zachbacon/BriskPlayer
Watch
1
0
Fork
You've already forked BriskPlayer
 0
mirror of https://github.com/BriskPlayer/BriskPlayer/ synced 2026-10-23 00:05:40 -04:00
Code Issues Projects Releases Packages Wiki Activity
No description
103 commits 1 branch 9 tags 3 MiB
  • C 85.6%
  • Rust 10.5%
  • CMake 2.1%
  • C++ 1.3%
  • PowerShell 0.4%
Find a file
Exact
Repository files (latest commit first)
Filename Latest commit message Latest commit date
Zach Bacon f4921a18f7 fix(security): harden parsing of untrusted input and process/DLL loading 
Most of what the player reads (media files, tags, playlists, skin packages,
stream responses, WM_COPYDATA) can come from a malicious source. This pass
closes memory-safety bugs in those paths and adds exploit mitigations.

Build / process
- Turn on compiler and linker mitigations, each flag probed first: CFG and
  CET on MSVC; stack protector, _FORTIFY_SOURCE=2, dynamicbase, nxcompat,
  cetcompat, high-entropy-va or large-address-aware on MinGW
- New main_harden_process() at startup: terminate on heap corruption, keep
  the current directory out of DLL search, use safe search mode, prefer
  System32 images, block DLLs from remote drives unless the player itself
  runs from one
- LoadLibrarySafeA uses LoadLibraryExW with LOAD_LIBRARY_SEARCH_* flags
  instead of changing SetDllDirectory process-wide
- Rust: overflow-checks on for the brisk-codecs crate in release builds

Untrusted input
- minimp4: limit sample-table allocations by box and file size (fixes 32-bit
  size wraparound), free tables when a box repeats, bounds-check avcC
  writes and frame lookups, turn off AVC/HEVC config parsing
- WM_COPYDATA: only read within cbData, size argv from the actual data; the
  sending instance now packs its arguments into one contiguous buffer
- Skins: fix out-of-bounds reads in skin line and parameter parsing, skip
  buttons whose image is missing, NULL-check image drawing, copy oversized
  ini values safely, destroy the playlist window before freeing the old skin
- Playlists: read local files with GetFileSizeEx plus a 64 MB cap, handle
  long and stream paths on export, guard directory recursion and paths that
  don't fit MAX_PATH
- MP3 length: reject reserved layer bits, do duration math in 64 bits;
  enlarge the track-length text buffer
- Truncate tag text for tooltip and tray tip instead of overflowing or
  aborting
- bitmap2region: check GetObject and guard the size multiplication
- Winamp plugin extensions must be alphanumeric before going into the
  file-dialog filter

Network / decoders
- WinINet (C and Rust): NO_COOKIES, NO_AUTH and NO_UI on all stream and
  playlist requests
- FFmpeg: protocol_whitelist=none so demuxers can't open nested URLs or
  local files
- WIC: only decode JPEG/PNG/GIF/BMP from album art and skins, and only with
  Windows' built-in decoders

