-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Format: 1.8 Date: Sun, 23 Aug 2026 14:44:26 +0100 Source: libsdl3-image Binary: libsdl3-image-dev libsdl3-image-tests libsdl3-image-tests-dbgsym libsdl3-image0 libsdl3-image0-dbgsym Architecture: armhf Version: 3.2.4+ds-1+deb13u1 Distribution: trixie Urgency: medium Maintainer: armhf Build Daemon (arm-ubc-06) Changed-By: Simon McVittie Description: libsdl3-image-dev - Image loading library for Simple DirectMedia Layer 3, development libsdl3-image-tests - Image loading library for Simple DirectMedia Layer 3 - tests libsdl3-image0 - Image loading library for Simple DirectMedia Layer 3, libraries Changes: libsdl3-image (3.2.4+ds-1+deb13u1) trixie; urgency=medium . * d/control, d/gbp.conf: Branch for trixie * d/patches: Add a malformed-image parser robustness fix from 3.4.2: - d/p/Fixed-out-of-bounds-read-in-XCF-image-loader-thanks-Sebas.patch: Avoid an out-of-bounds read when loading invalid XCF images (CVE-2026-35444, same issue as #1133010 in libsdl2-image) * d/patches: Add selected upstream malformed-image parser robustness fixes from 3.4.4: - d/p/xpm-Remove-QUICK_COLORHASH-replace-it-with-inline-code-th.patch: Check XPM colour hash entries before use - d/p/Fix-heap-buffer-overflow-WRITE-in-LBM-palette-CWE-122.patch Avoid an out-of-bounds write when parsing LBM images - d/p/Fix-heap-underflow-WRITE-in-XCF-read_string-CWE-787.patch Avoid an out-of-bounds write if XCF files contain a zero-length string - d/p/Fix-heap-buffer-overflow-READ-in-XCF-do_layer_surface-CWE.patch, d/p/xcf-Added-an-SDL_SetError-when-rejecting-out-of-bounds-ti.patch: Avoid an out-of-bounds read when parsing XCF file tile data, and report the resulting error correctly - d/p/Fix-heap-buffer-overflow-READ-in-XCF-RLE-decoder-CWE-122.patch: Avoid an out-of-bounds read when parsing XCF files with RLE encoding - d/p/xcf-fix-null-pointer-dereference-when-read_xcf_hierarchy-.patch: Check XCF hierarchy read failures before dereferencing - d/p/tga-reject-images-with-zero-width-or-height.patch: Reject zero-sized TGA images as invalid - d/p/Fixed-out-of-bound-read-in-GIF-decoder.patch: Avoid out-of-bounds reads in the GIF decoder * d/patches: Add an additional parser robustness fix from upstream git: - d/p/IMG_xcf.c-read_string-add-back-the-positive-string-size-c.patch Harden XCF parsing against extremely long strings * Thanks to Aquila Macedo Costa Checksums-Sha1: 67d6e109ca0b3886767fe1305fce11d9612b6d74 18740 libsdl3-image-dev_3.2.4+ds-1+deb13u1_armhf.deb e639b748e92a47b7d75b436dd6ef95095d330ace 39128 libsdl3-image-tests-dbgsym_3.2.4+ds-1+deb13u1_armhf.deb