-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Format: 1.8
Date: Sun, 30 Apr 2023 17:35:04 +0200
Source: sgt-puzzles
Binary: sgt-puzzles sgt-puzzles-dbgsym
Architecture: i386
Version: 20191231.79a5378-3+deb11u1
Distribution: bullseye
Urgency: medium
Maintainer: amd64 / i386 Build Daemon (x86-ubc-02) <buildd_amd64-x86-ubc-02@buildd.debian.org>
Changed-By: Ben Hutchings <benh@debian.org>
Description:
 sgt-puzzles - Simon Tatham's Portable Puzzle Collection - 1-player puzzle games
Closes: 905852 1028986 1034190
Changes:
 sgt-puzzles (20191231.79a5378-3+deb11u1) bullseye; urgency=medium
 .
   * Fix various security issues in game loading (Closes: #1028986, #1034190):
     - Mines: add validation for negative mine count.
     - Galaxies: fix assertion failure when adding out-of-bounds association.
     - Filling: fix assertion failure in 3x1 game generation.
     - Map: add missing sresize in new_game_desc().
     - Add more validation to midend deserialisation routine
     - Correct and enable the range check on statepos when loading
     - Add an assertion to check the format of encoded parameters
     - Add assertions that game descriptions consist only of printable ASCII.
     - Hex-encode non-ASCII random seeds in save files
     - Assert that everything written to a save file is printable ASCII
     - Build fix: take declarations out of for loops.
     - galaxies: Use the same code for handling all dropped arrows
     - magnets: Area constraints; fix message.
     - lightup: Ban 2x2 with either 4-way type
     - Remove _() introduced from Android port.
     - Solo: Set max difficulty for small jigsaw puzzles
     - Add a macro of an upper bound on the formatted length of an integer
     - Guess: Don't allow any moves once the game is solved (CVE-2023-24283)
     - Guess: validate peg colours in decode_ui() (CVE-2023-24284)
     - Netslide: Reject moves wider than the grid (CVE-2023-24285)
     - Sixteen: limit length of moves
     - Undead: check for valid commands in execute_move()
     - Undead: fix buffer overrun in "M" command (CVE-2023-24287)
     - Correct RANGECHECK macro in Black Box
     - Range-check normal moves in Undead
     - Range-check record lengths when deserialising games (CVE-2023-24291)
     - Don't load too many states just because there's no STATEPOS
       (CVE-2023-24288)
     - Palisade: forbid moves that remove grid edges
     - Last-ditch maximum size limit for Bridges
     - Last-ditch grid-size limit for Dominosa
     - Last-ditch grid-size limit for Galaxies
     - Last-ditch grid-size limit for Fifteen
     - Last-ditch maximum size limit for Flip
     - Last-ditch grid-size limit for Flood
     - Insist that Flood grids must have non-zero size
     - Last-ditch grid-size limit for Inertia
     - Last-ditch maximum size limit for Light Up
     - Limit maximum grid size in Loopy
     - Last-ditch maximum size limit for Magnets
     - Last-ditch maximum size limit for Map
     - Last-ditch maximum size limit for Mines
     - Also check for tiny grids in Mines
     - Last-ditch maximum size limit for Net
     - Last-ditch maximum size limit for Netslide
     - Integer overflow protection in Pattern
     - Last-ditch maximum size limit for Palisade
     - Last-ditch maximum size limit for Pearl
     - Last-ditch maximum size limit for Pegs
     - Also limit Pegs to at least 1x1 even when not doing full validation
     - Last-ditch maximum size limit for Same Game
     - Last-ditch maximum size limit for Signpost
     - Last-ditch maximum size limit for Sixteen
     - Limit size of puzzle in Tents to avoid integer overflow
     - Last-ditch maximum size limit for Tracks
     - Last-ditch maximum size limit for Twiddle
     - Adjust Undead upper grid-size limit to avoid overflow
     - Last-ditch point-count limit for Untangle
     - Black Box: correct order of validation checks for "F" commands
     - Palisade: don't leak memory on a bad move
     - Don't allow negative clues in Pattern
     - When loading, don't decode_ui unless we have a UI
     - Palisade: remove assertion from decode_ui()
     - Same Game: reject moves with unexpected characters in
     - Filling: validate length of auto-solve move strings
     - Tighten Bridges' validate_desc()
     - Untangle: forbid descriptions that connect a node to itself
     - Mines: No moving once you're dead!
     - Towers: reject descriptions with odd characters at the end
     - Tracks: make sure moves are valid in execute_move()
     - Tracks: let solve make illegal moves
     - Tracks: tighten up the 'illegal solve submoves' fix.
     - Allow repeated "solve" operations in Guess
     - Black Box: reject negative ball counts in game_params.
     - Add validate_params bounds checks in a few more games.
     - Don't allow Bridges games with < 2 islands
     - Forbid moves that fill with the current colour in Flood
     - Cleanly reject ill-formed solve moves in Flood
     - Don't segfault on premature solve moves in Mines
     - Limit number of mines in Mines game description
     - Validate the number of pegs and holes in a Pegs game ID
     - Mines: forbid moves that flag or unflag an exposed square
     - Mines: Don't check if the player has won if they've already lost
     - Avoid invalid moves when solving Tracks
     - Fix move validation in Netslide
     - Tighten validation of Tents game descriptions
     - Dominosa: require the two halves of a domino to be adjacent
     - Forbid lines off the grid in Pearl
     - Tolerate incorrect solutions in Inertia
     - Palisade: replace dfs_dsf() with a simple iteration.
     - latin_solver_alloc: handle clashing numbers in input grid.