Misc
- OFN_NOCHANGEDIR on all file dialogs; discord_rpc_debug.log goes next to
  the exe instead of the current directory
- Remove the stale TagLib include and credit lofty for tag support in the
  readme
2026-10-20 22:11:12 -04:00
.claude Begin initial framework for porting codecs to rust 2026-06-20 06:59:07 -04:00
po feat(i18n): make dialogs translatable, automate the POT; drop shell integration options 2026-10-20 09:49:03 -04:00
res feat(skin): unify main/EQ/shade skins into CPSkin, add external skin switching 2026-09-24 21:04:19 -04:00
rust fix(security): harden parsing of untrusted input and process/DLL loading 2026-10-20 22:11:12 -04:00
tests Fix crash bugs and improve sticky windows behavior 2026-01-13 12:40:42 -05:00
.gitignore feat(playlist): port data model from C to Rust 2026-06-20 09:26:45 -04:00
_BldNum.h Briskplayer is born 2025-09-12 11:17:33 -04:00
about.c feat(i18n): make dialogs translatable, automate the POT; drop shell integration options 2026-10-20 09:49:03 -04:00
bitmap2region.c fix(security): harden parsing of untrusted input and process/DLL loading 2026-10-20 22:11:12 -04:00
briskplayer.rc feat(i18n): make dialogs translatable, automate the POT; drop shell integration options 2026-10-20 09:49:03 -04:00
c23_compat.h Drop C Based decoders 2026-06-21 01:09:21 -04:00
CLV_ListView.c perf: optimise playlist, paint, and string hot paths 2026-05-01 21:23:44 -04:00
CLV_ListView.h Translations using gettext 2025-11-03 22:06:21 -05:00
CMakeLists.txt fix(security): harden parsing of untrusted input and process/DLL loading 2026-10-20 22:11:12 -04:00
CMakePresets.json fix: harden C core and Rust codec crate, fix MinGW/vcpkg build breakage 2026-09-06 22:42:25 -04:00
CompositeFile.c feat(skin): unify main/EQ/shade skins into CPSkin, add external skin switching 2026-09-24 21:04:19 -04:00
CompositeFile.h feat(skin): unify main/EQ/shade skins into CPSkin, add external skin switching 2026-09-24 21:04:19 -04:00
CP_Architecture.h OS Requirements raised 2026-05-01 21:38:35 -04:00
CP_Cleanup.h Fix crash bugs and improve sticky windows behavior 2026-01-13 12:40:42 -05:00
CP_Config.c fix: harden C core and Rust codec crate, fix MinGW/vcpkg build breakage 2026-09-06 22:42:25 -04:00
CP_Config.h Fix crash bugs and improve sticky windows behavior 2026-01-13 12:40:42 -05:00
CP_Constants.h fix(security): harden parsing of untrusted input and process/DLL loading 2026-10-20 22:11:12 -04:00
CP_Result.h Fix crash bugs and improve sticky windows behavior 2026-01-13 12:40:42 -05:00
CP_RIFFStructs.h Briskplayer is born 2025-09-12 11:17:33 -04:00
CP_SafeGlobals.h Add NULL-safe global access macros, Unicode support, and i18n improvements 2026-01-13 13:08:27 -05:00
CP_Test.h Fix crash bugs and improve sticky windows behavior 2026-01-13 12:40:42 -05:00
CP_Unicode.h Fix crash bugs and improve sticky windows behavior 2026-01-13 12:40:42 -05:00
CP_Version.h.in build: centralize version management in CMake 2026-01-13 21:38:42 -05:00
CP_WinAmpStructs.h Add WinAmp DSP plugin support 2026-01-16 12:47:02 -05:00
CPI_AlbumArtTooltip.c fix(security): harden parsing of untrusted input and process/DLL loading 2026-10-20 22:11:12 -04:00
CPI_AlbumArtTooltip.h fix(tooltip): stop deleting cached album art bitmap 2026-01-13 09:45:53 -05:00
CPI_CircleBuffer.c fix: close out a second audit pass over the remaining C surface and the 2026-09-12 08:53:13 -04:00
CPI_CircleBuffer.h fix: close out a second audit pass over the remaining C surface and the 2026-09-12 08:53:13 -04:00
CPI_DiscordRPC.c fix(security): harden parsing of untrusted input and process/DLL loading 2026-10-20 22:11:12 -04:00
CPI_DiscordRPC.h This is a huge set of changes 2026-04-12 20:30:07 -04:00
CPI_DpiScale.c feat(skin): unify main/EQ/shade skins into CPSkin, add external skin switching 2026-09-24 21:04:19 -04:00
CPI_DpiScale.h feat(skin): unify main/EQ/shade skins into CPSkin, add external skin switching 2026-09-24 21:04:19 -04:00
CPI_Equaliser.h Briskplayer is born 2025-09-12 11:17:33 -04:00
CPI_Equaliser_Basic.c Drop C Based decoders 2026-06-21 01:09:21 -04:00
CPI_Gettext.c feat(i18n): make dialogs translatable, automate the POT; drop shell integration options 2026-10-20 09:49:03 -04:00
CPI_Gettext.h feat(i18n): make dialogs translatable, automate the POT; drop shell integration options 2026-10-20 09:49:03 -04:00
CPI_Image.c fix(security): harden parsing of untrusted input and process/DLL loading 2026-10-20 22:11:12 -04:00
CPI_Image.h Briskplayer is born 2025-09-12 11:17:33 -04:00
CPI_Indicators.c Fix crash bugs and improve sticky windows behavior 2026-01-13 12:40:42 -05:00
CPI_Indicators.h Briskplayer is born 2025-09-12 11:17:33 -04:00
CPI_Interface.c fix: harden C core and Rust codec crate, fix MinGW/vcpkg build breakage 2026-09-06 22:42:25 -04:00
