Hi,

The following vulnerability was published for libphysfs.

CVE-2024-58392[0]:
| PhysicsFS through 3.2.0 contains an out-of-bounds read vulnerability
| in __PHYSFS_utf8codepoint() that allows attackers to read past name
| buffers via an off-by-one cursor advance on six-octet UTF-8
| sequences. Attackers can supply a crafted archive with entry names
| ending in six-octet sequences, causing PHYSFS_utf8stricmp() and
| hashing to over-read and crash the application.


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2024-58392
https://www.cve.org/CVERecord?id=CVE-2024-58392
[1] https://github.com/icculus/physfs/commit/8a90802778f14dea9c086fb5436839181a3222d5
[2] https://github.com/icculus/physfs/issues/79
[3] https://github.com/icculus/physfs/pull/80

Please adjust the affected versions in the BTS as needed.

Regards,
Salvatore