NEWS

0.4.9-dev - YYYY-MM-DD

  * Fix potential DOS in decompilers (CVS-2017-8782, issue #70)
  * Fix various overflows in util/ (CVE-2017-11704)
  * Fix various overflows in OpCode and readBytes (CVE-2017-11728,
    CVE-2017-11729, CVE-2017-11730 and CVE-2017-11731, issues #79,
    #81, #81 and #84).
  * Fix heap buffer overflow in decompileCALLFUNCTION (CVE-2017-11734,
    issue #83).
  * Add checks to avoid null pointer dereference in util/parser.c
    (CVE-2017-9988, issue #85)
  * Change type of size variable in readBytes (int->unsigned long) to
    avoid overflow when passing U30 integers (CVE-2017-9989, issue #86).
  * Add checks to avoid processing stackswap when stack only contains
    one element (CVE-2017-11733, issue #78).
  * Rewrite readSInt16, readUInt16 and readSInt32 (util/read.h) to avoid
    undefined behavior (order of evaluation is not guaranteed in the C
    standard).
  * Un-define DEBUGSTACK in util/decompile.c (return cleanly when stack
    is NULL).
  * Fix NULL pointer dereference in outputSWF_TEXT_RECORD (CVE-2017-16883,
    issue #94)
  * Fix heap buffer overflow in dcputs (global buffer missing \0 character)
    (CVE-2017-11732, issue #80)
  * Fix global buffer overflow in printMP3Headers (invalid bitrate 15 not
    detected) (CVE-2017-16898, issue #75).
  * Fix integer overflow vulnerability in util/read.c (out-of-range left
    shift in readUInt32) (CVE-2018-5251, issue #98)
  * Fix left shift of a negative value in util/read.c (left shift of a
    negative value in readSBits) (CVE-2018-5294, issue #97)
  * Fix buffer overflow in outputSWF_TEXT_RECORD (CVE-2018-6315, issue #101)
  * Fix heap-use-after-free in decompileIF (CVE-2018-6359, issue #105)
  * Use OpCode function instead of directly accessing actions array without
    checks in util/decompile.c. This is potentially avoiding numerous
    issues similar to #105 or #83.
  * Fix heap buffer overflow in listfdb.c (issue #104).
  * Fix code duplication issue in listfdb (issues #106 and #107).
  * Fix various compiler warnings.
  * Fix heap buffer overflows happening when accessing the constant pool in
    decompile.c (CVE-2018-7875, CVE-2018-7871, CVE-2018-7870, CVE-2018-7872,
    CVE-2018-7868, issues #112, #113, #114, #117, #120, #122 and #123).
  * Fix NULL pointer dereference happening when calling getName and getString
    with empty acts (NULL act->p.String). Perform deep copy in pushdup,
    instead of shallow copy (issue #121).
  * Fix heap-buffer-overflow in getString (CVE-2018-7867, issue #116).

0.4.8 - 2017-04-07

  * Add PHP7 compatibility
  * Fix C++ output of disassembler
  * Fix heap overflows in parser.c (CVE-2017-7578)
  * Avoid division by zero in listmp3 when no valid frame was found
  * Don't try printing unknown block.
  * Parse Protect tag's Password as string
  * Check values before deriving malloc parameters from them in parser.c
  * Make readString() stop reading string past buffer's end
  * Return EOF when reading unsigned values hits end of memory backed buffer
  * Exit immediately when unexpected EOF is by fgetc() in utility programs
  * Fix using EOF marker -1 value as a valid flag byte
  * Fix division by zero sample rate due to global buffer overflow.