CPI_Interface.h Briskplayer is born 2025-09-12 11:17:33 -04:00
CPI_InterfacePart.c Briskplayer is born 2025-09-12 11:17:33 -04:00
CPI_InterfacePart.h Briskplayer is born 2025-09-12 11:17:33 -04:00
CPI_InterfacePart_CommandButton.c Fix crash bugs and improve sticky windows behavior 2026-01-13 12:40:42 -05:00
CPI_InterfacePart_Indicator.c Minor Adjustments and fixes 2026-04-28 20:40:46 -04:00
CPI_Keyboard.c Add NULL-safe global access macros, Unicode support, and i18n improvements 2026-01-13 13:08:27 -05:00
CPI_Keyboard.h Briskplayer is born 2025-09-12 11:17:33 -04:00
CPI_Player.c feat(i18n): make dialogs translatable, automate the POT; drop shell integration options 2026-10-20 09:49:03 -04:00
CPI_Player.h feat(i18n): make dialogs translatable, automate the POT; drop shell integration options 2026-10-20 09:49:03 -04:00
CPI_Player_Callbacks.c Various fixes, removal of unused variables etc 2026-04-20 14:20:02 -04:00
CPI_Player_CoDec.h feat(i18n): make dialogs translatable, automate the POT; drop shell integration options 2026-10-20 09:49:03 -04:00
CPI_Player_CoDec_AAC.c refactor: code cleanup, and Discord RPC improvements 2026-04-29 09:37:56 -04:00
CPI_Player_CoDec_C23.h chore: remove dead OGG duplicate-parser and unused C23 codec scaffolding 2026-09-22 13:36:37 -04:00
CPI_Player_CoDec_FFmpeg.c fix(security): harden parsing of untrusted input and process/DLL loading 2026-10-20 22:11:12 -04:00
CPI_Player_CoDec_OPUS.c Optimizations 2026-06-20 23:46:53 -04:00
CPI_Player_CoDec_WinAmpPlugin.c feat(skin): unify main/EQ/shade skins into CPSkin, add external skin switching 2026-09-24 21:04:19 -04:00
CPI_Player_DSP.c refactor: code cleanup, and Discord RPC improvements 2026-04-29 09:37:56 -04:00
CPI_Player_DSP.h Add WinAmp DSP plugin support 2026-01-16 12:47:02 -05:00
CPI_Player_Engine.c fix(security): harden parsing of untrusted input and process/DLL loading 2026-10-20 22:11:12 -04:00
CPI_Player_Engine.h refactor: code cleanup, and Discord RPC improvements 2026-04-29 09:37:56 -04:00
CPI_Player_FileAssoc.c fix(security): harden parsing of untrusted input and process/DLL loading 2026-10-20 22:11:12 -04:00
CPI_Player_Messages.h feat(i18n): make dialogs translatable, automate the POT; drop shell integration options 2026-10-20 09:49:03 -04:00
CPI_Player_Output.h refactor: code cleanup, and Discord RPC improvements 2026-04-29 09:37:56 -04:00
CPI_Player_Output_DirectSound.c refactor: code cleanup, and Discord RPC improvements 2026-04-29 09:37:56 -04:00
CPI_Player_Output_FAudio.c refactor: code cleanup, and Discord RPC improvements 2026-04-29 09:37:56 -04:00
CPI_Player_Output_File.c fix(security): harden parsing of untrusted input and process/DLL loading 2026-10-20 22:11:12 -04:00
CPI_Player_Output_WASAPI.c Drop C Based decoders 2026-06-21 01:09:21 -04:00
CPI_Player_Output_Wave.c refactor: code cleanup, and Discord RPC improvements 2026-04-29 09:37:56 -04:00
CPI_Playlist.c fix(security): harden parsing of untrusted input and process/DLL loading 2026-10-20 22:11:12 -04:00
CPI_Playlist.h feat(codec): load FFmpeg at runtime from an ffmpeg folder instead of linking 2026-10-19 19:01:53 -04:00
CPI_Playlist_Callbacks.c Fix crash bugs and improve sticky windows behavior 2026-01-13 12:40:42 -05:00
CPI_PlaylistItem.c fix(security): harden parsing of untrusted input and process/DLL loading 2026-10-20 22:11:12 -04:00
CPI_PlaylistItem.h feat(playlist): port data model from C to Rust 2026-06-20 09:26:45 -04:00
CPI_PlaylistItem_Internal.h perf: Optimize TagLib metadata reading and caching 2026-01-13 14:03:59 -05:00
CPI_PlaylistWindow.c refactor: code cleanup, and Discord RPC improvements 2026-04-29 09:37:56 -04:00
CPI_PlaylistWindow.h Briskplayer is born 2025-09-12 11:17:33 -04:00
CPI_ReplayGain.c Drop C Based decoders 2026-06-21 01:09:21 -04:00
CPI_ReplayGain.h This is a huge set of changes 2026-04-12 20:30:07 -04:00
CPI_RIFFUtil.c Begin initial framework for porting codecs to rust 2026-06-20 06:59:07 -04:00
CPI_Stream.c feat: code hardening, static libc++, and EQ preset menu 2026-04-21 18:19:07 -04:00
CPI_Stream.h fix: harden C core and Rust codec crate, fix MinGW/vcpkg build breakage 2026-09-06 22:42:25 -04:00
CPI_Stream_Internet.c Add some more rust based codecs 2026-06-20 14:46:30 -04:00
CPI_Stream_LocalFile.c refactor: code cleanup, and Discord RPC improvements 2026-04-29 09:37:56 -04:00
CPI_TagLib.c fix(security): harden parsing of untrusted input and process/DLL loading 2026-10-20 22:11:12 -04:00
CPI_TagLib.h fix(security): harden parsing of untrusted input and process/DLL loading 2026-10-20 22:11:12 -04:00
CPI_TaskbarIntegration.c This is a huge set of changes 2026-04-12 20:30:07 -04:00
CPI_TaskbarIntegration.h This is a huge set of changes 2026-04-12 20:30:07 -04:00
CPI_Translation.c feat(i18n): make dialogs translatable, automate the POT; drop shell integration options 2026-10-20 09:49:03 -04:00
