-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Format: 1.8 Date: Sun, 23 Aug 2026 14:45:36 +0100 Source: libsdl2-image Binary: libsdl2-image-2.0-0 libsdl2-image-2.0-0-dbgsym libsdl2-image-dev libsdl2-image-tests libsdl2-image-tests-dbgsym Architecture: ppc64el Version: 2.8.8+dfsg-1+deb13u1 Distribution: trixie Urgency: medium Maintainer: ppc64el Build Daemon (ppc64el-osuosl-02) Changed-By: Simon McVittie Description: libsdl2-image-2.0-0 - Image loading library for Simple DirectMedia Layer 2, libraries libsdl2-image-dev - Image loading library for Simple DirectMedia Layer 2, development libsdl2-image-tests - Image loading library for Simple DirectMedia Layer 2 - tests Closes: 1133010 Changes: libsdl2-image (2.8.8+dfsg-1+deb13u1) trixie; urgency=medium . [ Aquila Macedo Costa ] * d/p/Fixed-out-of-bounds-read-in-XCF-image-loader-thanks-Sebas.patch: Import upstream patch for CVE-2026-35444 (Closes: #1133010) * d/patches: Add selected upstream malformed-image parser robustness fixes: - d/p/xpm-Remove-QUICK_COLORHASH-replace-it-with-inline-code-th.patch: check XPM color hash entries before use - d/p/Fix-heap-buffer-overflow-WRITE-in-LBM-palette-CWE-122.patch: fix LBM palette overflow - d/p/xcf-Fix-heap-buffer-overflow-READ-in-XCF-RLE-decoder-CWE-.patch: add XCF RLE decoder bounds checks - d/p/Fix-heap-buffer-overflow-READ-in-XCF-do_layer_surface-CWE.patch, d/p/xcf-Added-an-SDL_SetError-when-rejecting-out-of-bounds-ti.patch: add XCF do_layer_surface tile bounds check, report invalid XCF tile data through SDL_SetError() - d/p/xcf-fix-null-pointer-dereference-when-read_xcf_hierarchy-.patch: check XCF hierarchy read failures before dereferencing - d/p/tga-reject-images-with-zero-width-or-height.patch: reject TGA images with zero width or height - d/p/Fixed-out-of-bound-read-in-GIF-decoder.patch: fix out-of-bounds reads in the GIF decoder . [ Simon McVittie ] * d/control, d/gbp.conf: Branch for trixie * d/patches: Improve patch metadata: add CVE ID, Debian bug number, upstream commit references, etc. * d/patches: Re-export patches with their mechanically-generated names and apply them in the same order that upstream did, to make it more obvious how this version compares with 2.8.12 * d/patches: Add additional robustness fixes for parsing malformed images: - d/p/xcf-Permit-empty-strings-in-read_string.patch: Avoid an out-of-bounds write if XCF files contain a zero-length string - d/p/IMG_xcf.c-read_string-add-back-the-positive-string-size-c.patch: Harden XCF parsing against extremely long strings Checksums-Sha1: 48f360d0b840549696dc12baec9b2e3e3a9445d4 179628 libsdl2-image-2.0-0-dbgsym_2.8.8+dfsg-1+deb13u1_ppc64el.deb 1785ad3428e5f63687d2665158616bcc740ab978 74168 