cc1dc447bbe0515"
-S = "${WORKDIR}/git"
+SRCREV = "4a3b22d2600f92d8706fb72d85d52bfee2acbd54"
 
 EXTRA_OECMAKE = " \
         -DCMAKE_BUILD_TYPE=Release \
         -DJPEGXL_ENABLE_PLUGINS=ON \
         -DBUILD_TESTING=OFF \
         -DJPEGXL_WARNINGS_AS_ERRORS=OFF \
-        -DJPEGXL_ENABLE_SIZELESS_VECTORS=ON \
         -DJPEGXL_ENABLE_SJPEG=OFF \
         -DJPEGXL_ENABLE_BENCHMARK=OFF \
         -DJPEGXL_ENABLE_EXAMPLES=OFF \
@@ -31,9 +31,16 @@ EXTRA_OECMAKE = " \
         -DJPEGXL_ENABLE_TOOLS=OFF \
 "
 
-PACKAGECONFIG ?= "mime gdk-pixbuf-loader"
+PACKAGECONFIG ?= "mime gdk-pixbuf-loader sizeless-vectors"
+# libjxl/0.10.2/recipe-sysroot/usr/include/hwy/ops/rvv-inl.h:591:17: error: use
+# of undeclared identifier '__riscv_vsetvlmax_e8mf8'
+#  591 | HWY_RVV_FOREACH(HWY_RVV_LANES, Lanes, setvlmax_e, _ALL)
+#      |                 ^
+PACKAGECONFIG:remove:riscv64 = "sizeless-vectors"
+PACKAGECONFIG:remove:riscv32 = "sizeless-vectors"
 PACKAGECONFIG[gdk-pixbuf-loader] = "-DJPEGXL_ENABLE_PLUGIN_GDKPIXBUF=ON,-DJPEGXL_ENABLE_PLUGIN_GDKPIXBUF=OFF,gdk-pixbuf"
 PACKAGECONFIG[gimp] = "-DJPEGXL_ENABLE_PLUGIN_GIMP210=ON,-DJPEGXL_ENABLE_PLUGIN_GIMP210=OFF,gimp"
 PACKAGECONFIG[mime] = "-DJPEGXL_ENABLE_PLUGIN_MIME=ON,-DJPEGXL_ENABLE_PLUGIN_MIME=OFF"
+PACKAGECONFIG[sizeless-vectors] = "-DJPEGXL_ENABLE_SIZELESS_VECTORS=ON,-DJPEGXL_ENABLE_SIZELESS_VECTORS=OFF"
 
