-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Format: 1.8 Date: Sun, 30 Apr 2023 17:35:04 +0200 Source: sgt-puzzles Binary: sgt-puzzles sgt-puzzles-dbgsym Architecture: amd64 Version: 20191231.79a5378-3+deb11u1 Distribution: bullseye Urgency: medium Maintainer: all / amd64 / i386 Build Daemon (x86-conova-01) Changed-By: Ben Hutchings Description: sgt-puzzles - Simon Tatham's Portable Puzzle Collection - 1-player puzzle games Closes: 905852 1028986 1034190 Changes: sgt-puzzles (20191231.79a5378-3+deb11u1) bullseye; urgency=medium . * Fix various security issues in game loading (Closes: #1028986, #1034190): - Mines: add validation for negative mine count. - Galaxies: fix assertion failure when adding out-of-bounds association. - Filling: fix assertion failure in 3x1 game generation. - Map: add missing sresize in new_game_desc(). - Add more validation to midend deserialisation routine - Correct and enable the range check on statepos when loading - Add an assertion to check the format of encoded parameters - Add assertions that game descriptions consist only of printable ASCII. - Hex-encode non-ASCII random seeds in save files - Assert that everything written to a save file is printable ASCII - Build fix: take declarations out of for loops. - galaxies: Use the same code for handling all dropped arrows - magnets: Area constraints; fix message. - lightup: Ban 2x2 with either 4-way type - Remove _() introduced from Android port. - Solo: Set max difficulty for small jigsaw puzzles - Add a macro of an upper bound on the formatted length of an integer - Guess: Don't allow any moves once the game is solved (CVE-2023-24283) - Guess: validate peg colours in decode_ui() (CVE-2023-24284) - Netslide: Reject moves wider than the grid (CVE-2023-24285) - Sixteen: limit length of moves - Undead: check for valid commands in execute_move() - Undead: fix buffer overrun in "M" command (CVE-2023-24287) - Correct RANGECHECK macro in Black Box - Range-check normal moves in Undead - Range-check record lengths when deserialising games (CVE-2023-24291) - Don't load too many states just because there's no STATEPOS (CVE-2023-24288) - Palisade: forbid moves that remove grid edges - Last-ditch maximum size limit for Bridges - Last-ditch grid-size limit for Dominosa - Last-ditch grid-size limit for Galaxies - Last-ditch grid-size limit for Fifteen - Last-ditch maximum size limit for Flip - Last-ditch grid-size limit for Flood - Insist that Flood grids must have non-zero size - Last-ditch grid-size limit for Inertia - Last-ditch maximum size limit for Light Up - Limit maximum grid size in Loopy - Last-ditch maximum size limit for Magnets - Last-ditch maximum size limit for Map - Last-ditch maximum size limit for Mines - Also check for tiny grids in Mines - Last-ditch maximum size limit for Net - Last-ditch maximum size limit for Netslide - Integer overflow protection in Pattern - Last-ditch maximum size limit for Palisade - Last-ditch maximum size limit for Pearl - Last-ditch maximum size limit for Pegs - Also limit Pegs to at least 1x1 even when not doing full validation - Last-ditch maximum size limit for Same Game - Last-ditch maximum size limit for Signpost - Last-ditch maximum size limit for Sixteen - Limit size of puzzle in Tents to avoid integer overflow - Last-ditch maximum size limit for Tracks - Last-ditch maximum size limit for Twiddle - Adjust Undead upper grid-size limit to avoid overflow - Last-ditch point-count limit for Untangle - Black Box: correct order of validation checks for "F" commands - Palisade: don't leak memory on a bad move - Don't allow negative clues in Pattern - When loading, don't decode_ui unless we have a UI - Palisade: remove assertion from decode_ui() - Same Game: reject moves with unexpected characters in - Filling: validate length of auto-solve move strings - Tighten Bridges' validate_desc() - Untangle: forbid descriptions that connect a node to itself - Mines: No moving once you're dead! - Towers: reject descriptions with odd characters at the end - Tracks: make sure moves are valid in execute_move() - Tracks: let solve make illegal moves - Tracks: tighten up the 'illegal solve submoves' fix. - Allow repeated "solve" operations in Guess - Black Box: reject negative ball counts in game_params. - Add validate_params bounds checks in a few more games. - Don't allow Bridges games with < 2 islands - Forbid moves that fill with the current colour in Flood - Cleanly reject ill-formed solve moves in Flood - Don't segfault on premature solve moves in Mines - Limit number of mines in Mines game description - Validate the number of pegs and holes in a Pegs game ID - Mines: forbid moves that flag or unflag an exposed square - Mines: Don't check if the player has won if they've already lost - Avoid invalid moves when solving Tracks - Fix move validation in Netslide - Tighten validation of Tents game descriptions - Dominosa: require the two halves of a domino to be adjacent - Forbid lines off the grid in Pearl - Tolerate incorrect solutions in Inertia - Palisade: replace dfs_dsf() with a simple iteration. - latin_solver_alloc: handle clashing numbers in input grid. - Pearl: fix assertion failure on bad puzzle. - Pearl: fix bounds check in previous commit. - Unequal: Don't insist that solve moves must actually solve - Range: Don't fail an assertion on an all-black board - Limit width and height to SHRT_MAX in Mines - Mines: Add assertions to range-check conversions to short - Unequal: fix sense error in latin_solver_alloc fix. - Forbid impossible moves in Bridges - Forbid game descriptions with joined islands in Bridges - Check state is valid at the end of a move in Pearl - Cleanly reject more ill-formed solve moves in Flood - Don't allow moves that change the constraints in Unequal - Fix memory leaks in Keen's validate_desc() - Don't leak grids in Loopy's validate_desc() - Remember to free the to_draw member from Net's drawstate - Undead: check the return value of sscanf() in execute_move() - Don't leak duplicate edges in Untangle - Remember to free the numcolours array from Pattern's drawstate - Twiddle: don't read off the end of parameter strings ending 'm' - Loopy: free the grid description string if it's invalid - Avoid division by zero in Cube grid-size checks - Validate that save file values are ASCII (mostly) - More validation of solve moves in Flood - Make sure that moves in Flood use only valid colours - Tighten grid-size limit in Mines - Tracks: set drag_s{x,y} even if starting off-grid - Undead: be a bit more careful about sprintf buffer sizes - Fix memory leak in midend_game_id_int() - Flood: don't read off the end of some parameter strings - Be more careful with type of left operand of << - Map: reduce maximum size - Correctly handle some short save files - Inertia: insist that solutions must be non-empty - Galaxies: fix recursion depth limit in solver. - Correct a range check in Magnets' layout verification - Magnets: add a check that magnets don't wrap between lines - Net: assert that cx and cy are in range in compute_active() - Don't allow zero clues in Pattern * Solo: cope with pencil marks when tilesize == 1 (Closes: #905852) Checksums-Sha1: 8e02ccc489b07d94e7806778ab0b72fbd0be76f0 6946352 sgt-puzzles-dbgsym_20191231.79a5378-3+deb11u1_amd64.deb 5c12e8c9e94769884e997b27988460b20bd3fd52 15205 sgt-puzzles_20191231.79a5378-3+deb11u1_amd64-buildd.buildinfo 2340780fd478df58220f86670f7d1669cff2d391 1834172 sgt-puzzles_20191231.79a5378-3+deb11u1_amd64.deb Checksums-Sha256: a6648b9c1164e75eb60ce3952319b77c0b8963ee7a3e64c3e05b746e5e7fccb3 6946352 sgt-puzzles-dbgsym_20191231.79a5378-3+deb11u1_amd64.deb fed9a3495c02eacc5a09db026b0863daa696050adf71f4addb2b1d6522fd6d20 15205 sgt-puzzles_20191231.79a5378-3+deb11u1_amd64-buildd.buildinfo 3f4e2999593dedc91d6bf7d6958f0d496ff8633bf9f6273d04e161f37e6e1cfd 1834172 sgt-puzzles_20191231.79a5378-3+deb11u1_amd64.deb Files: 9213832d9dc88f4dad132884a6908546 6946352 debug optional sgt-puzzles-dbgsym_20191231.79a5378-3+deb11u1_amd64.deb 7408e2f9aafea5496e131d358312dbf7 15205 games optional sgt-puzzles_20191231.79a5378-3+deb11u1_amd64-buildd.buildinfo 23785d5033aba63120750c30d5b78660 1834172 games optional sgt-puzzles_20191231.79a5378-3+deb11u1_amd64.deb -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEi/TVpVg0yb7dq8QfDZWW6X29YdoFAmRi7RAACgkQDZWW6X29 YdrPPRAAv0+CdpG0JF8ukkI41hwLlDRm0rnLiVnDU/sYWVTxkPgWo3rH3EBiRMf4 sqQ5++g8KqnzZ05g/AflnD1M+IZ4MhFzKsAeekY+XF0OjC6Qwe9aT/T65VKCrkZz 16r0N60FT2279Cbkc7OU39A6Y0O/bKLTVPcJSug2oxVRSXSRT8RE8Pw8x1eoFiQC E0a/aNXk4TZ3SbTN6JCbhAyDpyBbi/0o2AwL4xTAnR++owGQHP7iQFqeq9TDmWar WGSlKyM3SlGUTWVGZdjrdRLJlg4m5efoQK55r0ROJWHdmMxuO1k3GUHI0aUDQgpL cEIgtSZLGYCP2Chw4NaKh90X3AvbTJDXXw5bulprfIpVnQgIko0WG14+wFo5GhJe M5L0LYEj4WKq6SbULabzvBmrJTZMCelE3MtoLEloB8AvSRbzCGcI0gNSI+7CW41F cmCSTmWpS5P1Z2Cv6aJ0rETYzsVaIcXXR002OhyHr3JyS9kV37RNAAMsVplDLUHZ ibJeqi2JnkpGyC7OwJkV2KhZEt+Brb35hz0mrSoG/ZbWIUhTjsQpfGqchZxvmNYM bSm0tmuUIEUhMkTxULx2wE292INSzK1dQmROTdQns0Ybdirt1DdQym00z0qsHlGJ 9WXs20KsetF9NrlIKZCD8HzgHp/j0BVr2FW3NzfL580BXQ6mX/k= =mHwV -----END PGP SIGNATURE-----