-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Format: 1.8 Date: Sun, 23 Aug 2026 14:44:26 +0100 Source: libsdl3-image Binary: libsdl3-image-dev libsdl3-image-tests libsdl3-image-tests-dbgsym libsdl3-image0 libsdl3-image0-dbgsym Architecture: i386 Version: 3.2.4+ds-1+deb13u1 Distribution: trixie Urgency: medium Maintainer: all / amd64 / i386 Build Daemon (x86-grnet-03) Changed-By: Simon McVittie Description: libsdl3-image-dev - Image loading library for Simple DirectMedia Layer 3, development libsdl3-image-tests - Image loading library for Simple DirectMedia Layer 3 - tests libsdl3-image0 - Image loading library for Simple DirectMedia Layer 3, libraries Changes: libsdl3-image (3.2.4+ds-1+deb13u1) trixie; urgency=medium . * d/control, d/gbp.conf: Branch for trixie * d/patches: Add a malformed-image parser robustness fix from 3.4.2: - d/p/Fixed-out-of-bounds-read-in-XCF-image-loader-thanks-Sebas.patch: Avoid an out-of-bounds read when loading invalid XCF images (CVE-2026-35444, same issue as #1133010 in libsdl2-image) * d/patches: Add selected upstream malformed-image parser robustness fixes from 3.4.4: - d/p/xpm-Remove-QUICK_COLORHASH-replace-it-with-inline-code-th.patch: Check XPM colour hash entries before use - d/p/Fix-heap-buffer-overflow-WRITE-in-LBM-palette-CWE-122.patch Avoid an out-of-bounds write when parsing LBM images - d/p/Fix-heap-underflow-WRITE-in-XCF-read_string-CWE-787.patch Avoid an out-of-bounds write if XCF files contain a zero-length string - d/p/Fix-heap-buffer-overflow-READ-in-XCF-do_layer_surface-CWE.patch, d/p/xcf-Added-an-SDL_SetError-when-rejecting-out-of-bounds-ti.patch: Avoid an out-of-bounds read when parsing XCF file tile data, and report the resulting error correctly - d/p/Fix-heap-buffer-overflow-READ-in-XCF-RLE-decoder-CWE-122.patch: Avoid an out-of-bounds read when parsing XCF files with RLE encoding - d/p/xcf-fix-null-pointer-dereference-when-read_xcf_hierarchy-.patch: Check XCF hierarchy read failures before dereferencing - d/p/tga-reject-images-with-zero-width-or-height.patch: Reject zero-sized TGA images as invalid - d/p/Fixed-out-of-bound-read-in-GIF-decoder.patch: Avoid out-of-bounds reads in the GIF decoder * d/patches: Add an additional parser robustness fix from upstream git: - d/p/IMG_xcf.c-read_string-add-back-the-positive-string-size-c.patch Harden XCF parsing against extremely long strings * Thanks to Aquila Macedo Costa Checksums-Sha1: 3f7dd93827bdb02737df6ce849dc41ca7a639208 18728 libsdl3-image-dev_3.2.4+ds-1+deb13u1_i386.deb 3e2350c7ad809ce2ef57a495f2668ebf12d21987 36392 libsdl3-image-tests-dbgsym_3.2.4+ds-1+deb13u1_i386.deb 