 FILES:${PN} += "${libdir}/gdk-pixbuf-2.0 ${datadir}"
diff --git a/meta-oe/recipes-multimedia/libmad/libmad/CVE-2017-8372_CVE-2017-8373.patch b/meta-oe/recipes-multimedia/libmad/libmad/CVE-2017-8372_CVE-2017-8373.patch
new file mode 100644
index 0000000000..a57df492d0
--- /dev/null
+++ b/meta-oe/recipes-multimedia/libmad/libmad/CVE-2017-8372_CVE-2017-8373.patch
@@ -0,0 +1,69 @@
+From 7e8f6e5118e31455924940141a761a1589e8d85d Mon Sep 17 00:00:00 2001
+From: Kurt Roeckx <kurt@roeckx.be>
+Date: Sun, 28 Jan 2018 15:44:08 +0100
+Subject: [PATCH] Check the size of the main data
+
+The main data to decode a frame can come from the current frame and part of the
+previous frame, the so called bit reservoir. si.main_data_begin is the part of
+the previous frame we need for this frame. frame_space is the amount of main
+data that can be in this frame, and next_md_begin is the part of this frame that
+is going to be used for the next frame.
+
+The maximum amount of data from a previous frame that the format allows is 511
+bytes. The maximum frame size for the defined bitrates is at MPEG 2.5 layer 2
+at 320 kbit/s and 8 kHz sample rate which gives 72 * (320000 / 8000) + 1 = 2881.
+So those defines are not large enough:
+ # define MAD_BUFFER_GUARD      8
+ # define MAD_BUFFER_MDLEN      (511 + 2048 + MAD_BUFFER_GUARD)
+
+There is also support for a "free" bitrate which allows you to create any frame
+size, which can be larger than the buffer.
+
+Changing the defines is not an option since it's part of the ABI, so we check
+that the main data fits in the bufer.
+
+The previous frame data is stored in *stream->main_data and contains
+stream->md_len bytes. If stream->md_len is larger than the data we
+need from the previous frame (si.main_data_begin) it still wouldn't fit
+in the buffer, so just keep the data that we need.
+
+Source: https://salsa.debian.org/multimedia-team/libmad/-/blob/debian/0.15.1b-11/debian/patches/md_size.diff?ref_type=tags
+
+CVE: CVE-2017-8372
+CVE: CVE-2017-8373
+Upstream-Status: Inactive-Upstream [lastrelease: 2018]
+Signed-off-by: Peter Marko <peter.marko@siemens.com>
+---
+ layer3.c | 12 ++++++++++--
+ 1 file changed, 10 insertions(+), 2 deletions(-)
+
+diff --git a/layer3.c b/layer3.c
+index 4e5d3fa..7dc4ca6 100644
+--- a/layer3.c
++++ b/layer3.c
+@@ -2608,6 +2608,11 @@ int mad_layer_III(struct mad_stream *stream, struct mad_frame *frame)
+     next_md_begin = 0;
+ 
+   md_len = si.main_data_begin + frame_space - next_md_begin;
++  if (md_len + MAD_BUFFER_GUARD > MAD_BUFFER_MDLEN) {
++    stream->error = MAD_ERROR_LOSTSYNC;
++    stream->sync = 0;
++    return -1;
++  }
+ 
+   frame_used = 0;
+ 
+@@ -2625,8 +2630,11 @@ int mad_layer_III(struct mad_stream *stream, struct mad_frame *frame)
+       }
+     }
+     else {
+-      mad_bit_init(&ptr,
+-                  *stream->main_data + stream->md_len - si.main_data_begin);
++      memmove(stream->main_data,
++       *stream->main_data + stream->md_len - si.main_data_begin,
++       si.main_data_begin);
++      stream->md_len = si.main_data_begin;
++      mad_bit_init(&ptr, *stream->main_data);
+ 
+       if (md_len > si.main_data_begin) {
+        assert(stream->md_len + md_len -
diff --git a/meta-oe/recipes-multimedia/libmad/libmad/CVE-2017-8374.patch b/meta-oe/recipes-multimedia/libmad/libmad/CVE-2017-8374.patch
new file mode 100644
index 0000000000..69a7153f07
--- /dev/null
+++ b/meta-oe/recipes-multimedia/libmad/libmad/CVE-2017-8374.patch
@@ -0,0 +1,830 @@
+From 05de6e0ddc2c911b725955d2af331ffd76aa8186 Mon Sep 17 00:00:00 2001
+From: Kurt Roeckx <kurt@roeckx.be>
+Date: Sun, 28 Jan 2018 19:26:36 +0100
+Subject: [PATCH] Check the size before reading with mad_bit_read
+
+There are various cases where it attemps to read past the end of the buffer
+using mad_bit_read(). Most functions didn't even know the size of the buffer
+they were reading from.
+
+Source: https://salsa.debian.org/multimedia-team/libmad/-/raw/debian/0.15.1b-11/debian/patches/length-check.patch?ref_type=tags
+
+CVE: CVE-2017-8374
+Upstream-Status: Inactive-Upstream [lastrelease: 2018]
+Signed-off-by: Peter Marko <peter.marko@siemens.com>
+---
+ bit.c     |   3 +
+ frame.c   |  20 +++++-
+ layer12.c | 112 +++++++++++++++++++++++++++---
+ layer3.c  | 198 ++++++++++++++++++++++++++++++++++++++----------------
+ 4 files changed, 262 insertions(+), 71 deletions(-)
+
+diff --git a/bit.c b/bit.c
+index c2bfb24..39ef50b 100644
+--- a/bit.c
++++ b/bit.c
+@@ -138,6 +138,9 @@ unsigned long mad_bit_read(struct mad_bitptr *bitptr, unsigned int len)
+ {
+   register unsigned long value;
+ 
++  if (len == 0)
++    return 0;
++
+   if (bitptr->left == CHAR_BIT)
+     bitptr->cache = *bitptr->byte;
+ 
+diff --git a/frame.c b/frame.c
+index 0cb3d0f..4b3aea8 100644
+--- a/frame.c
++++ b/frame.c
+@@ -120,11 +120,18 @@ static
+ int decode_header(struct mad_header *header, struct mad_stream *stream)
+ {
+   unsigned int index;
++  struct mad_bitptr bufend_ptr;
+ 
+   header->flags        = 0;
+   header->private_bits = 0;
+ 
++  mad_bit_init(&bufend_ptr, stream->bufend);
++
+   /* header() */
++  if (mad_bit_length(&stream->ptr, &bufend_ptr) < 32) {
++    stream->error = MAD_ERROR_BUFLEN;
++    return -1;
++  }
+ 
+   /* syncword */
+   mad_bit_skip(&stream->ptr, 11);
+@@ -225,8 +232,13 @@ int decode_header(struct mad_header *header, struct mad_stream *stream)
+   /* error_check() */
+ 
+   /* crc_check */
+-  if (header->flags & MAD_FLAG_PROTECTION)
++  if (header->flags & MAD_FLAG_PROTECTION) {
++    if (mad_bit_length(&stream->ptr, &bufend_ptr) < 16) {
++      stream->error = MAD_ERROR_BUFLEN;
++      return -1;
++    }
+     header->crc_target = mad_bit_read(&stream->ptr, 16);
++  }
+ 
+   return 0;
+ }
+@@ -338,7 +350,7 @@ int mad_header_decode(struct mad_header *header, struct mad_stream *stream)
+       stream->error = MAD_ERROR_BUFLEN;
+       goto fail;
+     }
+-    else if (!(ptr[0] == 0xff && (ptr[1] & 0xe0) == 0xe0)) {
++    else if ((end - ptr >= 2) && !(ptr[0] == 0xff && (ptr[1] & 0xe0) == 0xe0)) {
+       /* mark point where frame sync word was expected */
+       stream->this_frame = ptr;
+       stream->next_frame = ptr + 1;
+@@ -361,6 +373,8 @@ int mad_header_decode(struct mad_header *header, struct mad_stream *stream)
+     ptr = mad_bit_nextbyte(&stream->ptr);
+   }
+ 
++  stream->error = MAD_ERROR_NONE;
++
+   /* begin processing */
+   stream->this_frame = ptr;
+   stream->next_frame = ptr + 1;  /* possibly bogus sync word */
+@@ -413,7 +427,7 @@ int mad_header_decode(struct mad_header *header, struct mad_stream *stream)
+     /* check that a valid frame header follows this frame */
+ 
+     ptr = stream->next_frame;
+-    if (!(ptr[0] == 0xff && (ptr[1] & 0xe0) == 0xe0)) {
++    if ((end - ptr >= 2) && !(ptr[0] == 0xff && (ptr[1] & 0xe0) == 0xe0)) {
+       ptr = stream->next_frame = stream->this_frame + 1;
+       goto sync;
+     }
+diff --git a/layer12.c b/layer12.c
+index 6981f9c..b6f4a2f 100644
+--- a/layer12.c
++++ b/layer12.c
+@@ -72,10 +72,18 @@ mad_fixed_t const linear_table[14] = {
+  * DESCRIPTION:        decode one requantized Layer I sample from a bitstream
+  */
+ static
+-mad_fixed_t I_sample(struct mad_bitptr *ptr, unsigned int nb)
++mad_fixed_t I_sample(struct mad_bitptr *ptr, unsigned int nb, struct mad_stream *stream)
+ {
+   mad_fixed_t sample;
++  struct mad_bitptr frameend_ptr;
+ 
++  mad_bit_init(&frameend_ptr, stream->next_frame);
++
++  if (mad_bit_length(ptr, &frameend_ptr) < nb) {
++    stream->error = MAD_ERROR_LOSTSYNC;
++    stream->sync = 0;
++    return 0;
++  }
+   sample = mad_bit_read(ptr, nb);
+ 
+   /* invert most significant bit, extend sign, then scale to fixed format */
+@@ -106,6 +114,10 @@ int mad_layer_I(struct mad_stream *stream, struct mad_frame *frame)
+   struct mad_header *header = &frame->header;
+   unsigned int nch, bound, ch, s, sb, nb;
+   unsigned char allocation[2][32], scalefactor[2][32];
++  struct mad_bitptr bufend_ptr, frameend_ptr;
++
++  mad_bit_init(&bufend_ptr, stream->bufend);
++  mad_bit_init(&frameend_ptr, stream->next_frame);
+ 
+   nch = MAD_NCHANNELS(header);
+ 
+@@ -118,6 +130,11 @@ int mad_layer_I(struct mad_stream *stream, struct mad_frame *frame)
+   /* check CRC word */
+ 
+   if (header->flags & MAD_FLAG_PROTECTION) {
++    if (mad_bit_length(&stream->ptr, &bufend_ptr)
++               < 4 * (bound * nch + (32 - bound))) {
++      stream->error = MAD_ERROR_BADCRC;
++      return -1;
++    }
+     header->crc_check =
+       mad_bit_crc(stream->ptr, 4 * (bound * nch + (32 - bound)),
+                  header->crc_check);
+@@ -133,6 +150,11 @@ int mad_layer_I(struct mad_stream *stream, struct mad_frame *frame)
+ 
+   for (sb = 0; sb < bound; ++sb) {
+     for (ch = 0; ch < nch; ++ch) {
++      if (mad_bit_length(&stream->ptr, &frameend_ptr) < 4) {
++       stream->error = MAD_ERROR_LOSTSYNC;
++       stream->sync = 0;
++       return -1;
++      }
+       nb = mad_bit_read(&stream->ptr, 4);
+ 
+       if (nb == 15) {
+@@ -145,6 +167,11 @@ int mad_layer_I(struct mad_stream *stream, struct mad_frame *frame)
+   }
+ 
+   for (sb = bound; sb < 32; ++sb) {
++    if (mad_bit_length(&stream->ptr, &frameend_ptr) < 4) {
++      stream->error = MAD_ERROR_LOSTSYNC;
++      stream->sync = 0;
++      return -1;
++    }
+     nb = mad_bit_read(&stream->ptr, 4);
+ 
+     if (nb == 15) {
+@@ -161,6 +188,11 @@ int mad_layer_I(struct mad_stream *stream, struct mad_frame *frame)
+   for (sb = 0; sb < 32; ++sb) {
+     for (ch = 0; ch < nch; ++ch) {
+       if (allocation[ch][sb]) {
++        if (mad_bit_length(&stream->ptr, &frameend_ptr) < 6) {
++         stream->error = MAD_ERROR_LOSTSYNC;
++         stream->sync = 0;
++         return -1;
++       }
+        scalefactor[ch][sb] = mad_bit_read(&stream->ptr, 6);
+ 
+ # if defined(OPT_STRICT)
+@@ -185,8 +217,10 @@ int mad_layer_I(struct mad_stream *stream, struct mad_frame *frame)
+       for (ch = 0; ch < nch; ++ch) {
+        nb = allocation[ch][sb];
+        frame->sbsample[ch][s][sb] = nb ?
+-         mad_f_mul(I_sample(&stream->ptr, nb),
++         mad_f_mul(I_sample(&stream->ptr, nb, stream),
+                    sf_table[scalefactor[ch][sb]]) : 0;
++       if (stream->error != 0)
++         return -1;
+       }
+     }
+ 
+@@ -194,7 +228,14 @@ int mad_layer_I(struct mad_stream *stream, struct mad_frame *frame)
+       if ((nb = allocation[0][sb])) {
+        mad_fixed_t sample;
+ 
+-       sample = I_sample(&stream->ptr, nb);
++       if (mad_bit_length(&stream->ptr, &frameend_ptr) < nb) {
++         stream->error = MAD_ERROR_LOSTSYNC;
++         stream->sync = 0;
++          return -1;
++       }
++       sample = I_sample(&stream->ptr, nb, stream);
++        if (stream->error != 0)
++         return -1;
+ 
+        for (ch = 0; ch < nch; ++ch) {
+          frame->sbsample[ch][s][sb] =
+@@ -280,13 +321,21 @@ struct quantclass {
+ static
+ void II_samples(struct mad_bitptr *ptr,
+                struct quantclass const *quantclass,
+-               mad_fixed_t output[3])
++               mad_fixed_t output[3], struct mad_stream *stream)
+ {
+   unsigned int nb, s, sample[3];
++  struct mad_bitptr frameend_ptr;
++
++  mad_bit_init(&frameend_ptr, stream->next_frame);
+ 
+   if ((nb = quantclass->group)) {
+     unsigned int c, nlevels;
+ 
++    if (mad_bit_length(ptr, &frameend_ptr) < quantclass->bits) {
++      stream->error = MAD_ERROR_LOSTSYNC;
++      stream->sync = 0;
++      return;
++    }
+     /* degrouping */
+     c = mad_bit_read(ptr, quantclass->bits);
+     nlevels = quantclass->nlevels;
+@@ -299,8 +348,14 @@ void II_samples(struct mad_bitptr *ptr,
+   else {
+     nb = quantclass->bits;
+ 
+-    for (s = 0; s < 3; ++s)
++    for (s = 0; s < 3; ++s) {
++      if (mad_bit_length(ptr, &frameend_ptr) < nb) {
++       stream->error = MAD_ERROR_LOSTSYNC;
++       stream->sync = 0;
++       return;
++      }
+       sample[s] = mad_bit_read(ptr, nb);
++    }
+   }
+ 
+   for (s = 0; s < 3; ++s) {
+@@ -336,6 +391,9 @@ int mad_layer_II(struct mad_stream *stream, struct mad_frame *frame)
+   unsigned char const *offsets;
+   unsigned char allocation[2][32], scfsi[2][32], scalefactor[2][32][3];
+   mad_fixed_t samples[3];
++  struct mad_bitptr frameend_ptr;
++
++  mad_bit_init(&frameend_ptr, stream->next_frame);
+ 
+   nch = MAD_NCHANNELS(header);
+ 
+@@ -402,13 +460,24 @@ int mad_layer_II(struct mad_stream *stream, struct mad_frame *frame)
+   for (sb = 0; sb < bound; ++sb) {
+     nbal = bitalloc_table[offsets[sb]].nbal;
+ 
+-    for (ch = 0; ch < nch; ++ch)
++    for (ch = 0; ch < nch; ++ch) {
++      if (mad_bit_length(&stream->ptr, &frameend_ptr) < nbal) {
++       stream->error = MAD_ERROR_LOSTSYNC;
++       stream->sync = 0;
++       return -1;
++      }
+       allocation[ch][sb] = mad_bit_read(&stream->ptr, nbal);
++    }
+   }
+ 
+   for (sb = bound; sb < sblimit; ++sb) {
+     nbal = bitalloc_table[offsets[sb]].nbal;
+ 
++    if (mad_bit_length(&stream->ptr, &frameend_ptr) < nbal) {
++      stream->error = MAD_ERROR_LOSTSYNC;
++      stream->sync = 0;
++      return -1;
++    }
+     allocation[0][sb] =
+     allocation[1][sb] = mad_bit_read(&stream->ptr, nbal);
+   }
+@@ -417,8 +486,14 @@ int mad_layer_II(struct mad_stream *stream, struct mad_frame *frame)
+ 
+   for (sb = 0; sb < sblimit; ++sb) {
+     for (ch = 0; ch < nch; ++ch) {
+-      if (allocation[ch][sb])
++      if (allocation[ch][sb]) {
++       if (mad_bit_length(&stream->ptr, &frameend_ptr) < 2) {
++         stream->error = MAD_ERROR_LOSTSYNC;
++         stream->sync = 0;
++         return -1;
++       }
+        scfsi[ch][sb] = mad_bit_read(&stream->ptr, 2);
++      }
+     }
+   }
+ 
+@@ -441,6 +516,11 @@ int mad_layer_II(struct mad_stream *stream, struct mad_frame *frame)
+   for (sb = 0; sb < sblimit; ++sb) {
+     for (ch = 0; ch < nch; ++ch) {
+       if (allocation[ch][sb]) {
++       if (mad_bit_length(&stream->ptr, &frameend_ptr) < 6) {
++         stream->error = MAD_ERROR_LOSTSYNC;
++         stream->sync = 0;
++         return -1;
++       }
+        scalefactor[ch][sb][0] = mad_bit_read(&stream->ptr, 6);
+ 
+        switch (scfsi[ch][sb]) {
+@@ -451,11 +531,21 @@ int mad_layer_II(struct mad_stream *stream, struct mad_frame *frame)
+          break;
+ 
+        case 0:
++         if (mad_bit_length(&stream->ptr, &frameend_ptr) < 6) {
++           stream->error = MAD_ERROR_LOSTSYNC;
++           stream->sync = 0;
++           return -1;
++         }
+          scalefactor[ch][sb][1] = mad_bit_read(&stream->ptr, 6);
+          /* fall through */
+ 
+        case 1:
+        case 3:
++         if (mad_bit_length(&stream->ptr, &frameend_ptr) < 6) {
++           stream->error = MAD_ERROR_LOSTSYNC;
++           stream->sync = 0;
++           return -1;
++         }
+          scalefactor[ch][sb][2] = mad_bit_read(&stream->ptr, 6);
+        }
+ 
+@@ -487,7 +577,9 @@ int mad_layer_II(struct mad_stream *stream, struct mad_frame *frame)
+        if ((index = allocation[ch][sb])) {
+          index = offset_table[bitalloc_table[offsets[sb]].offset][index - 1];
+ 
+-         II_samples(&stream->ptr, &qc_table[index], samples);
++         II_samples(&stream->ptr, &qc_table[index], samples, stream);
++         if (stream->error != 0)
++            return -1;
+ 
+          for (s = 0; s < 3; ++s) {
+            frame->sbsample[ch][3 * gr + s][sb] =
+@@ -505,7 +597,9 @@ int mad_layer_II(struct mad_stream *stream, struct mad_frame *frame)
+       if ((index = allocation[0][sb])) {
+        index = offset_table[bitalloc_table[offsets[sb]].offset][index - 1];
+ 
+-       II_samples(&stream->ptr, &qc_table[index], samples);
++       II_samples(&stream->ptr, &qc_table[index], samples, stream);
++       if (stream->error != 0)
++          return -1;
+ 
+        for (ch = 0; ch < nch; ++ch) {
+          for (s = 0; s < 3; ++s) {
+diff --git a/layer3.c b/layer3.c
+index 7dc4ca6..59a81ed 100644
+--- a/layer3.c
++++ b/layer3.c
+@@ -598,7 +598,8 @@ enum mad_error III_sideinfo(struct mad_bitptr *ptr, unsigned int nch,
+ static
+ unsigned int III_scalefactors_lsf(struct mad_bitptr *ptr,
+                                  struct channel *channel,
+-                                 struct channel *gr1ch, int mode_extension)
++                                 struct channel *gr1ch, int mode_extension,
++                                 unsigned int bits_left, unsigned int *part2_length)
+ {
+   struct mad_bitptr start;
+   unsigned int scalefac_compress, index, slen[4], part, n, i;
+@@ -644,8 +645,12 @@ unsigned int III_scalefactors_lsf(struct mad_bitptr *ptr,
+ 
+     n = 0;
