-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Format: 1.8 Date: Sun, 23 Aug 2026 14:45:36 +0100 Source: libsdl2-image Binary: libsdl2-image-2.0-0 libsdl2-image-2.0-0-dbgsym libsdl2-image-dev libsdl2-image-tests libsdl2-image-tests-dbgsym Architecture: riscv64 Version: 2.8.8+dfsg-1+deb13u1 Distribution: trixie Urgency: medium Maintainer: riscv64 Build Daemon (rv-osuosl-04) Changed-By: Simon McVittie Description: libsdl2-image-2.0-0 - Image loading library for Simple DirectMedia Layer 2, libraries libsdl2-image-dev - Image loading library for Simple DirectMedia Layer 2, development libsdl2-image-tests - Image loading library for Simple DirectMedia Layer 2 - tests Closes: 1133010 Changes: libsdl2-image (2.8.8+dfsg-1+deb13u1) trixie; urgency=medium . [ Aquila Macedo Costa ] * d/p/Fixed-out-of-bounds-read-in-XCF-image-loader-thanks-Sebas.patch: Import upstream patch for CVE-2026-35444 (Closes: #1133010) * d/patches: Add selected upstream malformed-image parser robustness fixes: - d/p/xpm-Remove-QUICK_COLORHASH-replace-it-with-inline-code-th.patch: check XPM color hash entries before use - d/p/Fix-heap-buffer-overflow-WRITE-in-LBM-palette-CWE-122.patch: fix LBM palette overflow - d/p/xcf-Fix-heap-buffer-overflow-READ-in-XCF-RLE-decoder-CWE-.patch: add XCF RLE decoder bounds checks - d/p/Fix-heap-buffer-overflow-READ-in-XCF-do_layer_surface-CWE.patch, d/p/xcf-Added-an-SDL_SetError-when-rejecting-out-of-bounds-ti.patch: add XCF do_layer_surface tile bounds check, report invalid XCF tile data through SDL_SetError() - d/p/xcf-fix-null-pointer-dereference-when-read_xcf_hierarchy-.patch: check XCF hierarchy read failures before dereferencing - d/p/tga-reject-images-with-zero-width-or-height.patch: reject TGA images with zero width or height - d/p/Fixed-out-of-bound-read-in-GIF-decoder.patch: fix out-of-bounds reads in the GIF decoder . [ Simon McVittie ] * d/control, d/gbp.conf: Branch for trixie * d/patches: Improve patch metadata: add CVE ID, Debian bug number, upstream commit references, etc. * d/patches: Re-export patches with their mechanically-generated names and apply them in the same order that upstream did, to make it more obvious how this version compares with 2.8.12 * d/patches: Add additional robustness fixes for parsing malformed images: - d/p/xcf-Permit-empty-strings-in-read_string.patch: Avoid an out-of-bounds write if XCF files contain a zero-length string - d/p/IMG_xcf.c-read_string-add-back-the-positive-string-size-c.patch: Harden XCF parsing against extremely long strings Checksums-Sha1: c64461301a9179c37e73017045ca3bcc26ce6683 167792 libsdl2-image-2.0-0-dbgsym_2.8.8+dfsg-1+deb13u1_riscv64.deb 726dd4f91986eb8771b3a1fe2583031507d4befe 69328 libsdl2-image-2.0-0_2.8.8+dfsg-1+deb13u1_riscv64.deb 