-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Format: 1.8 Date: Sun, 23 Aug 2026 14:44:26 +0100 Source: libsdl3-image Binary: libsdl3-image-dev libsdl3-image-tests libsdl3-image-tests-dbgsym libsdl3-image0 libsdl3-image0-dbgsym Architecture: riscv64 Version: 3.2.4+ds-1+deb13u1 Distribution: trixie Urgency: medium Maintainer: riscv64 Build Daemon (rv-manda-04) Changed-By: Simon McVittie Description: libsdl3-image-dev - Image loading library for Simple DirectMedia Layer 3, development libsdl3-image-tests - Image loading library for Simple DirectMedia Layer 3 - tests libsdl3-image0 - Image loading library for Simple DirectMedia Layer 3, libraries Changes: libsdl3-image (3.2.4+ds-1+deb13u1) trixie; urgency=medium . * d/control, d/gbp.conf: Branch for trixie * d/patches: Add a malformed-image parser robustness fix from 3.4.2: - d/p/Fixed-out-of-bounds-read-in-XCF-image-loader-thanks-Sebas.patch: Avoid an out-of-bounds read when loading invalid XCF images (CVE-2026-35444, same issue as #1133010 in libsdl2-image) * d/patches: Add selected upstream malformed-image parser robustness fixes from 3.4.4: - d/p/xpm-Remove-QUICK_COLORHASH-replace-it-with-inline-code-th.patch: Check XPM colour hash entries before use - d/p/Fix-heap-buffer-overflow-WRITE-in-LBM-palette-CWE-122.patch Avoid an out-of-bounds write when parsing LBM images - d/p/Fix-heap-underflow-WRITE-in-XCF-read_string-CWE-787.patch Avoid an out-of-bounds write if XCF files contain a zero-length string - d/p/Fix-heap-buffer-overflow-READ-in-XCF-do_layer_surface-CWE.patch, d/p/xcf-Added-an-SDL_SetError-when-rejecting-out-of-bounds-ti.patch: Avoid an out-of-bounds read when parsing XCF file tile data, and report the resulting error correctly - d/p/Fix-heap-buffer-overflow-READ-in-XCF-RLE-decoder-CWE-122.patch: Avoid an out-of-bounds read when parsing XCF files with RLE encoding - d/p/xcf-fix-null-pointer-dereference-when-read_xcf_hierarchy-.patch: Check XCF hierarchy read failures before dereferencing - d/p/tga-reject-images-with-zero-width-or-height.patch: Reject zero-sized TGA images as invalid - d/p/Fixed-out-of-bound-read-in-GIF-decoder.patch: Avoid out-of-bounds reads in the GIF decoder * d/patches: Add an additional parser robustness fix from upstream git: - d/p/IMG_xcf.c-read_string-add-back-the-positive-string-size-c.patch Harden XCF parsing against extremely long strings * Thanks to Aquila Macedo Costa Checksums-Sha1: 9bf9fd0a012d10f2229845805cae1ebaa4529840 18732 libsdl3-image-dev_3.2.4+ds-1+deb13u1_riscv64.deb 74eba7b1bd2133c3358dbb1c4f278fd39902975d 37940 libsdl3-image-tests-dbgsym_3.2.4+ds-1+deb13u1_riscv64.deb 