+     for (part = 0; part < 4; ++part) {
+-      for (i = 0; i < nsfb[part]; ++i)
++      for (i = 0; i < nsfb[part]; ++i) {
++       if (bits_left < slen[part])
++         return MAD_ERROR_BADSCFSI;
+        channel->scalefac[n++] = mad_bit_read(ptr, slen[part]);
++       bits_left -= slen[part];
++      }
+     }
+ 
+     while (n < 39)
+@@ -690,7 +695,10 @@ unsigned int III_scalefactors_lsf(struct mad_bitptr *ptr,
+       max = (1 << slen[part]) - 1;
+ 
+       for (i = 0; i < nsfb[part]; ++i) {
++       if (bits_left < slen[part])
++         return MAD_ERROR_BADSCFSI;
+        is_pos = mad_bit_read(ptr, slen[part]);
++       bits_left -= slen[part];
+ 
+        channel->scalefac[n] = is_pos;
+        gr1ch->scalefac[n++] = (is_pos == max);
+@@ -703,7 +711,8 @@ unsigned int III_scalefactors_lsf(struct mad_bitptr *ptr,
+     }
+   }
+ 
+-  return mad_bit_length(&start, ptr);
++  *part2_length = mad_bit_length(&start, ptr);
++  return MAD_ERROR_NONE;
+ }
+ 
+ /*
+@@ -712,7 +721,8 @@ unsigned int III_scalefactors_lsf(struct mad_bitptr *ptr,
+  */
+ static
+ unsigned int III_scalefactors(struct mad_bitptr *ptr, struct channel *channel,
+-                             struct channel const *gr0ch, unsigned int scfsi)
++                             struct channel const *gr0ch, unsigned int scfsi,
++                             unsigned int bits_left, unsigned int *part2_length)
+ {
+   struct mad_bitptr start;
+   unsigned int slen1, slen2, sfbi;
+@@ -728,12 +738,20 @@ unsigned int III_scalefactors(struct mad_bitptr *ptr, struct channel *channel,
+     sfbi = 0;
+ 
+     nsfb = (channel->flags & mixed_block_flag) ? 8 + 3 * 3 : 6 * 3;
+-    while (nsfb--)
++    while (nsfb--) {
++      if (bits_left < slen1)
++       return MAD_ERROR_BADSCFSI;
+       channel->scalefac[sfbi++] = mad_bit_read(ptr, slen1);
++      bits_left -= slen1;
++    }
+ 
+     nsfb = 6 * 3;
+-    while (nsfb--)
++    while (nsfb--) {
++      if (bits_left < slen2)
++       return MAD_ERROR_BADSCFSI;
+       channel->scalefac[sfbi++] = mad_bit_read(ptr, slen2);
++      bits_left -= slen2;
++    }
+ 
+     nsfb = 1 * 3;
+     while (nsfb--)
+@@ -745,8 +763,12 @@ unsigned int III_scalefactors(struct mad_bitptr *ptr, struct channel *channel,
+        channel->scalefac[sfbi] = gr0ch->scalefac[sfbi];
+     }
+     else {
+-      for (sfbi = 0; sfbi < 6; ++sfbi)
++      for (sfbi = 0; sfbi < 6; ++sfbi) {
++       if (bits_left < slen1)
++         return MAD_ERROR_BADSCFSI;
+        channel->scalefac[sfbi] = mad_bit_read(ptr, slen1);
++       bits_left -= slen1;
++      }
+     }
+ 
+     if (scfsi & 0x4) {
+@@ -754,8 +776,12 @@ unsigned int III_scalefactors(struct mad_bitptr *ptr, struct channel *channel,
+        channel->scalefac[sfbi] = gr0ch->scalefac[sfbi];
+     }
+     else {
+-      for (sfbi = 6; sfbi < 11; ++sfbi)
++      for (sfbi = 6; sfbi < 11; ++sfbi) {
++       if (bits_left < slen1)
++         return MAD_ERROR_BADSCFSI;
+        channel->scalefac[sfbi] = mad_bit_read(ptr, slen1);
++       bits_left -= slen1;
++      }
+     }
+ 
+     if (scfsi & 0x2) {
+@@ -763,8 +789,12 @@ unsigned int III_scalefactors(struct mad_bitptr *ptr, struct channel *channel,
+        channel->scalefac[sfbi] = gr0ch->scalefac[sfbi];
+     }
+     else {
+-      for (sfbi = 11; sfbi < 16; ++sfbi)
++      for (sfbi = 11; sfbi < 16; ++sfbi) {
++       if (bits_left < slen2)
++         return MAD_ERROR_BADSCFSI;
+        channel->scalefac[sfbi] = mad_bit_read(ptr, slen2);
++       bits_left -= slen2;
++      }
+     }
+ 
+     if (scfsi & 0x1) {
+@@ -772,14 +802,19 @@ unsigned int III_scalefactors(struct mad_bitptr *ptr, struct channel *channel,
+        channel->scalefac[sfbi] = gr0ch->scalefac[sfbi];
+     }
+     else {
+-      for (sfbi = 16; sfbi < 21; ++sfbi)
++      for (sfbi = 16; sfbi < 21; ++sfbi) {
++       if (bits_left < slen2)
++         return MAD_ERROR_BADSCFSI;
+        channel->scalefac[sfbi] = mad_bit_read(ptr, slen2);
++       bits_left -= slen2;
++      }
+     }
+ 
+     channel->scalefac[21] = 0;
+   }
+ 
+-  return mad_bit_length(&start, ptr);
++  *part2_length = mad_bit_length(&start, ptr);
++  return MAD_ERROR_NONE;
+ }
+ 
+ /*
+@@ -933,19 +968,17 @@ static
+ enum mad_error III_huffdecode(struct mad_bitptr *ptr, mad_fixed_t xr[576],
+                              struct channel *channel,
+                              unsigned char const *sfbwidth,
+-                             unsigned int part2_length)
++                             signed int part3_length)
+ {
+   signed int exponents[39], exp;
+   signed int const *expptr;
+   struct mad_bitptr peek;
+-  signed int bits_left, cachesz;
++  signed int bits_left, cachesz, fakebits;
+   register mad_fixed_t *xrptr;
+   mad_fixed_t const *sfbound;
+   register unsigned long bitcache;
+ 
+-  bits_left = (signed) channel->part2_3_length - (signed) part2_length;
+-  if (bits_left < 0)
+-    return MAD_ERROR_BADPART3LEN;
++  bits_left = part3_length;
+ 
+   III_exponents(channel, sfbwidth, exponents);
+ 
+@@ -956,8 +989,12 @@ enum mad_error III_huffdecode(struct mad_bitptr *ptr, mad_fixed_t xr[576],
+   cachesz  = mad_bit_bitsleft(&peek);
+   cachesz += ((32 - 1 - 24) + (24 - cachesz)) & ~7;
+ 
++  if (bits_left < cachesz) {
++    cachesz = bits_left;
++  }
+   bitcache   = mad_bit_read(&peek, cachesz);
+   bits_left -= cachesz;
++  fakebits = 0;
+ 
+   xrptr = &xr[0];
+ 
+@@ -986,7 +1023,7 @@ enum mad_error III_huffdecode(struct mad_bitptr *ptr, mad_fixed_t xr[576],
+ 
+     big_values = channel->big_values;
+ 
+-    while (big_values-- && cachesz + bits_left > 0) {
++    while (big_values-- && cachesz + bits_left - fakebits > 0) {
+       union huffpair const *pair;
+       unsigned int clumpsz, value;
+       register mad_fixed_t requantized;
+@@ -1023,10 +1060,19 @@ enum mad_error III_huffdecode(struct mad_bitptr *ptr, mad_fixed_t xr[576],
+        unsigned int bits;
+ 
+        bits       = ((32 - 1 - 21) + (21 - cachesz)) & ~7;
++       if (bits_left < bits) {
++         bits = bits_left;
++       }
+        bitcache   = (bitcache << bits) | mad_bit_read(&peek, bits);
+        cachesz   += bits;
+        bits_left -= bits;
+       }
++      if (cachesz < 21) {
++       unsigned int bits = 21 - cachesz;
++       bitcache <<= bits;
++       cachesz += bits;
++       fakebits += bits;
++      }
+ 
+       /* hcod (0..19) */
+ 
+@@ -1041,6 +1087,8 @@ enum mad_error III_huffdecode(struct mad_bitptr *ptr, mad_fixed_t xr[576],
+       }
+ 
+       cachesz -= pair->value.hlen;
++      if (cachesz < fakebits)
++       return MAD_ERROR_BADHUFFDATA;
+ 
+       if (linbits) {
+        /* x (0..14) */
+@@ -1054,10 +1102,15 @@ enum mad_error III_huffdecode(struct mad_bitptr *ptr, mad_fixed_t xr[576],
+ 
+        case 15:
+          if (cachesz < linbits + 2) {
+-           bitcache   = (bitcache << 16) | mad_bit_read(&peek, 16);
+-           cachesz   += 16;
+-           bits_left -= 16;
++           unsigned int bits = 16;
++           if (bits_left < 16)
++             bits = bits_left;
++           bitcache   = (bitcache << bits) | mad_bit_read(&peek, bits);
++           cachesz   += bits;
++           bits_left -= bits;
+          }
++         if (cachesz - fakebits < linbits)
++           return MAD_ERROR_BADHUFFDATA;
+ 
+          value += MASK(bitcache, cachesz, linbits);
+          cachesz -= linbits;
+@@ -1074,6 +1127,8 @@ enum mad_error III_huffdecode(struct mad_bitptr *ptr, mad_fixed_t xr[576],
+          }
+ 
+        x_final:
++         if (cachesz - fakebits < 1)
++           return MAD_ERROR_BADHUFFDATA;
+          xrptr[0] = MASK1BIT(bitcache, cachesz--) ?
+            -requantized : requantized;
+        }
+@@ -1089,10 +1144,15 @@ enum mad_error III_huffdecode(struct mad_bitptr *ptr, mad_fixed_t xr[576],
+ 
+        case 15:
+          if (cachesz < linbits + 1) {
+-           bitcache   = (bitcache << 16) | mad_bit_read(&peek, 16);
+-           cachesz   += 16;
+-           bits_left -= 16;
++           unsigned int bits = 16;
++           if (bits_left < 16)
++             bits = bits_left;
++           bitcache   = (bitcache << bits) | mad_bit_read(&peek, bits);
++           cachesz   += bits;
++           bits_left -= bits;
+          }
++         if (cachesz - fakebits < linbits)
++           return MAD_ERROR_BADHUFFDATA;
+ 
+          value += MASK(bitcache, cachesz, linbits);
+          cachesz -= linbits;
+@@ -1109,6 +1169,8 @@ enum mad_error III_huffdecode(struct mad_bitptr *ptr, mad_fixed_t xr[576],
+          }
+ 
+        y_final:
++         if (cachesz - fakebits < 1)
++           return MAD_ERROR_BADHUFFDATA;
+          xrptr[1] = MASK1BIT(bitcache, cachesz--) ?
+            -requantized : requantized;
+        }
+@@ -1128,6 +1190,8 @@ enum mad_error III_huffdecode(struct mad_bitptr *ptr, mad_fixed_t xr[576],
+            requantized = reqcache[value] = III_requantize(value, exp);
+          }
+ 
++         if (cachesz - fakebits < 1)
++           return MAD_ERROR_BADHUFFDATA;
+          xrptr[0] = MASK1BIT(bitcache, cachesz--) ?
+            -requantized : requantized;
+        }
+@@ -1146,6 +1210,8 @@ enum mad_error III_huffdecode(struct mad_bitptr *ptr, mad_fixed_t xr[576],
+            requantized = reqcache[value] = III_requantize(value, exp);
+          }
+ 
++         if (cachesz - fakebits < 1)
++           return MAD_ERROR_BADHUFFDATA;
+          xrptr[1] = MASK1BIT(bitcache, cachesz--) ?
+            -requantized : requantized;
+        }
+@@ -1155,9 +1221,6 @@ enum mad_error III_huffdecode(struct mad_bitptr *ptr, mad_fixed_t xr[576],
+     }
+   }
+ 
+-  if (cachesz + bits_left < 0)
+-    return MAD_ERROR_BADHUFFDATA;  /* big_values overrun */
+-
+   /* count1 */
+   {
+     union huffquad const *table;
+@@ -1167,15 +1230,24 @@ enum mad_error III_huffdecode(struct mad_bitptr *ptr, mad_fixed_t xr[576],
+ 
+     requantized = III_requantize(1, exp);
+ 
+-    while (cachesz + bits_left > 0 && xrptr <= &xr[572]) {
++    while (cachesz + bits_left - fakebits > 0 && xrptr <= &xr[572]) {
+       union huffquad const *quad;
+ 
+       /* hcod (1..6) */
+ 
+       if (cachesz < 10) {
+-       bitcache   = (bitcache << 16) | mad_bit_read(&peek, 16);
+-       cachesz   += 16;
+-       bits_left -= 16;
++       unsigned int bits = 16;
++       if (bits_left < 16)
++         bits = bits_left;
++       bitcache   = (bitcache << bits) | mad_bit_read(&peek, bits);
++       cachesz   += bits;
++       bits_left -= bits;
++      }
++      if (cachesz < 10) {
++       unsigned int bits = 10 - cachesz;
++       bitcache <<= bits;
++       cachesz += bits;
++       fakebits += bits;
+       }
+ 
+       quad = &table[MASK(bitcache, cachesz, 4)];
+@@ -1188,6 +1260,11 @@ enum mad_error III_huffdecode(struct mad_bitptr *ptr, mad_fixed_t xr[576],
+                      MASK(bitcache, cachesz, quad->ptr.bits)];
+       }
+ 
++      if (cachesz - fakebits < quad->value.hlen + quad->value.v
++        + quad->value.w + quad->value.x + quad->value.y)
++       /* We don't have enough bits to read one more entry, consider them
++        * stuffing bits. */
++       break;
+       cachesz -= quad->value.hlen;
+ 
+       if (xrptr == sfbound) {
+@@ -1236,22 +1313,8 @@ enum mad_error III_huffdecode(struct mad_bitptr *ptr, mad_fixed_t xr[576],
+ 
+       xrptr += 2;
+     }
+-
+-    if (cachesz + bits_left < 0) {
+-# if 0 && defined(DEBUG)
+-      fprintf(stderr, "huffman count1 overrun (%d bits)\n",
+-             -(cachesz + bits_left));
+-# endif
+-
+-      /* technically the bitstream is misformatted, but apparently
+-        some encoders are just a bit sloppy with stuffing bits */
+-
+-      xrptr -= 4;
+-    }
+   }
+ 
+-  assert(-bits_left <= MAD_BUFFER_GUARD * CHAR_BIT);
+-
+ # if 0 && defined(DEBUG)
+   if (bits_left < 0)
+     fprintf(stderr, "read %d bits too many\n", -bits_left);
+@@ -2348,10 +2411,11 @@ void III_freqinver(mad_fixed_t sample[18][32], unsigned int sb)
+  */
+ static
+ enum mad_error III_decode(struct mad_bitptr *ptr, struct mad_frame *frame,
+-                         struct sideinfo *si, unsigned int nch)
++                         struct sideinfo *si, unsigned int nch, unsigned int md_len)
+ {
+   struct mad_header *header = &frame->header;
+   unsigned int sfreqi, ngr, gr;
++  int bits_left = md_len * CHAR_BIT;
+ 
+   {
+     unsigned int sfreq;
+@@ -2383,6 +2447,7 @@ enum mad_error III_decode(struct mad_bitptr *ptr, struct mad_frame *frame,
+     for (ch = 0; ch < nch; ++ch) {
+       struct channel *channel = &granule->ch[ch];
+       unsigned int part2_length;
++      unsigned int part3_length;
+ 
+       sfbwidth[ch] = sfbwidth_table[sfreqi].l;
+       if (channel->block_type == 2) {
+@@ -2391,18 +2456,30 @@ enum mad_error III_decode(struct mad_bitptr *ptr, struct mad_frame *frame,
+       }
+ 
+       if (header->flags & MAD_FLAG_LSF_EXT) {
+-       part2_length = III_scalefactors_lsf(ptr, channel,
++       error = III_scalefactors_lsf(ptr, channel,
+                                            ch == 0 ? 0 : &si->gr[1].ch[1],
+-                                           header->mode_extension);
++                                           header->mode_extension, bits_left, &part2_length);
+       }
+       else {
+-       part2_length = III_scalefactors(ptr, channel, &si->gr[0].ch[ch],
+-                                       gr == 0 ? 0 : si->scfsi[ch]);
++       error = III_scalefactors(ptr, channel, &si->gr[0].ch[ch],
++                                       gr == 0 ? 0 : si->scfsi[ch], bits_left, &part2_length);
+       }
++      if (error)
++        return error;
+ 
+-      error = III_huffdecode(ptr, xr[ch], channel, sfbwidth[ch], part2_length);
++      bits_left -= part2_length;
++
++      if (part2_length > channel->part2_3_length)
++        return MAD_ERROR_BADPART3LEN;
++
++      part3_length = channel->part2_3_length - part2_length;
++      if (part3_length > bits_left)
++        return MAD_ERROR_BADPART3LEN;
++
++      error = III_huffdecode(ptr, xr[ch], channel, sfbwidth[ch], part3_length);
+       if (error)
+        return error;
++      bits_left -= part3_length;
+     }
+ 
+     /* joint stereo processing */
+@@ -2519,11 +2596,13 @@ int mad_layer_III(struct mad_stream *stream, struct mad_frame *frame)
+   unsigned int nch, priv_bitlen, next_md_begin = 0;
+   unsigned int si_len, data_bitlen, md_len;
+   unsigned int frame_space, frame_used, frame_free;
+-  struct mad_bitptr ptr;
++  struct mad_bitptr ptr, bufend_ptr;
+   struct sideinfo si;
+   enum mad_error error;
+   int result = 0;
+ 
++  mad_bit_init(&bufend_ptr, stream->bufend);
++
+   /* allocate Layer III dynamic structures */
+ 
+   if (stream->main_data == 0) {
+@@ -2587,14 +2666,15 @@ int mad_layer_III(struct mad_stream *stream, struct mad_frame *frame)
+     unsigned long header;
+ 
+     mad_bit_init(&peek, stream->next_frame);
++    if (mad_bit_length(&peek, &bufend_ptr) >= 57) {
++      header = mad_bit_read(&peek, 32);
++      if ((header & 0xffe60000L) /* syncword | layer */ == 0xffe20000L) {
++        if (!(header & 0x00010000L))  /* protection_bit */
++         mad_bit_skip(&peek, 16);  /* crc_check */
+ 
+-    header = mad_bit_read(&peek, 32);
+-    if ((header & 0xffe60000L) /* syncword | layer */ == 0xffe20000L) {
+-      if (!(header & 0x00010000L))  /* protection_bit */
+-       mad_bit_skip(&peek, 16);  /* crc_check */
+-
+-      next_md_begin =
+-       mad_bit_read(&peek, (header & 0x00080000L) /* ID */ ? 9 : 8);
++        next_md_begin =
++         mad_bit_read(&peek, (header & 0x00080000L) /* ID */ ? 9 : 8);
++      }
+     }
+ 
+     mad_bit_finish(&peek);
+@@ -2653,7 +2733,7 @@ int mad_layer_III(struct mad_stream *stream, struct mad_frame *frame)
+   /* decode main_data */
+ 
+   if (result == 0) {
+-    error = III_decode(&ptr, frame, &si, nch);
++    error = III_decode(&ptr, frame, &si, nch, md_len);
+     if (error) {
+       stream->error = error;
+       result = -1;
diff --git a/meta-oe/recipes-multimedia/libmad/libmad_0.15.1b.bb b/meta-oe/recipes-multimedia/libmad/libmad_0.15.1b.bb
index e70c8e3ed1..0f89574b9a 100644
--- a/meta-oe/recipes-multimedia/libmad/libmad_0.15.1b.bb
+++ b/meta-oe/recipes-multimedia/libmad/libmad_0.15.1b.bb
@@ -16,12 +16,16 @@ SRC_URI = "https://downloads.sourceforge.net/mad/libmad-${PV}.tar.gz \
     file://obsolete_automake_macros.patch \
     file://automake-foreign.patch \
     file://0001-configure-Respect-the-cflags-from-environment.patch \
+    file://CVE-2017-8372_CVE-2017-8373.patch \
+    file://CVE-2017-8374.patch \
 "
 SRC_URI:append:toolchain-clang = " file://0004-Remove-clang-unsupported-compiler-flags.patch "
 