8398ced751d36b5c94db360d6ac8ea7e98ca65e0 160272 libsdl2-image-dev_2.8.8+dfsg-1+deb13u1_riscv64.deb 9ad1a6c6f0afb252ff858fdcd13eb0084fb9171b 36808 libsdl2-image-tests-dbgsym_2.8.8+dfsg-1+deb13u1_riscv64.deb af146fa3de6b5a2655e8543195fc8852ff83be3b 66976 libsdl2-image-tests_2.8.8+dfsg-1+deb13u1_riscv64.deb a2b40c764d2061f5ebec9920ae142c347698a0b5 12924 libsdl2-image_2.8.8+dfsg-1+deb13u1_riscv64-buildd.buildinfo Checksums-Sha256: 0513d669684006b8203726d5e58f6e92e093102ff65e0f9f84bd8696c50744d0 167792 libsdl2-image-2.0-0-dbgsym_2.8.8+dfsg-1+deb13u1_riscv64.deb a02d8a89a2d8f44121ae7fbbbbe0f801bbad62858e6ae9cabfcbed74eb6aebb0 69328 libsdl2-image-2.0-0_2.8.8+dfsg-1+deb13u1_riscv64.deb a187f0115d9e8a8f3b211a459b738623970fc668cbcdb9d62fbdbacb8d3ca8ba 160272 libsdl2-image-dev_2.8.8+dfsg-1+deb13u1_riscv64.deb 43c83c7e510f27aa5d650e84a68e74d68e31446cbcb2c128a0b77bbda19289d2 36808 libsdl2-image-tests-dbgsym_2.8.8+dfsg-1+deb13u1_riscv64.deb d5713507275a5dbd8510efcfc4cd059fe3a83dc4ceec0ee48544bcd6be066130 66976 libsdl2-image-tests_2.8.8+dfsg-1+deb13u1_riscv64.deb c87424ee62932be44c2005979018e55a865627a485d9c7604b9d5beefaa008c9 12924 libsdl2-image_2.8.8+dfsg-1+deb13u1_riscv64-buildd.buildinfo Files: f5d09e457dd6cb88fe5ef1bf10e0d20c 167792 debug optional libsdl2-image-2.0-0-dbgsym_2.8.8+dfsg-1+deb13u1_riscv64.deb 1231cbb2b325cd9a093d75ceba9559fb 69328 libs optional libsdl2-image-2.0-0_2.8.8+dfsg-1+deb13u1_riscv64.deb 1a57a2680485088a2c4346b43b5dcb41 160272 libdevel optional libsdl2-image-dev_2.8.8+dfsg-1+deb13u1_riscv64.deb f2762be833c54db9116c24bf83065c82 36808 debug optional libsdl2-image-tests-dbgsym_2.8.8+dfsg-1+deb13u1_riscv64.deb d77db5d4c4e3c73104e4a28c12e934fc 66976 misc optional libsdl2-image-tests_2.8.8+dfsg-1+deb13u1_riscv64.deb 17bf5756f91808aa32b8812087988213 12924 libs optional libsdl2-image_2.8.8+dfsg-1+deb13u1_riscv64-buildd.buildinfo -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEgLDDByWcR07HDSHyNVgvumj7+mMFAmqatPUACgkQNVgvumj7 +mNAJhAAi51MPeFxnOxzd7S9bfxKT0Q0CTXqFMN0HbMbM7llEGiRc1e9F/eldWdL xq39ED6k1W94UDm9gYfKpC0I85YcqDsyoDdz4rzstbB1L098RTkIMmtB260izRM4 6PGQKLtbaZRF1+tnD0bXS9q7EzrAkc4ONq1RgrGhfG5vXu+Olg4eOWZ3TBGBp3Gu K0zNlbKkiZJduYcXK/YmyISealDuUB6OTzEmb3JKVldMIqO3Tfs++wVTd4clMiJr O0TbqXTx9H/8xxzvtjIabHmn3ttyUBDdRR8nfplt2NHgxksMLYTDPOo5XCbYIsaQ rn+YD9rv5Yzv3Eyws0eYxa05m+WiRsgP3OD9HwAArAkZQvivcOO/bpXYxEtNLwHH Ln23aIlMAZTGjbxNAD93w2go/Ya5kdGAGkNVnHl5jeuIkAlb4KNZIoMHSRcVk9+N fosVQzNRAeLusBhxcatPAU6eO91tvlWIFh/BjwtrJmNhs128hIeELOfYJnYK0LQ3 bJDiS2ApHbvU+XqOTkeXNJFc+jR1Y/4zE6re86j2s4HMCYajcIo5XwQDFJ6Mq1E/ 2JdPqgwNKKGPGJUxuz2ZzVb6j7WHTZQBGQ1mkzvimAv5yfxjE91hDEYJ+K7rZMQy GbZhFjEcZphiloBkTE0IEND9OAlCnY1f3SSos90mtS7cYxMU4nY= =Y1V1 -----END PGP SIGNATURE-----