-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Format: 1.8 Date: Sun, 23 Aug 2026 14:44:26 +0100 Source: libsdl3-image Binary: libsdl3-image-dev libsdl3-image-tests libsdl3-image-tests-dbgsym libsdl3-image0 libsdl3-image0-dbgsym Architecture: s390x Version: 3.2.4+ds-1+deb13u1 Distribution: trixie Urgency: medium Maintainer: s390x Build Daemon (ziehrer) Changed-By: Simon McVittie Description: libsdl3-image-dev - Image loading library for Simple DirectMedia Layer 3, development libsdl3-image-tests - Image loading library for Simple DirectMedia Layer 3 - tests libsdl3-image0 - Image loading library for Simple DirectMedia Layer 3, libraries Changes: libsdl3-image (3.2.4+ds-1+deb13u1) trixie; urgency=medium . * d/control, d/gbp.conf: Branch for trixie * d/patches: Add a malformed-image parser robustness fix from 3.4.2: - d/p/Fixed-out-of-bounds-read-in-XCF-image-loader-thanks-Sebas.patch: Avoid an out-of-bounds read when loading invalid XCF images (CVE-2026-35444, same issue as #1133010 in libsdl2-image) * d/patches: Add selected upstream malformed-image parser robustness fixes from 3.4.4: - d/p/xpm-Remove-QUICK_COLORHASH-replace-it-with-inline-code-th.patch: Check XPM colour hash entries before use - d/p/Fix-heap-buffer-overflow-WRITE-in-LBM-palette-CWE-122.patch Avoid an out-of-bounds write when parsing LBM images - d/p/Fix-heap-underflow-WRITE-in-XCF-read_string-CWE-787.patch Avoid an out-of-bounds write if XCF files contain a zero-length string - d/p/Fix-heap-buffer-overflow-READ-in-XCF-do_layer_surface-CWE.patch, d/p/xcf-Added-an-SDL_SetError-when-rejecting-out-of-bounds-ti.patch: Avoid an out-of-bounds read when parsing XCF file tile data, and report the resulting error correctly - d/p/Fix-heap-buffer-overflow-READ-in-XCF-RLE-decoder-CWE-122.patch: Avoid an out-of-bounds read when parsing XCF files with RLE encoding - d/p/xcf-fix-null-pointer-dereference-when-read_xcf_hierarchy-.patch: Check XCF hierarchy read failures before dereferencing - d/p/tga-reject-images-with-zero-width-or-height.patch: Reject zero-sized TGA images as invalid - d/p/Fixed-out-of-bound-read-in-GIF-decoder.patch: Avoid out-of-bounds reads in the GIF decoder * d/patches: Add an additional parser robustness fix from upstream git: - d/p/IMG_xcf.c-read_string-add-back-the-positive-string-size-c.patch Harden XCF parsing against extremely long strings * Thanks to Aquila Macedo Costa Checksums-Sha1: 2f41959196cd37d3c387429115b0c4edbc6f0066 18732 libsdl3-image-dev_3.2.4+ds-1+deb13u1_s390x.deb 4657dda6fc179dd5d064cada5d67d19328e2a360 37088 libsdl3-image-tests-dbgsym_3.2.4+ds-1+deb13u1_s390x.deb 