 SRC_URI[sha256sum] = "bbfac3ed6bfbc2823d3775ebb931087371e142bb0e9bb1bee51a76a6e0078690"
 
-S = "${WORKDIR}/libmad-${PV}"
+CVE_PRODUCT:append = " mad_libmad"
+
+S = "${UNPACKDIR}/libmad-${PV}"
 
 inherit autotools pkgconfig
 
@@ -34,3 +38,6 @@ do_configure:prepend () {
 }
 
 ARM_INSTRUCTION_SET = "arm"
+
+CVE_STATUS[CVE-2017-11552] = "cpe-incorrect: this CVE is for mpg321, not libmad"
+CVE_STATUS[CVE-2018-7263] = "cpe-incorrect: this CVE is for mpg321, not libmad"
diff --git a/meta-oe/recipes-multimedia/libmms/libmms_0.6.4.bb b/meta-oe/recipes-multimedia/libmms/libmms_0.6.4.bb
index 62c20c6122..9fcb8a1dc0 100644
--- a/meta-oe/recipes-multimedia/libmms/libmms_0.6.4.bb
+++ b/meta-oe/recipes-multimedia/libmms/libmms_0.6.4.bb
@@ -6,7 +6,6 @@ LICENSE = "LGPL-2.0-or-later"
 LIC_FILES_CHKSUM = "file://COPYING.LIB;md5=fad9b3332be894bab9bc501572864b29"
 
