6
Distro Debian
Martin Guy edited this page 2025-08-24 15:27:55 +02:00
Distro Debian
Of the tested versions of SoX, Debian's is the one that defends best
against CVEs, though the strategy of importing sox.sf.net's patches
for them is less than 100% successful.
Test results for CVE patches in 14.4.2+git20190427-3.5 and -4
Legend
SUCC Exits zero when it should fail
ABRT Aborts
ASAN Works but the Address Sanitizer reports problems
ALOOP Loops forever when compiled with the Address Sanitizer.
If you give it more than a minute of CPU time, the address sanitizer kills it
saying it has tried to allocate more than `0xc0000000` bytes of VM so the 10x
ASAN slowdown is due to SoX beating `malloc()` to death.
1 Exits 1 without ASAN, "succeeds" with.
- We don't have a test for this bug
Results for Debian bookwork/trixie i386
For test results for other unaddressed CVEs and results for sox.sf.net
and sox_ng see Testing.
TODO
Add format OPUS
If libopusfile-dev is installed, dpkg-buildpackage says
dh_missing: warning: usr/lib/i386-linux-gnu/sox/libsox_fmt_opus.so exists in debian/tmp but is not installed to anywhere
Add format sndio
If libsndio-dev is installed, dpkg-buildpackage says
dh_missing: warning: usr/lib/i386-linux-gnu/sox/libsox_fmt_sndio.so exists in debian/tmp but is not installed to anywhere
Recommend libsox-fmt-all
I would recommend, not suggest, libsox-fmt-all so that most people get a
SoX that reads/writes most audio formats, which is one of its main purposes.
Other build dependencies and recommended packages
See the notes at the bottom of [Distros](Distros].