--- libgig/trunk/ChangeLog	2017/10/03 15:05:45	3348
+++ libgig/trunk/ChangeLog	2017/11/25 01:19:10	3370
@@ -1,4 +1,4 @@
-Version SVN trunk
+Version 4.1.0 (25 Nov 2017)
   * general changes:
     - removed 2 GB limitation when loading a gig or DLS file
     - using now native integer size where appropriate
@@ -12,6 +12,9 @@
       korgdump and sf2extract.
     - Fixed CVE-2017-12950, CVE-2017-12952, CVE-2017-12953
       (original patch by Paul Brossier, slightly modified).
+    - Debian: Fixed packaging error about invalid substitution variable
+      "Source-Version".
+    - Raised Debian compatibility level to Debian 9 "Stretch".
 
   * src/gig.cpp, src/gig.h:
     - fixed bug in Script::SetGroup: the script chunk wasn't moved
@@ -48,6 +51,10 @@
       DimensionRegion::EG1Options and DimensionRegion::EG2Options as an
       extension to the gig file format, which allows to override the default
       behavior of the first two EGs' state machines.
+    - Fixed undefined behavior when loading a gig file with invalid
+      velocity curve parameters (fixes CVE-2017-12951).
+    - Fixed undefined behavior when loading a gig file with invalid wave
+      pool index number (fixes CVE-2017-12954).
 
   * src/DLS.cpp, src/DLS.h:
     - Sample: wave pool offsets are now 64 bits (to allow support for files
@@ -93,6 +100,9 @@
     - DataType fix: Retain backward compatibility to older versions of native
       C++ classes/structs.
 
+  * src/Akai.cpp:
+    - Fixed compilation error with recent, more strict compilers.
+
   * src/tools/akaidump.cpp, src/tools/akaiextract.cpp:
     - improved output of non-ascii characters in usage messages
     - fixed printf format strings