 SRC_URI = "${SOURCEFORGE_MIRROR}/project/${BPN}/${BPN}/${PV}/${BP}.tar.gz"
-SRC_URI[md5sum] = "d6b665b335a6360e000976e770da7691"
 SRC_URI[sha256sum] = "3c05e05aebcbfcc044d9e8c2d4646cd8359be39a3f0ba8ce4e72a9094bee704f"
 
 inherit autotools pkgconfig
diff --git a/meta-oe/recipes-multimedia/libopus/libopus_1.5.2.bb b/meta-oe/recipes-multimedia/libopus/libopus_1.5.2.bb
index 02958ef023..642f34f71d 100644
--- a/meta-oe/recipes-multimedia/libopus/libopus_1.5.2.bb
+++ b/meta-oe/recipes-multimedia/libopus/libopus_1.5.2.bb
@@ -11,7 +11,7 @@ LIC_FILES_CHKSUM = "file://COPYING;md5=4b365c2155d66e550e1447075d6744a5"
 SRC_URI = "http://downloads.xiph.org/releases/opus/opus-${PV}.tar.gz"
 SRC_URI[sha256sum] = "65c1d2f78b9f2fb20082c38cbe47c951ad5839345876e46941612ee87f9a7ce1"
 
-S = "${WORKDIR}/opus-${PV}"
+S = "${UNPACKDIR}/opus-${PV}"
 
 inherit autotools pkgconfig
 
diff --git a/meta-oe/recipes-multimedia/libopusenc/libopusenc_0.2.1.bb b/meta-oe/recipes-multimedia/libopusenc/libopusenc_0.2.1.bb
index 596c5fe86d..fb822d7a0e 100644
--- a/meta-oe/recipes-multimedia/libopusenc/libopusenc_0.2.1.bb
+++ b/meta-oe/recipes-multimedia/libopusenc/libopusenc_0.2.1.bb
@@ -8,12 +8,12 @@ LIC_FILES_CHKSUM = "file://COPYING;md5=174b92049c2c697eb73112801662a07c"
 
 DEPENDS = "libopus"
 
-UPSTREAM_CHECK_URI = "https://github.com/xiph/libopusenc/releases"
+UPSTREAM_CHECK_URI = "https://github.com/xiph/libopusenc/tags"
+UPSTREAM_CHECK_REGEX = "releases/tag/v(?P<pver>\d+(\.\d+)+)"
 
 SRC_URI = "https://ftp.osuosl.org/pub/xiph/releases/opus/libopusenc-${PV}.tar.gz"
-SRC_URI[md5sum] = "f038ea0f4168d184c76b42d293697c57"
 SRC_URI[sha256sum] = "8298db61a8d3d63e41c1a80705baa8ce9ff3f50452ea7ec1c19a564fe106cbb9"
 
-S = "${WORKDIR}/libopusenc-${PV}"
+S = "${UNPACKDIR}/libopusenc-${PV}"
 
 inherit autotools pkgconfig
diff --git a/meta-oe/recipes-multimedia/libxmp/libxmp_4.6.3.bb b/meta-oe/recipes-multimedia/libxmp/libxmp_4.6.3.bb
new file mode 100644
index 0000000000..c302f65ed5
--- /dev/null
+++ b/meta-oe/recipes-multimedia/libxmp/libxmp_4.6.3.bb
@@ -0,0 +1,10 @@
+SUMMARY = "Extended Module Player Library"
+HOMEPAGE = "http://xmp.sourceforge.net/"
+LICENSE = "MIT"
+LIC_FILES_CHKSUM = "file://README;beginline=59;md5=ea030bd80f99071b0d3f9a9f752d1ca8"
+
+inherit cmake pkgconfig
+
+SRC_URI = "git://github.com/libxmp/libxmp.git;protocol=https;branch=master;tag=libxmp-${PV}"
+SRCREV = "bed660f8e530d399c38f27a5a7732f4e79740585"
+
diff --git a/meta-oe/recipes-multimedia/live555/live555_20210824.bb b/meta-oe/recipes-multimedia/live555/live555_20210824.bb
index a899049b77..1622a97fe1 100644
--- a/meta-oe/recipes-multimedia/live555/live555_20210824.bb
+++ b/meta-oe/recipes-multimedia/live555/live555_20210824.bb
@@ -18,7 +18,7 @@ MIRRORS += "http://www.live555.com/liveMedia/public/ http://download.videolan.or
 
 SRC_URI[sha256sum] = "ce95a1c79f6d18e959f9dc129b8529b711c60e76754acc285e60946303b923ec"
 
-S = "${WORKDIR}/live"
+S = "${UNPACKDIR}/live"
 
 LIC_FILES_CHKSUM = "file://COPYING;md5=d32239bcb673463ab874e80d47fae504 \
                     file://COPYING.LESSER;md5=e6a600fd5e1d9cbde2d983680233ad02 \
@@ -27,7 +27,7 @@ LIC_FILES_CHKSUM = "file://COPYING;md5=d32239bcb673463ab874e80d47fae504 \
 TARGET_CC_ARCH += "${LDFLAGS}"
 
 do_configure() {
-    cp ${WORKDIR}/config.linux-cross .
+    cp ${UNPACKDIR}/config.linux-cross .
     echo "COMPILE_OPTS+=" -fPIC -DXLOCALE_NOT_USED"" >> config.linux-cross
     ./genMakefiles linux-cross
 }
diff --git a/meta-oe/recipes-multimedia/mikmod/libmikmod_3.3.11.1.bb b/meta-oe/recipes-multimedia/mikmod/libmikmod_3.3.11.1.bb
index e0712ba930..d7a2820a79 100644
--- a/meta-oe/recipes-multimedia/mikmod/libmikmod_3.3.11.1.bb
+++ b/meta-oe/recipes-multimedia/mikmod/libmikmod_3.3.11.1.bb
@@ -8,7 +8,6 @@ DEPENDS = "alsa-lib texinfo"
 SRC_URI = "\
     ${SOURCEFORGE_MIRROR}/project/mikmod/${BPN}/${PV}/${BPN}-${PV}.tar.gz \
 "
-SRC_URI[md5sum] = "f69d7dd06d307e888f466fc27f4f680b"
 SRC_URI[sha256sum] = "ad9d64dfc8f83684876419ea7cd4ff4a41d8bcd8c23ef37ecb3a200a16b46d19"
 
