[ Reason ]
Fix CVE-2026-35444 and various other out-of-bounds accesses when parsing
malformed/crafted image files
[ Impact ]
If not fixed, games/applications that load untrusted images using
SDL3_image could be subject to denial-of-service (crash) or possibly
exploitable.
[ Tests ]
autopkgtest (automated smoke-tests loading images in various formats)
passes, and the showimage sample program from libsdl3-image-tests can
load various images on a trixie GNOME desktop. I didn't attempt to
obtain malformed/crafted images designed to exploit the robustness
issues.
[ Risks ]
Low risk, hardly anything in trixie uses libsdl3-image: I believe it's
only freerdp-sdl, a developer-oriented RDP client with low popcon, which
uses it to load images into dialogs.
[ Checklist ]
[x] *all* changes are documented in the d/changelog
[x] I reviewed all changes and I approve them
[x] attach debdiff against the package in (old)stable
[x] the issue is verified as fixed in unstable
[ Changes ]
All changes are robustness fixes from upstream. Most are fixed in 3.4.2
or 3.4.4 upstream. One is not in an upstream release yet, I backported
it into forky already.
[ Other info ]
Related to https://bugs.debian.org/1134510 for libsdl2-image, an older
branch of the same codebase.