-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Format: 1.8 Date: Sun, 23 Aug 2026 14:44:26 +0100 Source: libsdl3-image Binary: libsdl3-image-dev libsdl3-image-tests libsdl3-image-tests-dbgsym libsdl3-image0 libsdl3-image0-dbgsym Architecture: arm64 Version: 3.2.4+ds-1+deb13u1 Distribution: trixie Urgency: medium Maintainer: arm64 Build Daemon (arm-conova-01) Changed-By: Simon McVittie Description: libsdl3-image-dev - Image loading library for Simple DirectMedia Layer 3, development libsdl3-image-tests - Image loading library for Simple DirectMedia Layer 3 - tests libsdl3-image0 - Image loading library for Simple DirectMedia Layer 3, libraries Changes: libsdl3-image (3.2.4+ds-1+deb13u1) trixie; urgency=medium . * d/control, d/gbp.conf: Branch for trixie * d/patches: Add a malformed-image parser robustness fix from 3.4.2: - d/p/Fixed-out-of-bounds-read-in-XCF-image-loader-thanks-Sebas.patch: Avoid an out-of-bounds read when loading invalid XCF images (CVE-2026-35444, same issue as #1133010 in libsdl2-image) * d/patches: Add selected upstream malformed-image parser robustness fixes from 3.4.4: - d/p/xpm-Remove-QUICK_COLORHASH-replace-it-with-inline-code-th.patch: Check XPM colour hash entries before use - d/p/Fix-heap-buffer-overflow-WRITE-in-LBM-palette-CWE-122.patch Avoid an out-of-bounds write when parsing LBM images - d/p/Fix-heap-underflow-WRITE-in-XCF-read_string-CWE-787.patch Avoid an out-of-bounds write if XCF files contain a zero-length string - d/p/Fix-heap-buffer-overflow-READ-in-XCF-do_layer_surface-CWE.patch, d/p/xcf-Added-an-SDL_SetError-when-rejecting-out-of-bounds-ti.patch: Avoid an out-of-bounds read when parsing XCF file tile data, and report the resulting error correctly - d/p/Fix-heap-buffer-overflow-READ-in-XCF-RLE-decoder-CWE-122.patch: Avoid an out-of-bounds read when parsing XCF files with RLE encoding - d/p/xcf-fix-null-pointer-dereference-when-read_xcf_hierarchy-.patch: Check XCF hierarchy read failures before dereferencing - d/p/tga-reject-images-with-zero-width-or-height.patch: Reject zero-sized TGA images as invalid - d/p/Fixed-out-of-bound-read-in-GIF-decoder.patch: Avoid out-of-bounds reads in the GIF decoder * d/patches: Add an additional parser robustness fix from upstream git: - d/p/IMG_xcf.c-read_string-add-back-the-positive-string-size-c.patch Harden XCF parsing against extremely long strings * Thanks to Aquila Macedo Costa Checksums-Sha1: 3105f9c674a25dc174bb4bbfc826a13a3e3022d6 18732 libsdl3-image-dev_3.2.4+ds-1+deb13u1_arm64.deb 54a7278aef8cad7d122c9e1328546e8d921c5bff 38432 libsdl3-image-tests-dbgsym_3.2.4+ds-1+deb13u1_arm64.deb 