 inherit autotools binconfig lib_package
diff --git a/meta-oe/recipes-multimedia/mplayer/libplacebo_7.351.0.bb b/meta-oe/recipes-multimedia/mplayer/libplacebo_7.351.0.bb
new file mode 100644
index 0000000000..68a29dde91
--- /dev/null
+++ b/meta-oe/recipes-multimedia/mplayer/libplacebo_7.351.0.bb
@@ -0,0 +1,28 @@
+SUMMARY = "Reusable library for GPU-accelerated video/image rendering primitives"
+LICENSE = "LGPL-2.1-only"
+LIC_FILES_CHKSUM = "file://LICENSE;md5=435ed639f84d4585d93824e7da3d85da"
+
+DEPENDS += "fastfloat glad-native python3-mako-native python3-jinja2-native vulkan-headers"
+
+SRC_URI = "git://code.videolan.org/videolan/libplacebo.git;protocol=https;branch=v7.351"
+SRCREV = "3188549fba13bbdf3a5a98de2a38c2e71f04e21e"
+
+inherit meson pkgconfig
+
+
+PACKAGECONFIG ??= "${@bb.utils.filter('DISTRO_FEATURES', 'vulkan opengl', d)} lcms"
+
+PACKAGECONFIG[vulkan] =  "-Dvulkan=enabled,-Dvulkan=disabled,vulkan-loader shaderc spirv-shader-generator"
+PACKAGECONFIG[glslang] = "-Dglslang=enabled,-Dglslang=disabled,glslang"
+PACKAGECONFIG[opengl] = "-Dopengl=enabled,-Dopengl=disabled"
+PACKAGECONFIG[lcms] = "-Dlcms=enabled,-Dlcms=disabled,lcms"
+PACKAGECONFIG[demos] = "-Ddemos=true,-Ddemos=false,ffmpeg virtual/libsdl2 libsdl2-image"
+
+EXTRA_OEMESON = "-Dvulkan-registry=${STAGING_DATADIR}/vulkan/registry/vk.xml"
+
+do_install:append(){
+  if [ -f ${D}${libdir}/pkgconfig/libplacebo.pc ]; then
+    sed -i "s,${RECIPE_SYSROOT}${libdir}/libSPIRV.so,-lSPIRV,g" ${D}${libdir}/pkgconfig/libplacebo.pc
+    sed -i "s,${RECIPE_SYSROOT}${libdir}/libglslang.so,-lglslang,g" ${D}${libdir}/pkgconfig/libplacebo.pc
+  fi
+}
diff --git a/meta-oe/recipes-multimedia/mplayer/mpv_0.35.1.bb b/meta-oe/recipes-multimedia/mplayer/mpv_0.35.1.bb
deleted file mode 100644
index 0f50a6e8fe..0000000000
--- a/meta-oe/recipes-multimedia/mplayer/mpv_0.35.1.bb
+++ /dev/null
@@ -1,116 +0,0 @@
-SUMMARY = "Open Source multimedia player"
-DESCRIPTION = "mpv is a fork of mplayer2 and MPlayer. It shares some features with the former projects while introducing many more."
-SECTION = "multimedia"
-HOMEPAGE = "http://www.mpv.io/"
-
-DEPENDS = " \
-    zlib \
-    ffmpeg \
-    jpeg \
-    libv4l \
-    libass \
-"
-
-LICENSE = "GPL-2.0-or-later"
-LIC_FILES_CHKSUM = "file://LICENSE.GPL;md5=b234ee4d69f5fce4486a80fdaf4a4263"
-
-SRCREV_mpv = "140ec21c89d671d392877a7f3b91d67e7d7b9239"
-SRC_URI = "git://github.com/mpv-player/mpv;name=mpv;branch=release/0.35;protocol=https \
-           https://waf.io/waf-2.0.25;name=waf;subdir=git \
-           "
-SRC_URI[waf.sha256sum] = "21199cd220ccf60434133e1fd2ab8c8e5217c3799199c82722543970dc8e38d5"
-
-S = "${WORKDIR}/git"
-
-inherit waf pkgconfig mime-xdg
-
-LDFLAGS:append:riscv64 = " -latomic"
-
-LUA ?= "lua"
-LUA:mips64  = ""
-LUA:powerpc64  = ""
-LUA:powerpc64le  = ""
-LUA:riscv64  = ""
-LUA:riscv32  = ""
-LUA:powerpc  = ""
-
-# Note: lua is required to get on-screen-display (controls)
-PACKAGECONFIG ??= " \
-    ${LUA} \
-    ${@bb.utils.contains('DISTRO_FEATURES', 'wayland', 'wayland egl', '', d)} \
-    ${@bb.utils.filter('DISTRO_FEATURES', 'x11', d)} \
-    ${@bb.utils.filter('DISTRO_FEATURES', 'opengl', d)} \
-"
-
-PACKAGECONFIG[x11] = "--enable-x11,--disable-x11,virtual/libx11 xsp libxv libxscrnsaver libxinerama libxpresent libxext"
-PACKAGECONFIG[xv] = "--enable-xv,--disable-xv,libxv"
-PACKAGECONFIG[opengl] = "--enable-gl,--disable-gl,virtual/libgl"
-PACKAGECONFIG[egl] = "--enable-egl,--disable-egl,virtual/egl"
-PACKAGECONFIG[drm] = "--enable-drm,--disable-drm,libdrm"
-PACKAGECONFIG[gbm] = "--enable-gbm,--disable-gbm,virtual/libgbm"
-PACKAGECONFIG[lua] = "--enable-lua,--disable-lua,lua luajit"
-PACKAGECONFIG[libarchive] = "--enable-libarchive,--disable-libarchive,libarchive"
-PACKAGECONFIG[jack] = "--enable-jack, --disable-jack, jack"
-PACKAGECONFIG[vaapi] = "--enable-vaapi,--disable-vaapi,libva"
-PACKAGECONFIG[vdpau] = "--enable-vdpau,--disable-vdpau,libvdpau"
-PACKAGECONFIG[wayland] = "--enable-wayland,--disable-wayland,wayland wayland-native libxkbcommon"
-
-python __anonymous() {
-    packageconfig = (d.getVar("PACKAGECONFIG") or "").split()
-    extras = []
-    if "x11" in packageconfig and "opengl" in packageconfig:
-        extras.append(" --enable-gl-x11")
-    if "x11" in packageconfig and "egl" in packageconfig:
-        extras.append(" --enable-egl-x11")
-    if "egl" in packageconfig and "drm" in packageconfig:
-        extras.append(" --enable-egl-drm")
-    if "vaapi" in packageconfig and "x11" in packageconfig:
-        extras.append(" --enable-vaapi-x11")
-    if "vaapi" in packageconfig and "drm" in packageconfig:
-        extras.append(" --enable-vaapi-drm")
-    if "vaapi" in packageconfig and "x11" in packageconfig and "egl" in packageconfig:
-        extras.append(" --enable-vaapi-x-egl")
-    if "vdpau" in packageconfig and "opengl" in packageconfig and "x11" in packageconfig:
-        extras.append(" --enable-vdpau-gl-x11")
-    if "wayland" in packageconfig and "opengl" in packageconfig:
-        extras.append(" --enable-gl-wayland")
-    if "wayland" in packageconfig and "vaapi" in packageconfig:
-        extras.append(" --enable-vaapi-wayland")
-    if extras:
-        d.appendVar("EXTRA_OECONF", "".join(extras))
-}
-
-SIMPLE_TARGET_SYS = "${@'${TARGET_SYS}'.replace('${TARGET_VENDOR}', '')}"
-
-EXTRA_OECONF = " \
-    --prefix=${prefix} \
-    --target=${SIMPLE_TARGET_SYS} \
-    --confdir=${sysconfdir} \
-    --datadir=${datadir} \
-    --disable-manpage-build \
-    --disable-libbluray \
-    --disable-dvdnav \
-    --disable-cdda \
-    --disable-uchardet \
-    --disable-rubberband \
-    --disable-lcms2 \
-    --disable-vapoursynth \
-    ${PACKAGECONFIG_CONFARGS} \
-"
-
-do_configure:append() {
-    sed -i -e 's#${WORKDIR}#<WORKDIR>#g' ${B}/config.h
-}
-
-link_waf() {
-    ln -s waf-2.0.25 ${S}/waf
-}
-do_unpack[postfuncs] += "link_waf"
-
-FILES:${PN} += " \
-    ${datadir}/icons \
-    ${datadir}/zsh \
-    ${datadir}/bash-completion \
-    ${datadir}/metainfo \
-    "
-EXCLUDE_FROM_WORLD = "${@bb.utils.contains("LICENSE_FLAGS_ACCEPTED", "commercial", "0", "1", d)}"
diff --git a/meta-oe/recipes-multimedia/mplayer/mpv_0.40.0.bb b/meta-oe/recipes-multimedia/mplayer/mpv_0.40.0.bb
new file mode 100644
index 0000000000..3223dd69d7
--- /dev/null
+++ b/meta-oe/recipes-multimedia/mplayer/mpv_0.40.0.bb
@@ -0,0 +1,102 @@
+SUMMARY = "Open Source multimedia player"
+DESCRIPTION = "mpv is a fork of mplayer2 and MPlayer. It shares some features with the former projects while introducing many more."
+SECTION = "multimedia"
+HOMEPAGE = "http://www.mpv.io/"
+
+DEPENDS = " \
+    zlib \
+    ffmpeg \
+    jpeg \
+    libv4l \
+    libass \
+    libdisplay-info \
+    libplacebo \
+"
+
+LICENSE = "GPL-2.0-or-later"
+LIC_FILES_CHKSUM = "file://LICENSE.GPL;md5=570a9b3749dd0463a1778803b12a6dce"
+
+SRCREV = "e48ac7ce08462f5e33af6ef9deeac6fa87eef01e"
+SRC_URI = "git://github.com/mpv-player/mpv;name=mpv;branch=release/${@oe.utils.trim_version('${PV}', 2)};protocol=https"
+
+inherit meson pkgconfig mime-xdg
+
+LDFLAGS:append:riscv64 = " -latomic"
+
+LUA ?= "lua"
+LUA:mips64  = ""
+LUA:powerpc64  = ""
+LUA:powerpc64le  = ""
+LUA:riscv64  = ""
+LUA:riscv32  = ""
+LUA:powerpc  = ""
+
+# Note: lua is required to get on-screen-display (controls)
+PACKAGECONFIG ??= " \
+    libmpv \
+    ${LUA} \
+    ${@bb.utils.filter('DISTRO_FEATURES', 'x11 wayland opengl pipewire pulseaudio vulkan', d)} \
+    ${@bb.utils.contains('DISTRO_FEATURES', 'opengl wayland', 'egl', '', d)} \
+    ${@bb.utils.contains('DISTRO_FEATURES', 'opengl x11', 'drm gbm', '', d)} \
+"
+
+PACKAGECONFIG[x11] = "-Dx11=enabled,-Dx11=disabled,virtual/libx11 xsp libxv libxscrnsaver libxinerama libxpresent libxext"
+PACKAGECONFIG[xv] = "-Dxv=enabled,-Dxv=disabled,libxv"
+PACKAGECONFIG[opengl] = "-Dgl=enabled,-Dgl=disabled,virtual/libgl"
+PACKAGECONFIG[egl] = "-Degl=enabled,-Degl=disabled,virtual/egl"
+PACKAGECONFIG[drm] = "-Ddrm=enabled,-Ddrm=disabled,libdrm"
+PACKAGECONFIG[gbm] = "-Dgbm=enabled,-Dgbm=disabled,virtual/libgbm"
+PACKAGECONFIG[lua] = "-Dlua=luajit,-Dlua=disabled,luajit"
+PACKAGECONFIG[libarchive] = "-Dlibarchive=enabled,-Dlibarchive=disabled,libarchive"
+PACKAGECONFIG[lcms2] = "-Dlcms2=enabled,-Dlcms2=disabled,lcms"
+PACKAGECONFIG[libmpv] = "-Dlibmpv=true,-Dlibmpv=false"
+PACKAGECONFIG[jack] = "-Djack=enabled,-Djack=disabled,jack"
+PACKAGECONFIG[pipewire] = "-Dpipewire=enabled,-Dpipewire=disabled,pipewire"
+PACKAGECONFIG[pulseaudio] = "-Dpulse=enabled,-Dpulse=disabled,pulseaudio"
+PACKAGECONFIG[vaapi] = "-Dvaapi=enabled,-Dvaapi=disabled,libva"
+PACKAGECONFIG[vulkan] = "-Dvulkan=enabled,-Dvulkan=disabled,vulkan-headers"
+PACKAGECONFIG[vdpau] = "-Dvdpau=enabled,-Dvdpau=disabled,libvdpau nv-codec-headers"
+PACKAGECONFIG[wayland] = "-Dwayland=enabled,-Dwayland=disabled,wayland wayland-native libxkbcommon"
+
+python __anonymous() {
+    packageconfig = (d.getVar("PACKAGECONFIG") or "").split()
+    extras = []
+    if "x11" in packageconfig and "opengl" in packageconfig:
+        extras.append(" -Dgl-x11=enabled")
+    if "x11" in packageconfig and "egl" in packageconfig:
+        extras.append(" -Degl-x11=enabled")
+    if "egl" in packageconfig and "drm" in packageconfig:
+        extras.append(" -Degl-drm=enabled")
+    if "vaapi" in packageconfig and "x11" in packageconfig:
+        extras.append(" -Dvaapi-x11=enabled")
+    if "vaapi" in packageconfig and "drm" in packageconfig:
+        extras.append(" -Dvaapi-drm=enabled")
+    if "vdpau" in packageconfig and "opengl" in packageconfig and "x11" in packageconfig:
+        extras.append(" -Dvdpau-gl-x11=enabled")
+    if "wayland" in packageconfig and "opengl" in packageconfig:
+        extras.append(" -Degl-wayland=enabled")
+    if "wayland" in packageconfig and "vaapi" in packageconfig:
+        extras.append(" -Dvaapi-wayland=enabled")
+    if extras:
+        d.appendVar("EXTRA_OEMESON", "".join(extras))
+}
+
+#SIMPLE_TARGET_SYS = "${@'${TARGET_SYS}'.replace('${TARGET_VENDOR}', '')}"
+
+EXTRA_OEMESON = " \
+    -Dmanpage-build=disabled \
+    -Dlibbluray=disabled \
+    -Ddvdnav=disabled \
+    -Dcdda=disabled \
+    -Duchardet=disabled \
+    -Drubberband=disabled \
+    -Dvapoursynth=disabled \
+    -Dshaderc=disabled \
+"
+
+do_configure:append() {
+    sed -i -e 's#${WORKDIR}#<WORKDIR>#g' ${B}/config.h
+}
+
+FILES:${PN} += "${datadir}"
+EXCLUDE_FROM_WORLD = "${@bb.utils.contains("LICENSE_FLAGS_ACCEPTED", "commercial", "0", "1", d)}"
diff --git a/meta-oe/recipes-multimedia/pulseaudio/pavucontrol_5.0.bb b/meta-oe/recipes-multimedia/pulseaudio/pavucontrol_5.0.bb
index 012fc3a94d..29500bdb94 100644
--- a/meta-oe/recipes-multimedia/pulseaudio/pavucontrol_5.0.bb
+++ b/meta-oe/recipes-multimedia/pulseaudio/pavucontrol_5.0.bb
@@ -14,7 +14,7 @@ inherit autotools features_check perlnative pkgconfig
 
 ANY_OF_DISTRO_FEATURES = "${GTK3DISTROFEATURES}"
 
-SRC_URI = "http://freedesktop.org/software/pulseaudio/${BPN}/${BP}.tar.xz"
+SRC_URI = "http://www.freedesktop.org/software/pulseaudio/${BPN}/${BP}.tar.xz"
 SRC_URI:append = " ${@bb.utils.contains('DISTRO_FEATURES', 'wayland', 'file://0001-pavucontrol-remove-canberra-gtk-support.patch', '', d)}"
 
 SRC_URI[sha256sum] = "ce2b72c3b5f1a70ad0df19dd81750f9455bd20870d1d3a36d20536af2e8f4e7a"
diff --git a/meta-oe/recipes-multimedia/sound-themes/sound-theme-freedesktop_0.8.bb b/meta-oe/recipes-multimedia/sound-themes/sound-theme-freedesktop_0.8.bb
index 87320a98e8..ed9f561a5e 100644
--- a/meta-oe/recipes-multimedia/sound-themes/sound-theme-freedesktop_0.8.bb
+++ b/meta-oe/recipes-multimedia/sound-themes/sound-theme-freedesktop_0.8.bb
@@ -11,6 +11,5 @@ inherit autotools gettext
 
 DEPENDS += "glib-2.0-native"
 
