Bug#1145180: trixie-pu: package libsdl3-image/3.2.4+ds-1+deb13u1

[Simon McVittie]

Package: release.debian.org
Severity: normal
Tags: trixie
X-Debbugs-Cc: libsdl3-image at packages.debian.org
Control: affects -1 + src:libsdl3-image
User: release.debian.org at packages.debian.org
Usertags: pu

[ Reason ]
Fix CVE-2026-35444 and various other out-of-bounds accesses when parsing 
malformed/crafted image files

[ Impact ]
If not fixed, games/applications that load untrusted images using 
SDL3_image could be subject to denial-of-service (crash) or possibly 
exploitable.

[ Tests ]
autopkgtest (automated smoke-tests loading images in various formats) 
passes, and the showimage sample program from libsdl3-image-tests can 
load various images on a trixie GNOME desktop. I didn't attempt to 
obtain malformed/crafted images designed to exploit the robustness 
issues.

[ Risks ]
Low risk, hardly anything in trixie uses libsdl3-image: I believe it's 
only freerdp-sdl, a developer-oriented RDP client with low popcon, which 
uses it to load images into dialogs.

[ Checklist ]
  [x] *all* changes are documented in the d/changelog
  [x] I reviewed all changes and I approve them
  [x] attach debdiff against the package in (old)stable
  [x] the issue is verified as fixed in unstable

[ Changes ]
All changes are robustness fixes from upstream. Most are fixed in 3.4.2 
or 3.4.4 upstream. One is not in an upstream release yet, I backported 
it into forky already.

[ Other info ]
Related to https://bugs.debian.org/1134510 for libsdl2-image, an older 
branch of the same codebase.