     - Pearl: fix assertion failure on bad puzzle.
     - Pearl: fix bounds check in previous commit.
     - Unequal: Don't insist that solve moves must actually solve
     - Range: Don't fail an assertion on an all-black board
     - Limit width and height to SHRT_MAX in Mines
     - Mines: Add assertions to range-check conversions to short
     - Unequal: fix sense error in latin_solver_alloc fix.
     - Forbid impossible moves in Bridges
     - Forbid game descriptions with joined islands in Bridges
     - Check state is valid at the end of a move in Pearl
     - Cleanly reject more ill-formed solve moves in Flood
     - Don't allow moves that change the constraints in Unequal
     - Fix memory leaks in Keen's validate_desc()
     - Don't leak grids in Loopy's validate_desc()
     - Remember to free the to_draw member from Net's drawstate
     - Undead: check the return value of sscanf() in execute_move()
     - Don't leak duplicate edges in Untangle
     - Remember to free the numcolours array from Pattern's drawstate
     - Twiddle: don't read off the end of parameter strings ending 'm'
     - Loopy: free the grid description string if it's invalid
     - Avoid division by zero in Cube grid-size checks
     - Validate that save file values are ASCII (mostly)
     - More validation of solve moves in Flood
     - Make sure that moves in Flood use only valid colours
     - Tighten grid-size limit in Mines
     - Tracks: set drag_s{x,y} even if starting off-grid
     - Undead: be a bit more careful about sprintf buffer sizes
     - Fix memory leak in midend_game_id_int()
     - Flood: don't read off the end of some parameter strings
     - Be more careful with type of left operand of <<
     - Map: reduce maximum size
     - Correctly handle some short save files
     - Inertia: insist that solutions must be non-empty
     - Galaxies: fix recursion depth limit in solver.
     - Correct a range check in Magnets' layout verification
     - Magnets: add a check that magnets don't wrap between lines
     - Net: assert that cx and cy are in range in compute_active()
     - Don't allow zero clues in Pattern
   * Solo: cope with pencil marks when tilesize == 1 (Closes: #905852)
Checksums-Sha1:
 b555632edcf96784ee9d7658624a41c1fafce169 5850620 sgt-puzzles-dbgsym_20191231.79a5378-3+deb11u1_i386.deb
 cc5ec73d96808bfbf4f797f7a5e06a1061fb9219 15144 sgt-puzzles_20191231.79a5378-3+deb11u1_i386-buildd.buildinfo
 6eb30e2cc4d418c4917f427d97ce30c0a8f0edaa 1804416 sgt-puzzles_20191231.79a5378-3+deb11u1_i386.deb
Checksums-Sha256:
 9ed6b6f2476373870765ab151ab4d36247513be5e908fc902f12f76f04fc25a2 5850620 sgt-puzzles-dbgsym_20191231.79a5378-3+deb11u1_i386.deb
 404314b1af56144e4c2772c6a62a3fcae643b1b265934f59d388d933fc409735 15144 sgt-puzzles_20191231.79a5378-3+deb11u1_i386-buildd.buildinfo
 79358e5d4276e02eee98e7986b5d2fd7d5e99fa61d8bdc099f4279d68730fffb 1804416 sgt-puzzles_20191231.79a5378-3+deb11u1_i386.deb
Files:
 6d2d4848c7e4cf1f7dea1d0bd8d9c721 5850620 debug optional sgt-puzzles-dbgsym_20191231.79a5378-3+deb11u1_i386.deb
 a3828ebd4e264548b3233205be8f539d 15144 games optional sgt-puzzles_20191231.79a5378-3+deb11u1_i386-buildd.buildinfo
 fcfb9dcc9e46f6ce01d1634f34df9fd1 1804416 games optional sgt-puzzles_20191231.79a5378-3+deb11u1_i386.deb

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEJyRdn7p9tGRfxctAots23/koc0EFAmRi7acACgkQots23/ko
c0HIrhAAzlgHhO690Q9k3g5Q5S24qljx4TobC3q4ADCVyp6eaaH32Tglq8tWiVY/
mTi/pSbyAP1lJuc8JxNYso8oRuWQi6VUbFwWTLchLhvqFTNuhHZWxH24sMgOGiqg
AeI741a/xSYAzY6P2lLRRoePJvmlC5Wb9VMD6HfnyhBwVs7v8YyoaN55l94wVah6
UYcftr/gg4ZNM6zU5xArPAOKZsarjrd1FuRvHx5OZZd6ySUO/4xeaW1GnxmXx6ri
UOEEr/4I7Unz277+7qImOaHSgtySAPIdPkkMoaxSOsKz+mEl96N3IbjKvawWWR24
ZmB/CP5DfqVi45mbOobUHRVeOt5Dqp7u7nI6sIvT4x+TchNnVGarMYKvLRvD+D3E
wKqBLWD3SZlXTeKyf9M3Pw4OCFJxsUnjufbYzlJkJYnSGlf/mHaqVx/TvrIRQetf
4bQBobHVApc0oJakrOPPLBmRvMK2kUKUmQOEHBzz8hqwtoCkKDBsb/Bln5YMsT8j
HjjO0S/xbKOWLfRhSlu1oWMe+RrHOtBfBVulZePPC8I3ewpRo+jS4uRz6c8/veh1
nF/lCvWO5EsIY4mVJnKDyonWExEAvITc0GQkwLFNBEcaSk6pstMX03J/1bFD4H8q
dM4jFVdm3sdi+49A4TPxMl0TKpsln3nVSfQJT67ahIvL++Oq2QY=
=aBp2
-----END PGP SIGNATURE-----