CPI_Translation.h feat(i18n): make dialogs translatable, automate the POT; drop shell integration options 2026-10-20 09:49:03 -04:00
CPI_Verbs.c fix(security): harden parsing of untrusted input and process/DLL loading 2026-10-20 22:11:12 -04:00
CPI_Verbs.h Briskplayer is born 2025-09-12 11:17:33 -04:00
CPSK_Skin.c fix(security): harden parsing of untrusted input and process/DLL loading 2026-10-20 22:11:12 -04:00
CPSK_Skin.h feat(skin): unify main/EQ/shade skins into CPSkin, add external skin switching 2026-09-24 21:04:19 -04:00
CPString.c perf: optimise playlist, paint, and string hot paths 2026-05-01 21:23:44 -04:00
CPString.h Various fixes, removal of unused variables etc 2026-04-20 14:20:02 -04:00
crctables.h Briskplayer is born 2025-09-12 11:17:33 -04:00
debug.h This is a huge set of changes 2026-04-12 20:30:07 -04:00
DLG_Equalizer.c feat(i18n): make dialogs translatable, automate the POT; drop shell integration options 2026-10-20 09:49:03 -04:00
DLG_Equalizer.h feat(i18n): make dialogs translatable, automate the POT; drop shell integration options 2026-10-20 09:49:03 -04:00
DLG_Find.c feat(i18n): make dialogs translatable, automate the POT; drop shell integration options 2026-10-20 09:49:03 -04:00
DLG_Find.h Briskplayer is born 2025-09-12 11:17:33 -04:00
DLG_Properties.c feat(i18n): make dialogs translatable, automate the POT; drop shell integration options 2026-10-20 09:49:03 -04:00
DLG_Properties.h feat: Add playlist context menu and properties dialog with MusicBrainz integration 2026-01-11 12:34:52 -05:00
globals.c fix(security): harden parsing of untrusted input and process/DLL loading 2026-10-20 22:11:12 -04:00
globals.h feat(i18n): make dialogs translatable, automate the POT; drop shell integration options 2026-10-20 09:49:03 -04:00
license.md About.c Changed the changelog to be for a license block 2025-11-08 08:44:34 -05:00
main.c fix(security): harden parsing of untrusted input and process/DLL loading 2026-10-20 22:11:12 -04:00
MainMenu.c feat(skin): unify main/EQ/shade skins into CPSkin, add external skin switching 2026-09-24 21:04:19 -04:00
MainMenu.h feat(skin): unify main/EQ/shade skins into CPSkin, add external skin switching 2026-09-24 21:04:19 -04:00
minimp4.h fix(security): harden parsing of untrusted input and process/DLL loading 2026-10-20 22:11:12 -04:00
options.c feat(i18n): make dialogs translatable, automate the POT; drop shell integration options 2026-10-20 09:49:03 -04:00
profile.c feat(skin): unify main/EQ/shade skins into CPSkin, add external skin switching 2026-09-24 21:04:19 -04:00
readme.md fix(security): harden parsing of untrusted input and process/DLL loading 2026-10-20 22:11:12 -04:00
resource.h feat(i18n): make dialogs translatable, automate the POT; drop shell integration options 2026-10-20 09:49:03 -04:00
RotatingIcon.c fix(security): harden parsing of untrusted input and process/DLL loading 2026-10-20 22:11:12 -04:00
RotatingIcon.h Fix crash bugs and improve sticky windows behavior 2026-01-13 12:40:42 -05:00
safe_string.h Fix crash bugs and improve sticky windows behavior 2026-01-13 12:40:42 -05:00
shwapi.c C23: This adds some additional feature changes 2025-11-22 19:51:27 -05:00
skin.c fix(security): harden parsing of untrusted input and process/DLL loading 2026-10-20 22:11:12 -04:00
skin.h This is a huge set of changes 2026-04-12 20:30:07 -04:00
stdafx.c Briskplayer is born 2025-09-12 11:17:33 -04:00
stdafx.h fix: harden C core and Rust codec crate, fix MinGW/vcpkg build breakage 2026-09-06 22:42:25 -04:00
summary.md fix: close out a second audit pass over the remaining C surface and the 2026-09-12 08:53:13 -04:00
threading_compat.h OS Requirements raised 2026-05-01 21:38:35 -04:00
vcpkg-configuration.json This is a huge set of changes 2026-04-12 20:30:07 -04:00
vcpkg-install.ps1 This is a huge set of changes 2026-04-12 20:30:07 -04:00
vcpkg-native-arm64.ini meson.build Setup with vcpkg 2025-09-13 12:47:27 -04:00
vcpkg-native-x86.ini Some code cleanup 2025-10-24 20:44:11 -04:00
vcpkg-native.ini meson cross file: x64 2025-11-11 06:49:32 -05:00
vcpkg.json feat(codec): load FFmpeg at runtime from an ffmpeg folder instead of linking 2026-10-19 19:01:53 -04:00
WindowSnapping.c Various fixes, removal of unused variables etc 2026-04-20 14:20:02 -04:00
WindowSnapping.h Improve window snapping with Audacious-style algorithm 2026-01-16 11:03:59 -05:00
WindowsOS.c Fix crash bugs and improve sticky windows behavior 2026-01-13 12:40:42 -05:00
WindowsOS.h OS Requirements raised 2026-05-01 21:38:35 -04:00
WinModern.c fix(security): harden parsing of untrusted input and process/DLL loading 2026-10-20 22:11:12 -04:00
WinModern.h fix(security): harden parsing of untrusted input and process/DLL loading 2026-10-20 22:11:12 -04:00

