-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Format: 1.8 Date: Sun, 23 Aug 2026 14:44:26 +0100 Source: libsdl3-image Binary: libsdl3-image-dev libsdl3-image-tests libsdl3-image-tests-dbgsym libsdl3-image0 libsdl3-image0-dbgsym Architecture: amd64 Version: 3.2.4+ds-1+deb13u1 Distribution: trixie Urgency: medium Maintainer: all / amd64 / i386 Build Daemon (x86-grnet-03) Changed-By: Simon McVittie Description: libsdl3-image-dev - Image loading library for Simple DirectMedia Layer 3, development libsdl3-image-tests - Image loading library for Simple DirectMedia Layer 3 - tests libsdl3-image0 - Image loading library for Simple DirectMedia Layer 3, libraries Changes: libsdl3-image (3.2.4+ds-1+deb13u1) trixie; urgency=medium . * d/control, d/gbp.conf: Branch for trixie * d/patches: Add a malformed-image parser robustness fix from 3.4.2: - d/p/Fixed-out-of-bounds-read-in-XCF-image-loader-thanks-Sebas.patch: Avoid an out-of-bounds read when loading invalid XCF images (CVE-2026-35444, same issue as #1133010 in libsdl2-image) * d/patches: Add selected upstream malformed-image parser robustness fixes from 3.4.4: - d/p/xpm-Remove-QUICK_COLORHASH-replace-it-with-inline-code-th.patch: Check XPM colour hash entries before use - d/p/Fix-heap-buffer-overflow-WRITE-in-LBM-palette-CWE-122.patch Avoid an out-of-bounds write when parsing LBM images - d/p/Fix-heap-underflow-WRITE-in-XCF-read_string-CWE-787.patch Avoid an out-of-bounds write if XCF files contain a zero-length string - d/p/Fix-heap-buffer-overflow-READ-in-XCF-do_layer_surface-CWE.patch, d/p/xcf-Added-an-SDL_SetError-when-rejecting-out-of-bounds-ti.patch: Avoid an out-of-bounds read when parsing XCF file tile data, and report the resulting error correctly - d/p/Fix-heap-buffer-overflow-READ-in-XCF-RLE-decoder-CWE-122.patch: Avoid an out-of-bounds read when parsing XCF files with RLE encoding - d/p/xcf-fix-null-pointer-dereference-when-read_xcf_hierarchy-.patch: Check XCF hierarchy read failures before dereferencing - d/p/tga-reject-images-with-zero-width-or-height.patch: Reject zero-sized TGA images as invalid - d/p/Fixed-out-of-bound-read-in-GIF-decoder.patch: Avoid out-of-bounds reads in the GIF decoder * d/patches: Add an additional parser robustness fix from upstream git: - d/p/IMG_xcf.c-read_string-add-back-the-positive-string-size-c.patch Harden XCF parsing against extremely long strings * Thanks to Aquila Macedo Costa Checksums-Sha1: fc43cc4e23df512ef6e76637ffcafcf959ce7ff2 18732 libsdl3-image-dev_3.2.4+ds-1+deb13u1_amd64.deb 4c5751f0df760a701b76a3d23226f43771be8a90 37736 libsdl3-image-tests-dbgsym_3.2.4+ds-1+deb13u1_amd64.deb 