0.4.7 - 2015-05-15

	* Restore support for giflib 4.1.x

0.4.6 - 2015-05-14

	* Add support for building against giflib 5.1.1+ (PR #47).
	* Fix support for bison 2.6+ (Issue #38, PR #40).
	* Fix build on GNU/Hurd (PR #39).
	* Fix possible buffer overflow in makeswf
	* Change php bindings license from PHP to LGPL-2.1+ (Issue #42)
	* Fix build of python binding with libgif (rather than libungif)

0.4.5 - 2013-06-08

	* Fix a build problem with perl module and Perl 5.13.10 (Debian package patch 07)
	* Fix an issue with a shared lib version of the perl module (Debian package patch 05)
	* Fix a runtime warnign in the PHP module (Issue #6)
	* Fix build probem with PHP 5.4 (Issue #9, Debian Bug #662620)
	* Took in some build warning fixes found by openSUSE
	* Add support for giflib 4.2.0+ (bugzilla #119)
	* Fix build with SunStudio compiler (bugzilla #103, #118)
	* Include test file missing in 0.4.4 (Oops)
	* Ensure perl tests use uninstalled package
	* Allow running testsuite with interpreters in custom paths
	* Improve detection of TCL files
	* Fix testsuite runs on systems w/out GNU vasprintf
	* Fix run of ActionScriptTests with BSD make
	* Fix short allocation parsing empty glyph record

0.4.4 - 2011-10-26

	* Generally improve swftoscript and decompiler
	* Change makefdb to name output files by font ID, to play nicer
	  with swftoscript.
	* Add support for 'class A extends B' syntax in actioncompiler
	* Fix bug in 'makeswf' failing to catch some compile errors
	  (bugzilla #94) and being too silent in swf embedding errors
	* Fix bug in action compiler dealing with class methods (bugzilla #94)
	* Add support for libpng > 1.4 (bugzilla #96)
	* Add font kernings support (bugzilla #95)
	* Add button characters export capabilities 
	* Add support for 'swfAction <code>' syntax in asm blocks

0.4.3 - 2010-02-06

	* Fixed SWFMatrix scaling if scale = 0.0
	* Added delete and delete2 support in asm blocks
	* A lot of updates and improvements in the Perl interface
	* A lot of documentation (pod) was added to Perl files
	* Support for manually specifying MP3 delaySeek for SWFSound
	  and SWFSoundStream 
	* Fix sharing of fonts between static and dynamic texts 
	* Fix support for movie-bound init actions 

0.4.0.rc2 - 2008-09-17

	* SWFVideoStream allow manual frame control
	* Autoconf perl version
	* MSVC compile fixes
	* removed src/test.c
	* Embedded video in movie clips
	* Seek in Embedded video streams
	* Gradient / Fill fixes
	* Sound / Soundstream fixes

0.4.0.rc1 - 2008-07-05

	* Perl extension updates 
	* Python extension updates
	* Do not force bgColor
	* Redirect SWF_warn and SWF_error to stderr
	* Propper checks for YACC and LEX
	* Complete Bitmap fillstyles
	* Font fixes
	* Actioncompiler fixes (delete, built-in functions, callFrame -> call())
	* Fixed tag order issues
	* Ming defaults now to local-with-filesystem sandbox for SWF>=8
	* Add support for init actions in makeswf
	* SWF8 / 9 support for fromswf / prebuiltclip
	* implements ASM op
	* ASFunction()
	* AS Class support
	* Removed SWFFontCharacter destructor from PHP wrapper
	* py_ext update
	* Class members
	* outputBlock() usese length and offset from SWF_Parserstruct
	* SWFDisplayItem_flush(): immediately write display items.
	* Removed ttftofft
	* Improved ButtonRecord handling
	* SWFSound_fromSoundStream()
	* Many improvements in decompiler and swftoXXX tools
	* C++ might throw a SWFException
	* Support for embedded Nellymoser sound
	* AS: in with-blocks legacy functions o not work
	* Compiles again with MSVC
	* simplified SWFSound usage with mp3 files
	* SWFSoundStream_getDuration replaces SWFSoundStream_getFrames()
	* perl_ext build changes (build out of tree)
	* API float->double transition
	* php_ext: SWFInput can wrap raw byte-streams 
	* php_ext: API: external data can be passed as file-resource, SWFInput or filename
	* removed newSWFFont() as public function (causes various crashes)
	* removed new SWFFont(...) usage with browserfonts in script languages. Use SWFBrowserFont class.