2ea740b3f77a80a873b01ea2000b444a18fc75aa 68488 libsdl3-image-tests_3.2.4+ds-1+deb13u1_riscv64.deb 00ccb5fbfe00ed142c40f6c68aab13c45b7333e3 173976 libsdl3-image0-dbgsym_3.2.4+ds-1+deb13u1_riscv64.deb 45cc43aace62803bdb8537b572865fbadc6a7b61 67276 libsdl3-image0_3.2.4+ds-1+deb13u1_riscv64.deb 45a97c4342536c627604cdd34cad76e11954a753 14233 libsdl3-image_3.2.4+ds-1+deb13u1_riscv64-buildd.buildinfo Checksums-Sha256: 1559fbfc3b7d7886f08e5d3a25acf403788ab7bf29bd8de3f282ae3f897f639d 18732 libsdl3-image-dev_3.2.4+ds-1+deb13u1_riscv64.deb 03db67265e051790d63b832a4f5aeec3d981b6b9f962dc10dffac14c565f488e 37940 libsdl3-image-tests-dbgsym_3.2.4+ds-1+deb13u1_riscv64.deb 1b279eb2090abf7f0ee4231a4d1f880f9a2716485b12700f33504452a6e73e7c 68488 libsdl3-image-tests_3.2.4+ds-1+deb13u1_riscv64.deb 9fb5f5d079817c4d8b38d0076b5217b57f3c015eb7bc089f70ff8810f9d3b289 173976 libsdl3-image0-dbgsym_3.2.4+ds-1+deb13u1_riscv64.deb c5343d12b82d3a2348400ba21cca91af435d68b30d15c019fc7abb2aedfda355 67276 libsdl3-image0_3.2.4+ds-1+deb13u1_riscv64.deb 87d99961e35f99e4fa368443818178ecf33e43435c2921d59cdbd757ad0753ad 14233 libsdl3-image_3.2.4+ds-1+deb13u1_riscv64-buildd.buildinfo Files: 33bee70536a0292a419483b9f2ed1407 18732 libdevel optional libsdl3-image-dev_3.2.4+ds-1+deb13u1_riscv64.deb e4d3f3982dfaa5da0de69b8d01d55142 37940 debug optional libsdl3-image-tests-dbgsym_3.2.4+ds-1+deb13u1_riscv64.deb 062bfa0f68f6c455ba6d7c58339efcc7 68488 misc optional libsdl3-image-tests_3.2.4+ds-1+deb13u1_riscv64.deb 75bcfe99c9d7f4b0d149869f63f3c327 173976 debug optional libsdl3-image0-dbgsym_3.2.4+ds-1+deb13u1_riscv64.deb 24a9c02df14bc037c1ea8f5a71cabb81 67276 libs optional libsdl3-image0_3.2.4+ds-1+deb13u1_riscv64.deb 3007b28768a42145026ea55561f4d54f 14233 libs optional libsdl3-image_3.2.4+ds-1+deb13u1_riscv64-buildd.buildinfo -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEpWtAFYomK/29mcYCqTndZcwOQoMFAmqatVUACgkQqTndZcwO QoPXAg//amrfsCVx5dEm5a53RLlgVaa1avjXNFD1ovTvWjrEIV1y90eyJNFSSSQ+ W9k1hnuF0BmEX+xMNdWM8XJMai2jUdUKxmWyxmTkFbb1+0C5mEhnd/IH/8fg1usX c2bIgWaTqtu/8m7RPoXncMxrUMG9HoVCbDIqwe6Cw1acokyvROTJXV2SFpK+dHCD OffP4wELt1RxNaF4OgJ1Iu0rmRJvbIk7a7K6f51E4iDahIq0kmZ9GkAROlyPu3KG 9uRz6thN8KpJPKuY0H9VeNjSKdf2iQhbPdHged/2Q+0ACW1ORjT7Qpv3k2X3hC2l o8rezhFzjW0cZ4v9y2Yb5uizYqFZtKFRWROLc2feMN3JfcZ7csPV36R9+Z2VGRQn IL3HrliHedNTiBNLKGHijwG88GEqbBQRgm6I8ak9MFp86oCrZEtjuAkqg5ZlfSMR X2tKTsjfyy41jtblTl8qQTeNu7u3JeLYS2CyrhlGB78pPAI7BjfJAPukKdsfKKHW dmYSGVJAOPHlPFQaxAKKCJmv3Cb8Tlx1y8bXWvO+fFGQlVAIsDOTwMkowXi/P3xE a4yS5qOpPmggeTgSwj5seR2W8Y1UROPnce8Qk/hKL5Gp0+sa5utiv6cECRt/Vy4P xHkLE6Q8ZMlj6u2E0PQNNsoLlH/rimb47GdQi8mhnfxYRXF5e9I= =W2VO -----END PGP SIGNATURE-----