libsdl2-image-2.0-0_2.8.8+dfsg-1+deb13u1_ppc64el.deb 173198c419ca05cfb6d23b6775e04468bc994a58 90148 libsdl2-image-dev_2.8.8+dfsg-1+deb13u1_ppc64el.deb 246c6a9a3d2a6fc00c8da0056eca5398f97fc109 37848 libsdl2-image-tests-dbgsym_2.8.8+dfsg-1+deb13u1_ppc64el.deb 3288cf91011267f2dd8de6827818d20458d470de 71360 libsdl2-image-tests_2.8.8+dfsg-1+deb13u1_ppc64el.deb 6f30693e60365b7b9503615726b7732dbe5f1c33 12946 libsdl2-image_2.8.8+dfsg-1+deb13u1_ppc64el-buildd.buildinfo Checksums-Sha256: 9f9361b620b060e40393acbdb0fe85765132bc0d1096eb36408ad801979b6979 179628 libsdl2-image-2.0-0-dbgsym_2.8.8+dfsg-1+deb13u1_ppc64el.deb c9a861d7ad3ad83c0d4ff64edcc4ea5bcf19a56b589c0d5c3c8d2b43ad77d29e 74168 libsdl2-image-2.0-0_2.8.8+dfsg-1+deb13u1_ppc64el.deb b141eeb69cf26aa40ecf15bff2dd999582edbd4b77a1697356f33b8bfea55882 90148 libsdl2-image-dev_2.8.8+dfsg-1+deb13u1_ppc64el.deb f63d2bbfa8cd878105ab7eaff768f14876484cb50ca9fac81823d3d4f5fda590 37848 libsdl2-image-tests-dbgsym_2.8.8+dfsg-1+deb13u1_ppc64el.deb 0af2b48916e62c7727832549f01c034970693953a5785a6f4d41c58a20245a2f 71360 libsdl2-image-tests_2.8.8+dfsg-1+deb13u1_ppc64el.deb ff3ee0c83dec225ae4a6e5912a67f11516b4721fa053b00e49eaef3492feadaf 12946 libsdl2-image_2.8.8+dfsg-1+deb13u1_ppc64el-buildd.buildinfo Files: c3a122440a997fc9695a210a2304a2a9 179628 debug optional libsdl2-image-2.0-0-dbgsym_2.8.8+dfsg-1+deb13u1_ppc64el.deb d83b4d36dac1524234d39959f125f5f8 74168 libs optional libsdl2-image-2.0-0_2.8.8+dfsg-1+deb13u1_ppc64el.deb 91d74ecb78681f4a137e51e1eaae4725 90148 libdevel optional libsdl2-image-dev_2.8.8+dfsg-1+deb13u1_ppc64el.deb 83453d656d31dce4aa818b386873bcf4 37848 debug optional libsdl2-image-tests-dbgsym_2.8.8+dfsg-1+deb13u1_ppc64el.deb 75fb6af4cb679e2fb1270f1a95d4d7b7 71360 misc optional libsdl2-image-tests_2.8.8+dfsg-1+deb13u1_ppc64el.deb 6dd0d1e4f79269f33f127e4e7cc1df6a 12946 libs optional libsdl2-image_2.8.8+dfsg-1+deb13u1_ppc64el-buildd.buildinfo -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEE9ibmwdV9gdKNbK7oV8ucRsMTpuMFAmqamscACgkQV8ucRsMT puO7chAApWXJIcNOpbbebgOUamf15MlitzxljM9x5yrVw26Oi9iDUG+FQH3okGFA oOWRF83KKwIPh3Asie0Qek4lC7kwvh+qjRzECaS1fZtdo/Fcm/5XDjAWf6HIOByg FgUhgi5k3HBkPOx7qS4qn3rk1vMfRwqKu29iYyGxnzQg8ns7nzep/L38xm4OYj0c AdBiScOnBA+97CVapS6HkQuDKy2Oz9pAiQ6PMmPNI6QumXccPY54forA0jJ72QLp 9wiXkisl6siJAzi9KVkzm0JXJ5/Er80MHzPB+FQmhnitf/S7pXzOClfeNDEBwA06 OCtmG2kp9HWMOo4Ma91zPDgJJXk9+4chZRG6JfXIoP5J2C3AnBhEdH1bIsH8MOef ZMXwBFYGL/L8zsQ/CtGhPKwpvJXa1zGD9jkvGBwdr08zshqLcGdhP51DmHvEAzM6 n09XgvS4JTmsksm2AxX80fLpN0nx5fwpEf/mi04zX51Ta1VIhog/FyU0PQiAOEyF p5ZaK+SlHJCfQPeaMENWHKxuANczHFHQawbhP7ksVJdZP1abiLsz6HO2E+x0x37t IWmwuixNHBq6kmySL3DlAdtBOA98p38D9Faxj4zd9GbGy7Eiv4iF8liB/w2x87pi IsbPRIFidVtQKcjhPM83qV0SK800dNXbPrOuSuSAnNedafSdKE0= =llK1 -----END PGP SIGNATURE-----