-SRC_URI = "http://people.freedesktop.org/~mccann/dist/${BPN}-${PV}.tar.bz2"
-SRC_URI[md5sum] = "d7387912cfd275282d1ec94483cb2f62"
+SRC_URI = "https://people.freedesktop.org/~mccann/dist/${BPN}-${PV}.tar.bz2"
 SRC_URI[sha256sum] = "cb518b20eef05ec2e82dda1fa89a292c1760dc023aba91b8aa69bafac85e8a14"
diff --git a/meta-oe/recipes-multimedia/v4l2apps/v4l-utils/0001-keytable-meson-Restrict-the-installation-of-50-rc_ke.patch b/meta-oe/recipes-multimedia/v4l2apps/v4l-utils/0001-keytable-meson-Restrict-the-installation-of-50-rc_ke.patch
deleted file mode 100644
index 64c01e4977..0000000000
--- a/meta-oe/recipes-multimedia/v4l2apps/v4l-utils/0001-keytable-meson-Restrict-the-installation-of-50-rc_ke.patch
+++ /dev/null
@@ -1,46 +0,0 @@
-From 502c0302827cec3d2b2a69fb25189646685ef2ff Mon Sep 17 00:00:00 2001
-From: Fabio Estevam <festevam@denx.de>
-Date: Fri, 12 Jan 2024 00:17:14 -0300
-Subject: [PATCH] keytable: meson: Restrict the installation of
- 50-rc_keymap.conf
-
-Currently, meson tries to install 50-rc_keymap.conf even if systemd
-is not used.
-
-Commit 01f2c6c58e6f ("keytable: restrict installation of 50-rc_keymap.conf"),
-only allowed 50-rc_keymap.conf to be installed when both BPF and systemd
-were used.
-
-Apply the same logic in meson to fix the problem.
-
-Signed-off-by: Fabio Estevam <festevam@denx.de>
-Signed-off-by: Sean Young <sean@mess.org>
-Upstream-Status: Backport [https://git.linuxtv.org/v4l-utils.git/commit/?id=a21924ec424c4744af6f2a794e0677eba35dd168]
----
- utils/keytable/meson.build | 4 ++++
- 1 file changed, 4 insertions(+)
-
-diff --git a/utils/keytable/meson.build b/utils/keytable/meson.build
-index 4130a4bea514..76ce329eae8e 100644
---- a/utils/keytable/meson.build
-+++ b/utils/keytable/meson.build
-@@ -69,6 +69,8 @@ ir_keytable_udev_rules = files(
- install_data(ir_keytable_udev_rules,
-              install_dir : ir_keytable_system_dir / 'rules.d')
-
-+if ir_bpf_enabled
-+if dep_systemd.found()
- if have_udevdsyscallfilter
-     ir_keytable_systemd_files = files(
-         '50-rc_keymap.conf',
-@@ -76,6 +78,8 @@ if have_udevdsyscallfilter
-     install_data(ir_keytable_systemd_files,
-                  install_dir : systemd_systemdir / 'systemd-udevd.service.d')
- endif
-+endif
-+endif
-
- # Install non-existing directory to create empty directory structure
- # See: https://github.com/mesonbuild/meson/issues/2904
---
-2.34.1
diff --git a/meta-oe/recipes-multimedia/v4l2apps/v4l-utils/0001-media-ctl-Install-media-ctl-header-and-library-files.patch b/meta-oe/recipes-multimedia/v4l2apps/v4l-utils/0001-media-ctl-Install-media-ctl-header-and-library-files.patch
new file mode 100644
index 0000000000..6c946d8c48
--- /dev/null
+++ b/meta-oe/recipes-multimedia/v4l2apps/v4l-utils/0001-media-ctl-Install-media-ctl-header-and-library-files.patch
@@ -0,0 +1,78 @@
+From 3867fcfa4389c7fa271705f1fd1d4bfb74bc1bd1 Mon Sep 17 00:00:00 2001
+From: Neel Gandhi <neel.gandhi@amd.com>
+Date: Wed, 5 Jun 2024 13:51:36 +0530
+Subject: [PATCH] media-ctl: Install media-ctl header and library files
+
+Install mediactl and v4l2subdev header and library
+files, which may be required by 3rd party applications
+to populate and control v4l2subdev device node tree
+
+Install of these files was removed in upstream commit
+0911dce53b08b0df3066be2c75f67e8a314d8729.
+
+Upstream-Status: Denied
+
+v4l-utils maintainers do not promise a stable API for this library, and
+do not currently have the time to do so. So exporting the API in this
+way is fine, as long as we understand that it will change and users of
+the API will need to adapt over time.
+
+Signed-off-by: Neel Gandhi <neel.gandhi@amd.com>
+Signed-off-by: Mark Hatle <mark.hatle@amd.com>
+---
+ utils/media-ctl/meson.build | 28 +++++++++++++++++++++-------
+ 1 file changed, 21 insertions(+), 7 deletions(-)
+
+diff --git a/utils/media-ctl/meson.build b/utils/media-ctl/meson.build
+index 3a7b0c9a..40669b4c 100644
+--- a/utils/media-ctl/meson.build
++++ b/utils/media-ctl/meson.build
+@@ -3,14 +3,24 @@ libmediactl_sources = files(
+     'mediactl-priv.h',
+ )
+ 
++libmediactl_api = files(
++    'mediactl.h',
++    'v4l2subdev.h',
++)
++
++install_headers(libmediactl_api, subdir: 'mediactl')
++
+ libmediactl_deps = [
+     dep_libudev,
+ ]
+ 
+-libmediactl = static_library('mediactl',
+-                             libmediactl_sources,
+-                             dependencies : libmediactl_deps,
+-                             include_directories : v4l2_utils_incdir)
++libmediactl = library('mediactl',
++                      libmediactl_sources,
++                      soversion: '0',
++                      version: '0.0.0',
++                      install : true,
++                      dependencies : libmediactl_deps,
++                      include_directories : v4l2_utils_incdir)
+ 
+ dep_libmediactl = declare_dependency(link_with : libmediactl)
+ 
+@@ -18,9 +28,13 @@ libv4l2subdev_sources = files('libv4l2subdev.c')
+ libv4l2subdev_sources += media_bus_format_names_h
+ libv4l2subdev_sources += media_bus_format_codes_h
+ 
+-libv4l2subdev = static_library('v4l2subdev',
+-                               libv4l2subdev_sources,
+-                               include_directories : v4l2_utils_incdir)
++libv4l2subdev = library('v4l2subdev',
++                        libv4l2subdev_sources,
++                        soversion: '0',
++                        version: '0.0.0',
++                        install : true,
++                        dependencies : dep_libmediactl,
++                        include_directories : v4l2_utils_incdir)
+ 
+ dep_libv4l2subdev = declare_dependency(link_with : libv4l2subdev)
+ 
+-- 
+2.34.1
+
diff --git a/meta-oe/recipes-multimedia/v4l2apps/v4l-utils/0002-media-ctl-Install-media-ctl-pkg-config-files.patch b/meta-oe/recipes-multimedia/v4l2apps/v4l-utils/0002-media-ctl-Install-media-ctl-pkg-config-files.patch
new file mode 100644
index 0000000000..8a009ae806
--- /dev/null
+++ b/meta-oe/recipes-multimedia/v4l2apps/v4l-utils/0002-media-ctl-Install-media-ctl-pkg-config-files.patch
@@ -0,0 +1,49 @@
+From a422ddf7f8805d34ff1fbb46d335993c9cd05ead Mon Sep 17 00:00:00 2001
+From: Einar Jon Gunnarsson <tolvupostur@gmail.com>
+Date: Fri, 10 May 2024 11:56:17 +0200
+Subject: [PATCH] media-ctl: Install media-ctl pkg-config files
+
+libv4l2subdev/libmediactl can not be used in projects without the
+pkg-config files. This adds them as well.
+
+Upstream-Status: Denied
+
+This is an add-on to the previous patch:
+0001-media-ctl-Install-media-ctl-header-and-library-files.patch
+so same restrictions apply.
+
+Signed-off-by: Einar Jon Gunnarsson <tolvupostur@gmail.com>
+---
+ utils/media-ctl/meson.build | 12 ++++++++++++
+ 1 file changed, 12 insertions(+)
+
+diff --git a/utils/media-ctl/meson.build b/utils/media-ctl/meson.build
+index 40669b4c..6feba1af 100644
+--- a/utils/media-ctl/meson.build
++++ b/utils/media-ctl/meson.build
+@@ -38,6 +38,12 @@ libv4l2subdev = library('v4l2subdev',
+ 
+ dep_libv4l2subdev = declare_dependency(link_with : libv4l2subdev)
+ 
++pkg.generate(
++      libv4l2subdev,
++      name : 'libv4l2subdev',
++      version : meson.project_version(),
++      description : 'v4l2 subdev library')
++
+ media_ctl_sources = files(
+     'media-ctl.c',
+     'options.c',
+@@ -55,3 +61,9 @@ media_ctl = executable('media-ctl',
+                        dependencies : media_ctl_deps,
+                        install : true,
+                        include_directories : v4l2_utils_incdir)
++
++pkg.generate(
++     libmediactl,
++     name : 'libmediactl',
++     version : meson.project_version(),
++     description : 'v4l2 mediactl library')
+-- 
+2.43.5
+
diff --git a/meta-oe/recipes-multimedia/v4l2apps/v4l-utils_1.26.1.bb b/meta-oe/recipes-multimedia/v4l2apps/v4l-utils_1.28.1.bb
index 52759ef18e..0a3b5d28b6 100644
--- a/meta-oe/recipes-multimedia/v4l2apps/v4l-utils_1.26.1.bb
+++ b/meta-oe/recipes-multimedia/v4l2apps/v4l-utils_1.28.1.bb
@@ -26,15 +26,15 @@ PACKAGECONFIG[qvidcap] = ",-Dqvidcap=disabled"
 PACKAGECONFIG[v4l2-tracer] = ",-Dv4l2-tracer=disabled,json-c"
 
 SRC_URI = "\
-    git://git.linuxtv.org/v4l-utils.git;protocol=https;branch=stable-1.26 \
-    file://0001-keytable-meson-Restrict-the-installation-of-50-rc_ke.patch \
+    git://git.linuxtv.org/v4l-utils.git;protocol=https;branch=stable-1.28 \
+    file://0001-media-ctl-Install-media-ctl-header-and-library-files.patch \
+    file://0002-media-ctl-Install-media-ctl-pkg-config-files.patch \
 "
 
-SRCREV = "4aee01a027923cab1e40969f56f8ba58d3e6c0d1"
+SRCREV = "fc15e229d9d337e46d730f00647821adbbd58548"
 
-PV .= "+git"
 
-S = "${WORKDIR}/git"
+UPSTREAM_CHECK_GITTAGREGEX = "v4l-utils-(?P<pver>\d+(\.\d+)+)"
 
 EXTRA_OEMESON = "-Dudevdir=${base_libdir}/udev -Dv4l2-compliance-32=false -Dv4l2-ctl-32=false"
 
diff --git a/meta-oe/recipes-multimedia/v4l2apps/yavta_git.bb b/meta-oe/recipes-multimedia/v4l2apps/yavta_git.bb
index 3069528301..87dc7a7be6 100644
--- a/meta-oe/recipes-multimedia/v4l2apps/yavta_git.bb
+++ b/meta-oe/recipes-multimedia/v4l2apps/yavta_git.bb
@@ -2,23 +2,13 @@ SUMMARY = "Yet Another V4L2 Test Application"
 LICENSE = "GPL-2.0-only"
 LIC_FILES_CHKSUM = "file://COPYING.GPL;md5=751419260aa954499f7abaabaa882bbe"
 
