[ Reason ]
This upload updates libsdl2-image in trixie with upstream fixes for
CVE-2026-35444 and closely related parser hardening fixes in the same
area of code.

The Debian security tracker currently marks this issue as a minor issue
for trixie/bookworm with no DSA, so I am requesting inclusion via
stable-proposed-updates instead of via stable-security.

[ Impact ]
Without this update, trixie continues to ship the vulnerable XCF parser
code addressed by CVE-2026-35444, as well as two adjacent upstream XCF
bounds check fixes from the same hardening batch. This can result in out
of bounds reads when parsing crafted image files.

[ Tests ]
I validated the update in Salsa CI, including the package build, the
configured test jobs, and the reverse build dependencies builds:
https://salsa.debian.org/aquila/libsdl2-image/-/pipelines/1070508

[ Risks ]
The changes are limited to four small upstream fixes, one for the CVE
itself, two additional bounds checks in the XCF loader, and one small
sanity check in the LBM loader. The update is limited to parser side
code changes. No installed headers, exported symbols, or package
relationships are changed.

[ Checklist ]
   [x] *all* changes are documented in the d/changelog
   [x] I reviewed all changes and I approve them
   [x] attach debdiff against the package in (old)stable
   [x] the issue is verified as fixed in unstable

[ Changes ]
This upload imports the following upstream fixes:

   * CVE-2026-35444.patch
     - fix the out-of-bounds read in the XCF image loader
   * xcf-fix-heap-buffer-overflow-read-in-XCF-RLE-decoder.patch
     - add bounds checks in load_xcf_tile_rle()
   * xcf-fix-heap-buffer-overflow-read-in-do_layer_surface.patch
     - add bounds checks in do_layer_surface()
   * lbm-fix-heap-buffer-overflow-write-in-LBM-palette.patch
     - reject invalid paletted LBM files with too many bitplanes


Please find the debdiff attached.

Control: tags -1 + confirmed

Please go ahead.

Regards,

Adam

Control: tags -1 + moreinfo

Please note that this trixie-pu was not coordinated with the package's
maintainer(s), and I haven't had a response after querying the contents
of this proposed update in the CVE tracking bug
<https://bugs.debian.org/1134510>. I think it should include at least
the follow-up commit
https://github.com/libsdl-org/SDL_image/commit/1aedddcbd205c4e1ea0f99fdb2c785acc8e2489b,
which arranges for SDL's error/exception mechanism to be used correctly
when parsing an invalid XCF file.

In the CVE tracking bug, I also mentioned that there were other
robustness fixes pending review at the time. Those have now been
released (in 2.8.12 and 3.4.4 upstream) so now would be a good time for
anyone interested in backporting invalid-image parsing fixes to take
another look at libsdl2-image (and libsdl3-image). I'm not sure why
CVE-2026-35444, specifically, got a CVE ID but out-of-bounds accesses in
the LBM and XPM parsers didn't.

Aquila, if you have some time available and an interest in this package
(or this CVE), please could you reassess the various fixes in
2.8.10/2.8.12 and 3.4.2/3.4.4 and propose a new update? Or if you no
longer have time available for this package, I'll try to get to it at
some point, but probably not in time for Debian 13.5.

Thanks,
     smcv

Hi Simon,

Thanks for the detailed feedback, and sorry for not getting back to this
earlier.

To clarify the context, I'm not working on this on behalf of any company
or group, and there is no incentive based on the number of CVEs removed.
I was looking through the Security Tracker and decided to help with some
security-related fixes.

When I first looked at CVE-2026-35444 around Apr 8, the Security Tracker
entry was still listed as unfixed for libsdl2-image, libsdl3-image and
sdl-image1.2.

The no-dsa/minor classification for trixie/bookworm was added later, on
Apr 14:

https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/4fc2dc066e5cdf4c2cb87ccbb6acba724423dac0

For context, I already had a minimal patch prepared by Apr 10, before
that classification was added, and I sent it to the Security Team for
review. I also let you know about it around that time.

Your points make sense. I'll review the update again, including the
follow-up SDL_SetError commit you mentioned, the XPM null pointer fix,
and the other robustness fixes released in 2.8.12 and 3.4.4. I'll also
take a look at the related libsdl3-image side before proposing a new update.

Thanks again for the guidance.

Aquila Macedo

[ Reason ]
Fix CVE-2026-35444 and various other out-of-bounds accesses when parsing
malformed/crafted image files

[ Impact ]
If not fixed, games/applications that load untrusted images using
SDL2_image could be subject to denial-of-service (crash) or possibly
exploitable.

[ Tests ]
autopkgtest (automated smoke-tests loading images in various formats)
passes. Some sample games from trixie that depend on this library
(assaultcube, wesnoth) appear to run normally. As with SDL3_image, I
haven't attempted to load malformed/crafted/malicious images.

A test-build (equivalent except for the changelog) is available from
<https://people.debian.org/~smcv/13.7/libsdl2-image/testbuild/>.

[ Risks ]
Could regress image loading in SDL2 games, especially in weird/rare
formats. I suspect that in practice, none of our games/applications rely
on being able to load the affected formats (*maybe* GIF and TGA).

[ Checklist ]
  [x] *all* changes are documented in the d/changelog
  [x] I reviewed all changes and I approve them
  [x] attach debdiff against the package in (old)stable
  [x] the issue is verified as fixed in unstable

[ Changes ]
All changes are robustness fixes from upstream. Most are fixed in 3.4.2
or 3.4.4 upstream. One is not in an upstream release yet, I backported
it into forky already.

[ Other info ]
Related to https://bugs.debian.org/1145180 for libsdl3-image, a newer
branch of the same codebase.

Compared with the earlier proposal from Aquila Macedo Costa, this one
addresses all known out-of-bounds accesses, not just the one that (for
whatever reason) had a CVE ID allocated upstream.