c120a267602b128be97a7e8d5b41f78e7e6c0feb 65412 libsdl3-image-tests_3.2.4+ds-1+deb13u1_armhf.deb 02a04082a63811638f8c8e998d39f784f0cb3482 186164 libsdl3-image0-dbgsym_3.2.4+ds-1+deb13u1_armhf.deb e3578567b7f92b15f27e94d46803e5f6e4a72210 57100 libsdl3-image0_3.2.4+ds-1+deb13u1_armhf.deb 294fc02e58f0a203d3ddb249cd281c023ae70810 14263 libsdl3-image_3.2.4+ds-1+deb13u1_armhf-buildd.buildinfo Checksums-Sha256: 6e0c8afdfbe4984979b08ee487c9d5b59bcef5e1b3c6f4b410597e76c6349218 18740 libsdl3-image-dev_3.2.4+ds-1+deb13u1_armhf.deb 8ddb97d5406a459e9bb8eac45cf632b30feae97736f3efdee97a62c7c285f984 39128 libsdl3-image-tests-dbgsym_3.2.4+ds-1+deb13u1_armhf.deb bb95c985b22b32d28de433a5d39b78f9bfcb4868d0120ddadf1ae96f5b398cec 65412 libsdl3-image-tests_3.2.4+ds-1+deb13u1_armhf.deb b910bc4fe7fafd5d398901b33953a955315f5f883015bda1e0b92a81618d3be5 186164 libsdl3-image0-dbgsym_3.2.4+ds-1+deb13u1_armhf.deb abb6a458b88a8c89a25b763e1a9852e05cf39093c3502a32ce94862efaa24900 57100 libsdl3-image0_3.2.4+ds-1+deb13u1_armhf.deb 5dba260ef06b484f11503ab8342809e541d5281d3402d9c0874d68a98bdb5a42 14263 libsdl3-image_3.2.4+ds-1+deb13u1_armhf-buildd.buildinfo Files: 51720c79a49c2f9eca4c2978fabab0e4 18740 libdevel optional libsdl3-image-dev_3.2.4+ds-1+deb13u1_armhf.deb e45d0d3547e65edc5d6aecf57adf9f38 39128 debug optional libsdl3-image-tests-dbgsym_3.2.4+ds-1+deb13u1_armhf.deb f5c3de6c427f5ad15f1583547f5601a7 65412 misc optional libsdl3-image-tests_3.2.4+ds-1+deb13u1_armhf.deb cfae769981f2111db1b742487579cd0f 186164 debug optional libsdl3-image0-dbgsym_3.2.4+ds-1+deb13u1_armhf.deb 31e36409f65ca5999aacfe787ba5c54e 57100 libs optional libsdl3-image0_3.2.4+ds-1+deb13u1_armhf.deb 0c17deb89ba7762ce3dadeeaed12696c 14263 libs optional libsdl3-image_3.2.4+ds-1+deb13u1_armhf-buildd.buildinfo -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEBOUsBrtd5lcy6oRfutMAkCxKbL0FAmqanWoACgkQutMAkCxK bL2I6g//XVX7RM7c3vXWsewkGwmeRRFmnXURoMjJX2lL1uekYqvFqEED+E1/zi4n NjUmfiE9BOQee4QYMcYAfJEYdYBFbyuI2vO+GlomkFZCEDFDh12yUDN6UOUjlIYI VZb022WmZLIETiTKk8767A5k+j8ucBA+NH899ZDh7yei1W+QwHPvJeX/er5rkzCK E3GoxEonbLXrx+mPTXqq2TctKeBUyYM78Ptb8gs0ZZF9mYyd3/hfXt/nHe/bJjyL qlhedq2l1QtBOKtEULRyZZvLK3EthCdBwBNuJz25hvM6h/T5phy9G0gBatjdIiKm iS2nlJx7eRmpnKGxvCnKp7VJh+fwEvGAJcR62QnPS3eWVSisK4JJn+aSR/mKVpTH mxrssahMh3RNn6g13VC5OOozeM/3A6n+SaLerE1oyc8G2Qvs2l4caObAlLYWY7nW +hVmdUckZzFk0/z3RKgbetoqbB4jb+DWIMgWkGIv05ioa8SiNJ31eWKd/pTZXION PWHWwjpzqDREBj/XGNsxbwc1J34PMiLMYTDfaK/mYpCgL2RkE5DdSp23JuhG/xWI go5vty9tald15kjAEytmGEO35chutcAUn7uW/BCwpzvTNtEAFGk1DOrFtJ8EHVnE dwhD1iQbvErIKivfX0eVzXgVEUrAwTvvzAVEzBADXCTtkmtOu3U= =/LK3 -----END PGP SIGNATURE-----