0.4.0.beta5 - 2007-09-18

	* Add support for targetPath asm opcode.
	* Flash 8: filter and blend modes for buttons
	* Flash 8: SWF_DEFINEMORPHSHAPE2
	* Flash 8: SWFShape rendering hints
	* Flash 8: new gradient features
	* SWFFillStyle is reusable now and calculates propper GradientMatrix
	* setLeft/RightFillStyle adds fill to the shape if necessary
	* Handling fonts as shapes
	* Basic ttf font support 
	* Typesafe SWFMovie_add / replace
	* Add Envelopes to SoundInstance
	* ABC (AS3) parser and output
	* Parse SWF_SERIALNUMBER
	* Parse SWF9 tags
	* SWF9: DefineBinaryData
	* SWF9: SymbolClass
	* SWF9: DefineSceneData

0.4.0.beta4 - 2007-03-27

	* Fix handling of the special 'undefined' value.
	* Fix 'delete' syntax in action compiler.
	* makeswf now handles bitmaps.
	* Many improvements in decompiler.
	* Build scripts cleanup (including check rule).
	* Add support for 'extends' and proper 'push' asm opcodes in
	  ActionScript compiler.
	* Generate DefineFunction2 when target version > 6.
	* Use GOTOFRAME, GOTOFRAME2 and GOTOLABEL when using gotoAndPlay()
	  or gotoAndStop() w/out an object.
	* Video updates: added Flash8 codecs, generic flv parser
	* Soundstream: accept flv audio streams (mp3 only for now)
	* Flash 8: PlaceObject3
	* Flash 8: Filter and Blendmode
	* Write proper Flash 8 files
	* Added movie control tags: FileAttributes, Metadata, 
	  ScriptLimits, ImportAssets2, SetTabIndex
	* Flash 8: ScalingGrid
	* Parser / listswf updates
	* PHP / Perl bindings update
	* Flash 8: DefineShape4 / Linestyle2
	* SWFAction cleanup and API cleanup
	* SWF_warnOnce()
	* SWFInitAction

0.4.0.beta3 - 2006-12-10

	* Fix version to not use dashes to make rpmbuild happy
	* autotool tcl extension
	* coalesce multiple ming.i files into a single file at the top
	* swig output updated for python & tcl
	* Misc decompiler fixes
	* makeswf now handles precompiled clips
	* Make sure the extension source show up in the dist tarballs
	* compiler fix for asm {} blocks

0.4.0-beta2 - 2006-11-21

	* Preliminary support for building RPM packages
	* New PHP code that builds for PHP$ and PHP5
	* Added missing SWFMovieClip class in PHP
	* New tool, ttftofft, for producing ming formast fonts
	* Allow output of SWF version 8 
	* Better SWF parser (utilities).
	* NEW function: SWFMovie_protectWithPassword()
	* preprocessor products of 'makeswf' are now named after
	  output filename and frame# (ie: "out.swf.frame0.pp")
	* Automake-based build, for portability's sake (libtool)
	* Ming_setWarnFunction and Ming_setErrorFunction now return
	  the previously-set value.
	* More documentation !
	* Start of a test suite!
	* makeswf now provides an __SWF_VERSION__ macro for use
	  in cross-version ActionScript code.
	* NEW functions: SWFDisplayItem_getMatrix(),
	  SWFPosition_getMatrix(), SWFMatrix_getScaleX(),
	  SWFMatrix_getRotate0(), SWFMatrix_getRotate1(),
	  SWFMatrix_getScaleY(), SWFMatrix_getTranslateX(),
	  SWFMatrix_getTranslateY(), SWFShape_moveScaledPenTo().

0.3.1 - ?

	* Fixed libpng-less builds
	* Fixed default error handler to exit with a FAILURE code

0.3.0 - 2006-02-15

	* Fixed bug in empty case: statements
	* Updated ch language bindings

0.3beta2 - 2006-01-30

        * C# support
        * Garbage collection support
        * C++ / PHP / Java extensions fixes
        * Autotools / configure support
	* New SWFPrebuiltClip class - include external SWFs as MovieClips
	* Command line actionscript compiler
	* Decompiler redesign
        * Fixes and cleanups all over the place
	* Case-sensitive actionscript compiler
	* Language bindings are now split out into seperate tarballs
	* New utils based on common code and new parsing framework

0.3beta1 - 2004-02-02

0.2a - ???