279cc303409206cb69bd1faa6d96efacfbe5e086 68960 libsdl3-image-tests_3.2.4+ds-1+deb13u1_amd64.deb f21b4c960a15eaa5e7a0663804738006fc721814 187364 libsdl3-image0-dbgsym_3.2.4+ds-1+deb13u1_amd64.deb b622ab4d2d987ee32af2b9a74e8f9a5178147e72 65276 libsdl3-image0_3.2.4+ds-1+deb13u1_amd64.deb 0a9b8ac845b4639f41127da4e5099db973437db0 14271 libsdl3-image_3.2.4+ds-1+deb13u1_amd64-buildd.buildinfo Checksums-Sha256: 1f2ba865a70b74ef06223888c1461a427448b74bd9f9feb17cf1bd776677883c 18732 libsdl3-image-dev_3.2.4+ds-1+deb13u1_amd64.deb ac539002e0f21811887fd4ed4144b907d87653e83a5e9fa2d0396ddd0626ad8f 37736 libsdl3-image-tests-dbgsym_3.2.4+ds-1+deb13u1_amd64.deb 4608f4e823dcfdae0d1002ba603b48271d84bae79fa06417c5613a419b7e8e18 68960 libsdl3-image-tests_3.2.4+ds-1+deb13u1_amd64.deb dfa57b85568e1835422b87653dc38c136dafd1ce09341223258b83a93337b257 187364 libsdl3-image0-dbgsym_3.2.4+ds-1+deb13u1_amd64.deb 4666f697d0ef681e43d98a0b7198b1eb24d1b11df5fdc086f1aba1f0aa1689c6 65276 libsdl3-image0_3.2.4+ds-1+deb13u1_amd64.deb 6aebbf82c6ebbd94b37a5a931697b0a96b00165f0882bcfbf39c5c870d7b7a22 14271 libsdl3-image_3.2.4+ds-1+deb13u1_amd64-buildd.buildinfo Files: cda1c532c632e9138afd28fe6b9a874c 18732 libdevel optional libsdl3-image-dev_3.2.4+ds-1+deb13u1_amd64.deb e5b05b2e7541a1ada17bddb24148c989 37736 debug optional libsdl3-image-tests-dbgsym_3.2.4+ds-1+deb13u1_amd64.deb b51f5aeb1a657da676c83e114257e5a8 68960 misc optional libsdl3-image-tests_3.2.4+ds-1+deb13u1_amd64.deb dca979ea34120e1cccad928f72fc50ff 187364 debug optional libsdl3-image0-dbgsym_3.2.4+ds-1+deb13u1_amd64.deb d443edf6a42b212b30e4407cabc67591 65276 libs optional libsdl3-image0_3.2.4+ds-1+deb13u1_amd64.deb b71c1d9b16bb96b3d1f2b473190821e3 14271 libs optional libsdl3-image_3.2.4+ds-1+deb13u1_amd64-buildd.buildinfo -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEE5ZI1lXv5WjhHIVjsN8Ugyu9dQiQFAmqamw8ACgkQN8Ugyu9d QiQCFA/+Oz117o06A14ezyKrQVHmKsudIMQQGe8WEPpk6ooXCbGyUcUs3lEpMjV6 H5CfWrPz/uslnVfe+TmXymqhJwuH2de2j+0xpL/5ZYkhkkEfXuZ6Q9kQ6mYWF1vO 5UOPOn//89Cm1P6k8kBbrM4ydCjs2aKFpfeB5l19lcYSBMp8uatGiq0z38E2YIOF 4Ayzdhk//fDqN7jVA1zyYUfUGOHEOkq+0svI+28+9np4nrWl1i/0cZHrIAbJU8UM SPiNhCzqrRa2RpdrfEzpo6LSKIBIFvyA/DAmnOw31Pv/NHMO7zNiW48Q0/OQTHar vHCD9fcZaPMyYL6yLKUiqUn1IYDWYzpB2cNqzxit6C39p6KOqw2O3kcJ7z/LDoeR Grl7Df/VcC13meW1AaczOxPmXCOmBB8fGuIrgiht2EvZZnSusehA22IOzKlugeI+ rDCVvmhPHc780E1611Kpq/Ia2A22G7IYy/ZhOPTnt5zBS2oyl/BRLuGvBq8Y+WUL gtkrxY1MTEovz12vtTNL8oqCOMMixuvvxXeFBJhv70xRP7o+xrHZ3RKkSG802L+k ndg+ZRFp97tZ9WZ9cC9uOAB9T3fH3ZBfr6DNOzF2gKDVuB9yemafDUXvATRhdiXO lo5bm3gliUQWn0jj4enjktwTYAl88lqMss9S6iYNrelRRQ4uzPY= =kVJe -----END PGP SIGNATURE-----