readme.md

Welcome to BriskPlayer

A Blazing fast media player forked from CoolPlayer and written in C

BriskPlayer

Features

  • GNU General Public License
  • Freeform Skins
  • Simple User Interface
  • Advanced Playlist editor
  • Internet streaming
  • File Renamer
  • Fast mp3->wav converter
  • Optional FFMpeg codec support (see below)
  • Winamp input plugins support
  • Smallest executable programmed in blazing fast 'C'
  • Continuous play
  • 8 band convolution equalizer
  • Translation Engine using gettext
  • Metadata tag support (ID3, Vorbis comments, MP4, APE) made possible using lofty
  • Modernized codebase fork of the CoolPlayer media player

Optional FFmpeg support

BriskPlayer is not built against FFmpeg. To play formats beyond the built-in codecs (APE, WavPack, WMA, AC3/DTS, TTA, Musepack, ...), put a shared FFmpeg 7.x, 8.x or 9.x build matching the player's architecture (32/64-bit) into a folder named ffmpeg next to briskplayer.exe:

briskplayer.exe
ffmpeg\avutil-NN.dll
ffmpeg\swresample-NN.dll
ffmpeg\avcodec-NN.dll
ffmpeg\avformat-NN.dll
ffmpeg\(any other DLLs those depend on)

An FFmpeg release archive (for example gyan.dev's ffmpeg-release-full-shared.7z) can also simply be extracted into the ffmpeg folder: ffmpeg\bin\ and ffmpeg\<subfolder>\bin\ are searched as well. The DLLs are picked up on startup. Built-in codecs keep handling the formats they support; FFmpeg handles the rest and acts as a fallback for files a built-in codec can't open.

Skin was created and is copyright NeoRame and released under the terms GPL with my own modifications to fit the name of the fork.

If you like to see your language in briskplayer, then use this POT File to begin translating!