6a3556b0a24f3fbcad4b56b5baca3554754be62b 66776 libsdl3-image-tests_3.2.4+ds-1+deb13u1_s390x.deb 80db1a7f453ba696af87d98913d564bdfd2d595b 186944 libsdl3-image0-dbgsym_3.2.4+ds-1+deb13u1_s390x.deb c333d193d90617ac8a9942dd6c618ae173823f59 65616 libsdl3-image0_3.2.4+ds-1+deb13u1_s390x.deb b5a52c47e01f1a4d5ad6d6a178335b211c15e7ae 14048 libsdl3-image_3.2.4+ds-1+deb13u1_s390x-buildd.buildinfo Checksums-Sha256: c0b203ce6bf075a67ee4f3cfd1e956d1893c9b24c8d07f740c92e18063fdc218 18732 libsdl3-image-dev_3.2.4+ds-1+deb13u1_s390x.deb c5a929e2b7fad9b2af7100e4dc8bd35b76c0a8c01c909eea34e91cc33e6f6f90 37088 libsdl3-image-tests-dbgsym_3.2.4+ds-1+deb13u1_s390x.deb 78078fca6e0d2f2ba23811c6c8df229dadf0427b08016e4be1eced3412c5e1e8 66776 libsdl3-image-tests_3.2.4+ds-1+deb13u1_s390x.deb 881a13dcd1fba92b2b244afcfb130d8f823081c581bba2844f5a9fdba4bf1989 186944 libsdl3-image0-dbgsym_3.2.4+ds-1+deb13u1_s390x.deb 38095299ed6025e1f8e14d96f7a224abb7f6e988f2b86e9f41d2c598b02a5430 65616 libsdl3-image0_3.2.4+ds-1+deb13u1_s390x.deb 7dfa5f8d297c1828eec4269678293c9bbefcf7fd287fb69ec15ac16a3c52515c 14048 libsdl3-image_3.2.4+ds-1+deb13u1_s390x-buildd.buildinfo Files: 6c9f4019f016a2f882fa194722cbe324 18732 libdevel optional libsdl3-image-dev_3.2.4+ds-1+deb13u1_s390x.deb baaa0fdb5eced539d60dd3611cb5525e 37088 debug optional libsdl3-image-tests-dbgsym_3.2.4+ds-1+deb13u1_s390x.deb ee09ae2badf85adb2e004b89120f85ff 66776 misc optional libsdl3-image-tests_3.2.4+ds-1+deb13u1_s390x.deb 35564b7acb0754ee8fb479f1d10a9bcd 186944 debug optional libsdl3-image0-dbgsym_3.2.4+ds-1+deb13u1_s390x.deb c9bb2fee7a15ccaa8489b056f1068fa1 65616 libs optional libsdl3-image0_3.2.4+ds-1+deb13u1_s390x.deb 02597743f72217b128757fe10826a4ab 14048 libs optional libsdl3-image_3.2.4+ds-1+deb13u1_s390x-buildd.buildinfo -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEl0BM/nR+Oj597wRWMWUFebkHnoQFAmqanNQACgkQMWUFebkH noQguQ//cwZVpn0B2U9qIf6Xpd7+pXfoEuLWwhf8n43V20Ko/7SLSxRb8RNRsn+5 DNSUO41Ba85+pAwv/3c7Hmah9iZioGmT/lsOSwte1I3vMscfk04HL7n63W65ydG4 EW7UpgdkQ5spYiddp7Hhaf/ugsNVSzqbbuVKJ/Al/0T9agMjJsPxnzEL6zhwePX6 qUaVFhrVbhbrKjNZ8ERH/V38Ef5HVii6zPmqDvi2xN+fqNi5TQA3tK+BBWHfeWRZ KP5GeY3s5T1iBGH4lViiA25LaEydxFr7VHbeRhb0zuWFx8nXyG7523lxQ8jpYAtm SK/L63XNZvLOZxX411OfT6ZtAm+4Bac2GwHoHtf73yI2NLZPUjCOhAtM8/nYBeuT 3avx1uNUbtFEi2eFXg+HCS+Z8Yj/sMCJlUB2Dpm/9+gudykeh/Zn28z2fidRYUpC U7QW3/PsZv99q8HYWAKKfs8rA6RZ1CgAc/KkKXECVXA8G51nyB8q0sj4Sx3l/V7w AplUogpOQG7NygVJ1iPaedv3Bt0+rFr7gX3fuAEJXBEh+KEzpqP3vWuUymadyy5r /oiiwq8SWVxSBoEc9zXEyMEjA4Sftyk5cyyjXSDFdCYKMrK7dhIZAqpzWIb81Vpe M10EZ85NshlUYJGvcIl228RTEaVETDx4JkqccwUA79EwZ9Lhpio= =/uqj -----END PGP SIGNATURE-----