631d78a149d77e477433c27678a55defc8e9da6f 67916 libsdl3-image-tests_3.2.4+ds-1+deb13u1_arm64.deb 939bde48c6c8e75e2ebe08a24a26e1126c5f332f 180452 libsdl3-image0-dbgsym_3.2.4+ds-1+deb13u1_arm64.deb 6c2aab9047fd6ac004c26c6fa0bca1ae8d707da2 60800 libsdl3-image0_3.2.4+ds-1+deb13u1_arm64.deb cde9612a292002052ab5b99c4325ec3843cd5bc5 14324 libsdl3-image_3.2.4+ds-1+deb13u1_arm64-buildd.buildinfo Checksums-Sha256: 14ee38f93f3b1fdf821cc442595c00f13a8b1fb79bd2de4c1db1ebfa2eeefe62 18732 libsdl3-image-dev_3.2.4+ds-1+deb13u1_arm64.deb 5c2914721055120b0bed1632874f9e5d7b83d825a4efd7c1f61004087a551be4 38432 libsdl3-image-tests-dbgsym_3.2.4+ds-1+deb13u1_arm64.deb 5a1c9c759fcb7fc98d2004d854f055b96bd20d6b0c6403ea87da115ad9ecdf8f 67916 libsdl3-image-tests_3.2.4+ds-1+deb13u1_arm64.deb 4062d7e2714fb786b5e1babf7f86092f5e766f6793e7443b6fea17bf4f84425d 180452 libsdl3-image0-dbgsym_3.2.4+ds-1+deb13u1_arm64.deb 76f5318e60e3fd9077678cf36cbed149fa55e6915d16c3a8dcf0abc83f1973ec 60800 libsdl3-image0_3.2.4+ds-1+deb13u1_arm64.deb 3c72fbcaaf24cdbd8eeb67fb59a68ab091931ad0a47393a6636dbc870e0a9694 14324 libsdl3-image_3.2.4+ds-1+deb13u1_arm64-buildd.buildinfo Files: 443f12206fc549e51c360cb0e6aaa9bd 18732 libdevel optional libsdl3-image-dev_3.2.4+ds-1+deb13u1_arm64.deb 3cffd95dcd23048059ed5e6a21c19a14 38432 debug optional libsdl3-image-tests-dbgsym_3.2.4+ds-1+deb13u1_arm64.deb 27024ce5fcbd6fcd280dd55c8e764cc5 67916 misc optional libsdl3-image-tests_3.2.4+ds-1+deb13u1_arm64.deb c480517aba5a8050d0f5c486542fc9a1 180452 debug optional libsdl3-image0-dbgsym_3.2.4+ds-1+deb13u1_arm64.deb 8f33a5866045e7a14e63c7f407494501 60800 libs optional libsdl3-image0_3.2.4+ds-1+deb13u1_arm64.deb 0cd32bdfebdb19ebfe14075bb4e6af01 14324 libs optional libsdl3-image_3.2.4+ds-1+deb13u1_arm64-buildd.buildinfo -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEO4qAQUSIo2p/kVRf8U6eOZMpj68FAmqanWsACgkQ8U6eOZMp j68RQRAAv4xyed201lxxOMFVyCEjXDghIWTl4Cu+39kofQuoLrc/pxUBJt0asfni k824Wt+GVaolRiPllZ+f81SoL5SKrwaH021t0VFVj9K6o3XmjagRdFhj4dw/O94i d2KLpG/2+BiOpq+fiBxoeWkfm2CuSPYmms2UMwr1yRKJyNF2K/JiwYRauQipnHbV Cm5t05giO/SYCJeMAT5lJPbURD/xPTlUZB2Ml/ugUGx0yzJ17Jo80b73KpsGy6bn Dyj4aAoOZ/P+jrBPC+qgJ0o13ox2Zq/gnYsslXki+2TjIQ9MfosVuJZ2E8rOYImj IiJPRCGbwPRuGdFqI6jYrnmQBo3FYSV6yrjAGDUhEN0npC43q/fP9B91cU27edbK m+VmgzP+FRCwJQDD2d4GXnJVWu1zr4kXUAyeQqqyn8O2bEgiYLPE/Imfu5RYTis4 YPIRv6LmqPsa+cuFhq0TRH6pgyyuuCt9GqykQYaqdqU33Z/7VXoMUzaGkZh4qO8g 3GuK2v34/3uRHGkP280GRa5RCKNtmvzr54Czd/Ylop3jeFvOzRFJrrm9jCAaGl+a h7nfABdKBNTSzdECZfOmRsfb7EDDnMxh5sj7jwmLTZ0YCemPzNzCCojMY/SXcTs/ XFEt/vyX4d0wi703z9q9LKO2x+Az815dZ2qKAtSJF7D0ry0wOdQ= =x1eb -----END PGP SIGNATURE-----