--- libgig/trunk/ChangeLog	2017/07/29 09:59:35	3334
+++ libgig/trunk/ChangeLog	2017/10/03 17:35:02	3350
@@ -10,6 +10,8 @@
     - print compiler warning if no RTTI available
     - Fixed potential crash in command line tools gig2stereo, korg2gig,
       korgdump and sf2extract.
+    - Fixed CVE-2017-12950, CVE-2017-12952, CVE-2017-12953
+      (original patch by Paul Brossier, slightly modified).
 
   * src/gig.cpp, src/gig.h:
     - fixed bug in Script::SetGroup: the script chunk wasn't moved
@@ -46,6 +48,10 @@
       DimensionRegion::EG1Options and DimensionRegion::EG2Options as an
       extension to the gig file format, which allows to override the default
       behavior of the first two EGs' state machines.
+    - Fixed undefined behavior when loading a gig file with invalid
+      velocity curve parameters (fixes CVE-2017-12951).
+    - Fixed undefined behavior when loading a gig file with invalid wave
+      pool index number (fixes CVE-2017-12954).
 
   * src/DLS.cpp, src/DLS.h:
     - Sample: wave pool offsets are now 64 bits (to allow support for files