-SRC_URI = "git://git.ideasonboard.org/yavta.git;branch=master \
+SRC_URI = "git://git.ideasonboard.org/yavta.git;branch=master;protocol=https \
           "
-SRCREV = "65f740aa1758531fd810339bc1b7d1d33666e28a"
+SRCREV = "52c975e5542504ac10bed8b1d68df5c75951d202"
 
 PV = "0.0"
-S = "${WORKDIR}/git"
-
-EXTRA_OEMAKE = "-e MAKEFLAGS="
-
-# The yavta sources include copies of the headers required to build in the
-# include directory.  The Makefile uses CFLAGS to include these, but since
-# we override the CFLAGS then we need to add this include path back in.
-CFLAGS += "-I${S}/include"
-
-do_install() {
-    install -d ${D}${bindir}
-    install -m 0755 yavta ${D}${bindir}
-}
 
+# Upstream repo does not tag
+UPSTREAM_CHECK_COMMITS = "1"
 
+inherit meson
diff --git a/meta-oe/recipes-multimedia/wavpack/wavpack_5.6.0.bb b/meta-oe/recipes-multimedia/wavpack/wavpack_5.6.0.bb
index 7384d2892f..651fbc4192 100644
--- a/meta-oe/recipes-multimedia/wavpack/wavpack_5.6.0.bb
+++ b/meta-oe/recipes-multimedia/wavpack/wavpack_5.6.0.bb
@@ -11,7 +11,6 @@ SRC_URI = "git://github.com/dbry/WavPack.git;branch=master;protocol=https \
 
 SRCREV = "e03e8e29dc618e08e7baba9636e57ba1254874ce"
 
-S = "${WORKDIR}/git"
 
 inherit cmake pkgconfig lib_package
 
diff --git a/meta-oe/recipes-multimedia/webm/libvpx/libvpx-configure-support-blank-prefix.patch b/meta-oe/recipes-multimedia/webm/libvpx/libvpx-configure-support-blank-prefix.patch
index 463651aa4a..04c4804c05 100644
--- a/meta-oe/recipes-multimedia/webm/libvpx/libvpx-configure-support-blank-prefix.patch
+++ b/meta-oe/recipes-multimedia/webm/libvpx/libvpx-configure-support-blank-prefix.patch
@@ -1,4 +1,4 @@
-From 2829e6998b7595dd2108c1497fdd02485ef99e2c Mon Sep 17 00:00:00 2001
+From c71898649e300d7e5700cd247d7ae994c7faa406 Mon Sep 17 00:00:00 2001
 From: Koen Kooi <koen@dominion.thruhere.net>
 Date: Tue, 16 Aug 2011 16:04:35 +0200
 Subject: [PATCH] Upstream: not yet
@@ -11,10 +11,10 @@ Upstream-Status: Pending
  1 file changed, 16 insertions(+), 4 deletions(-)
 
 diff --git a/build/make/configure.sh b/build/make/configure.sh
-index b645a666f..0b99a8b38 100644
+index 8220d5cbe..923daf8bc 100644
 --- a/build/make/configure.sh
 +++ b/build/make/configure.sh
-@@ -658,6 +658,8 @@ process_common_cmdline() {
+@@ -699,6 +699,8 @@ process_common_cmdline() {
          ;;
        --prefix=*)
          prefix="${optval}"
@@ -23,7 +23,7 @@ index b645a666f..0b99a8b38 100644
          ;;
        --libdir=*)
          libdir="${optval}"
-@@ -687,13 +689,23 @@ process_cmdline() {
+@@ -728,13 +730,23 @@ process_cmdline() {
  }
  
  post_process_common_cmdline() {
diff --git a/meta-oe/recipes-multimedia/webm/libvpx_1.14.0.bb b/meta-oe/recipes-multimedia/webm/libvpx_1.15.2.bb
index b4d49842ea..a7cd76e0c7 100644
--- a/meta-oe/recipes-multimedia/webm/libvpx_1.14.0.bb
+++ b/meta-oe/recipes-multimedia/webm/libvpx_1.15.2.bb
@@ -7,12 +7,11 @@ LICENSE = "BSD-3-Clause"
 
 LIC_FILES_CHKSUM = "file://LICENSE;md5=d5b04755015be901744a78cc30d390d4"
 
-SRCREV = "602e2e8979d111b02c959470da5322797dd96a19"
-SRC_URI += "git://chromium.googlesource.com/webm/libvpx;protocol=https;branch=main \
+SRCREV = "d168454ecd099805c675d4a98c66f4891373302a"
+SRC_URI += "git://chromium.googlesource.com/webm/libvpx;protocol=https;branch=main;tag=v${PV} \
            file://libvpx-configure-support-blank-prefix.patch \
            "
 
-S = "${WORKDIR}/git"
 
 # ffmpeg links with this and fails
 # sysroots/armv4t-oe-linux-gnueabi/usr/lib/libvpx.a(vpx_encoder.c.o)(.text+0xc4): unresolvable R_ARM_THM_CALL relocation against symbol `memcpy@@GLIBC_2.4'
diff --git a/meta-oe/recipes-multimedia/xpext/xpext_1.0-5.bb b/meta-oe/recipes-multimedia/xpext/xpext_1.0-5.bb
index f900aca2d4..5023e4e842 100644
--- a/meta-oe/recipes-multimedia/xpext/xpext_1.0-5.bb
+++ b/meta-oe/recipes-multimedia/xpext/xpext_1.0-5.bb
@@ -1,4 +1,4 @@
-LICENSE= "MIT"
+LICENSE = "MIT"
 SUMMARY = "X Server Nokia 770 extensions library"
 SECTION = "x11/libs"
 DEPENDS = "virtual/libx11 libxext"
@@ -7,7 +7,7 @@ LIC_FILES_CHKSUM = "file://COPYING;md5=db043791349ba57ad1169e1c92477cb6"
 
 SRC_URI = "http://repository.maemo.org/pool/maemo/ossw/source/x/${BPN}/${BPN}_${PV}.tar.gz \
            file://auxdir.patch;striplevel=0"
-S = "${WORKDIR}/xpext-1.0"
+S = "${UNPACKDIR}/xpext-1.0"
 
 inherit autotools pkgconfig features_check
 # depends on virtual/libx11
@@ -16,5 +16,4 @@ REQUIRED_DISTRO_FEATURES = "x11"
 # Remove runtime dependency on empty package ${PN}
 RDEPENDS:${PN}-dev = ""
 
-SRC_URI[md5sum] = "1b0cb67b6f2bd7c4abef17648b062896"
 SRC_URI[sha256sum] = "a3b06f5188fd9effd0799ae31352b3cd65cb913b964e2c1a923ffa9d3c08abbe"
diff --git a/meta-oe/recipes-multimedia/xsp/xsp/0001-fix-incompatible-pointer-types-build-error-in-gcc-15.patch b/meta-oe/recipes-multimedia/xsp/xsp/0001-fix-incompatible-pointer-types-build-error-in-gcc-15.patch
new file mode 100644
index 0000000000..ffb1089423
--- /dev/null
+++ b/meta-oe/recipes-multimedia/xsp/xsp/0001-fix-incompatible-pointer-types-build-error-in-gcc-15.patch
@@ -0,0 +1,40 @@
+From e001efa4a50e43fca5d8918ee05a3bc37180262d Mon Sep 17 00:00:00 2001
+From: "mark.yang" <mark.yang@lge.com>
+Date: Thu, 24 Apr 2025 18:10:25 +0900
+Subject: [PATCH] fix incompatible-pointer-types build error in gcc 15
+
+../Xsp/Xsp.c:37:9: error: initialization of 'int (*)(Display *, XExtCodes *)' from incompatible pointer type 'int (*)(void)' [-Wincompatible-pointer-types]
+   37 |         XSPCloseDisplay,                    /* close_display */
+      |         ^~~~~~~~~~~~~~~
+../Xsp/Xsp.c:37:9: note: (near initialization for 'xsp_extension_hooks.close_display')
+../Xsp/Xsp.c:23:12: note: 'XSPCloseDisplay' declared here
+   23 | static int XSPCloseDisplay();
+      |            ^~~~~~~~~~~~~~~
+In file included from ../Xsp/Xsp.c:6:
+../Xsp/Xsp.c:49:37: error: conflicting types for 'XSPCloseDisplay'; have 'int(Display *, XExtCodes *)'
+   49 | static XEXT_GENERATE_CLOSE_DISPLAY (XSPCloseDisplay, xsp_info)
+      |                                     ^~~~~~~~~~~~~~~
+../Xsp/Xsp.c:36:9: error: 'XSPCloseDisplay' undeclared here (not in a function); did you mean 'XCloseDisplay'?
+   36 |         XSPCloseDisplay,                    /* close_display */
+      |         ^~~~~~~~~~~~~~~
+      |         XCloseDisplay
+
+Upstream-Status: Inactive-Upstream [seems to be unmaintained]
+Signed-off-by: mark.yang <mark.yang@lge.com>
+---
+ Xsp.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/Xsp.c b/Xsp.c
+index 28e2d6e..9bcc958 100644
+--- a/Xsp.c
++++ b/Xsp.c
+@@ -20,7 +20,7 @@ static XExtensionInfo _xsp_info_data;
+ static XExtensionInfo *xsp_info = &_xsp_info_data;
+ static /* const */ char *xsp_extension_name = XSP_NAME;
+ 
+-static int XSPCloseDisplay();
++static XEXT_CLOSE_DISPLAY_PROTO(XSPCloseDisplay);
+ static Bool XSPWireToEvent(Display *dpy, XEvent *event, xEvent *wire);
+ 
+ static Status XSPEventToWire(Display *dpy, XEvent *event, xEvent *wire);
diff --git a/meta-oe/recipes-multimedia/xsp/xsp_1.0.0-8.bb b/meta-oe/recipes-multimedia/xsp/xsp_1.0.0-8.bb
index c611da48c0..5350cf1c65 100644
--- a/meta-oe/recipes-multimedia/xsp/xsp_1.0.0-8.bb
+++ b/meta-oe/recipes-multimedia/xsp/xsp_1.0.0-8.bb
@@ -1,15 +1,18 @@
-LICENSE= "MIT"
+LICENSE =  "MIT"
 SUMMARY = "X Server Nokia 770 extensions library"
 SECTION = "x11/libs"
 DEPENDS = "virtual/libx11 libxext xpext"
 LIC_FILES_CHKSUM = "file://COPYING;md5=ea2bda168c508c7cd8afa567b2fcc549"
 SRC_URI = "http://repository.maemo.org/pool/maemo/ossw/source/x/xsp/${BPN}_${PV}.tar.gz \
-           file://xsp-fix-pc.patch"
-S = "${WORKDIR}/Xsp"
+           file://xsp-fix-pc.patch \
+           file://0001-fix-incompatible-pointer-types-build-error-in-gcc-15.patch \
+"
+S = "${UNPACKDIR}/Xsp"
 
 inherit autotools pkgconfig features_check
 # depends on virtual/libx11
 REQUIRED_DISTRO_FEATURES = "x11"
 
-SRC_URI[md5sum] = "2a0d8d02228d4cbd28b6e07bb7c17cf5"
 SRC_URI[sha256sum] = "8b722b952b64841d996c70c3278499886c81bb5012991beed5f66f4158418f59"
+
+CVE_STATUS[CVE-2006-2658] = "cpe-incorrect: The recipe used in the `meta-openembedded` is a different xsp package compared to the one which has the CVE issue."