You could access this page securely.

mpg123 - Fast console MPEG Audio Player and decoder library

The mpg123 distribution contains a real time MPEG 1.0/2.0/2.5 audio player/decoder for layers 1,2 and 3 (most commonly MPEG 1.0 layer 3 aka MP3), as well as re-usable decoding and output libraries. Among others, it works on GNU/Linux, MacOSX, the BSDs, Solaris, AIX, HPUX, SGI Irix, OS/2 and Cygwin or plain MS Windows (not all more exotic platforms tested regularily, but patches welcome). You may jump to the non-exhaustive list of features.

It is free software licensed under LGPL 2.1 .

Note that nowadays, the mpg123 decoder core can work with floating point or integer math and with some tuning between accuracy and performance at build-time, using assembly optimizations for several platforms, depending on your build configuration. There is detection and selection of assembly optimisations on x86, x86-64, and ARM at program runtime. It's fast, it's high-quality. Just use it;-)

Top News

2024-10-26 thomas: Releasing mpg123 version 1.32.8: Frankenstein's Monster

This is an important security update! There is possible buffer overflow (writing of decoded PCM samples beyond allocated output buffer) for streams that change output properties together with certain usage of libmpg123. This needed seeking around in the stream (including scanning it before actual decoding) to trigger. So, your usual web radio stream as obvious attack vector is unlikely, as you won't seek around in it. If you do work with stream dumps, usage of MPG123_NO_FRANKENSTEIN or the --no-frankenstein option to the mpg123 application is a workaround to avoid the formerly dangerous situation in earlier mpg123 releases. This also means that mpg123 will not decode streams of concatenated files with either varying format or leading Info frames past the first track anymore.

With this release, the parser has been improved not to store certain stream properties before actual MPEG frame data matching that property has been stored. This avoids the inconsistency that triggered the overflow. Also note that if you always use a fixed decoding buffer for full stereo of the maximum of 1152 samples per frame, times two and your choice of encoding, your application is also not susceptible.

Exploitation of this is not trivial, but I cannot rule out the possibility of gaining code execution. Your exploit payload needs to pass through an MPEG decoder and PCM synth before possibly reaching the CPU. Some heap corruption can follow at the least. So update or mitigate. If you run 1.32.x, there is no excuse not to get the the latest bugfix release now. Basically any version of mpg123 is affected by this, at least those that explicitly support so-called Frankenstein streams.

libmpg123:
- Add sections to assembly to support PAC/BTI code for aarch64 (-mbranch-protection variants), thanks to Bill Roberts (github PR 15).
- Prevent premature application of header info into decoding structure, at worst having triggered out-of-bounds writes of decoded PCM data (bug 322, again).
out123: Show --quiet in --longhelp.