2e6db262c8b511df877c8fb7174a3e04c30e7b19 71856 libsdl3-image-tests_3.2.4+ds-1+deb13u1_i386.deb cd63a51c55ede5e76bd1b165f478129f128fdfe6 177912 libsdl3-image0-dbgsym_3.2.4+ds-1+deb13u1_i386.deb f82f1372e2addabc3186c9cf6acf54fd21ec3454 69820 libsdl3-image0_3.2.4+ds-1+deb13u1_i386.deb c90b8961684e1fe1c7dbe228d4b93341ce9df231 14163 libsdl3-image_3.2.4+ds-1+deb13u1_i386-buildd.buildinfo Checksums-Sha256: f5566c3de2072e4f78dcc65c13e0692c51f0c07b02a564f0ee059fb3a652dde6 18728 libsdl3-image-dev_3.2.4+ds-1+deb13u1_i386.deb ac614013f83851eec543441da52f6681c10cfc5635301e852e3b15bd2bb55033 36392 libsdl3-image-tests-dbgsym_3.2.4+ds-1+deb13u1_i386.deb 80889749f93951715528d2097085521e26c951c56c472580da6f62292e90b9fd 71856 libsdl3-image-tests_3.2.4+ds-1+deb13u1_i386.deb 200c929054213fd09673904e634de138123272438bffd9e7b7d7e5b13f860a53 177912 libsdl3-image0-dbgsym_3.2.4+ds-1+deb13u1_i386.deb 212c2168fa76c404302b711f6dfa03891f1570da4dade94f57065831128ddfbb 69820 libsdl3-image0_3.2.4+ds-1+deb13u1_i386.deb 851019ed74469a4e1432586df3f92903fb808576af755378ca93c17e04bf0599 14163 libsdl3-image_3.2.4+ds-1+deb13u1_i386-buildd.buildinfo Files: 75776298c415aa73eabe075838394f41 18728 libdevel optional libsdl3-image-dev_3.2.4+ds-1+deb13u1_i386.deb 56821f90a131e86de730de80e6b7ccaf 36392 debug optional libsdl3-image-tests-dbgsym_3.2.4+ds-1+deb13u1_i386.deb 2066bcae7b43bd3195772a74768d81f2 71856 misc optional libsdl3-image-tests_3.2.4+ds-1+deb13u1_i386.deb a2bd8c1a40dc129f82a9735cacf23ce8 177912 debug optional libsdl3-image0-dbgsym_3.2.4+ds-1+deb13u1_i386.deb e82437a3eda0b795e9aaabb93e601513 69820 libs optional libsdl3-image0_3.2.4+ds-1+deb13u1_i386.deb 4d11191ddba3af1043daaf59ae7eeb7b 14163 libs optional libsdl3-image_3.2.4+ds-1+deb13u1_i386-buildd.buildinfo -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEE5ZI1lXv5WjhHIVjsN8Ugyu9dQiQFAmqam5oACgkQN8Ugyu9d QiSHFBAAp7afjB4vaprUeD0VcKCKIEDBauDpjFMOKMT303gz8BMTlR6eIvmF37Om eVC1OYVE2nzK0cYngatDOqt+wQA++5SyPQP0kDcMTHpFMYLqRyBeBu++rd1DqZi4 uVf8yrKoCK427KuRKAAggwl137V0s5SJYKYGFLrr1XUM3LVauv86gKH6Y1Vhrjra V/zjt/DLHCPNFtWgM3sYYp+5g8NxawxyD13THmjI8egfKNNX+T5398CSaOSR3BHM ZbtC+zqys/OJhk2azCFhHZyQv7J/9fy2zAA3uCCYUZzFu6jX7xu2vYtGf4NgVTDf vlNBntNPXE9AVMYUTaXemEq2mSp2aatmUir9HFnDLk9yyVfYlvDbQpZn4a1pJm4+ cT8tQYbkP1XUxYC4u1q5HRlqbf6+h0NQm40jMWnZXaaoec/5Bw1CT54+7oUVxNRC TmjD1d3noy8Us2+c+brKG7rxdJtM+TNqpd4VnfD2vwkF/LOMtzaks9Q7nwb2liQ7 39Vw2jvMNsRmGIB5qgBFv9gXAlJy+tTUFYJkTPzkwzBOIAuHMRsANY/+u9uXm/PU QGkBtG3VkOS1aeA2BjgFNcSr3O2yj/3UhKl21z2iEZ7uY2BXXkBb8xe52JyWt4qr Bk+ncV4qiMouo7Vf12nDGmT2cqJ18mVmgXZVqxQkjioNyGoMYB0= =etHb -----END PGP SIGNATURE-----