-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
Format: 1.8
Date: Sun, 30 Apr 2023 17:35:04 +0200
Source: sgt-puzzles
Binary: sgt-puzzles sgt-puzzles-dbgsym
Architecture: mips64el
Version: 20191231.79a5378-3+deb11u1
Distribution: bullseye
Urgency: medium
Maintainer: mipsel Build Daemon (mipsel-osuosl-03) <buildd_mips64el-mipsel-osuosl-03@buildd.debian.org>
Changed-By: Ben Hutchings <benh@debian.org>
Description:
sgt-puzzles - Simon Tatham's Portable Puzzle Collection - 1-player puzzle games
Closes: 905852 1028986 1034190
Changes:
sgt-puzzles (20191231.79a5378-3+deb11u1) bullseye; urgency=medium
.
* Fix various security issues in game loading (Closes: #1028986, #1034190):
- Mines: add validation for negative mine count.
- Galaxies: fix assertion failure when adding out-of-bounds association.
- Filling: fix assertion failure in 3x1 game generation.
- Map: add missing sresize in new_game_desc().
- Add more validation to midend deserialisation routine
- Correct and enable the range check on statepos when loading
- Add an assertion to check the format of encoded parameters
- Add assertions that game descriptions consist only of printable ASCII.
- Hex-encode non-ASCII random seeds in save files
- Assert that everything written to a save file is printable ASCII
- Build fix: take declarations out of for loops.
- galaxies: Use the same code for handling all dropped arrows
- magnets: Area constraints; fix message.
- lightup: Ban 2x2 with either 4-way type
- Remove _() introduced from Android port.
- Solo: Set max difficulty for small jigsaw puzzles
- Add a macro of an upper bound on the formatted length of an integer
- Guess: Don't allow any moves once the game is solved (CVE-2023-24283)
- Guess: validate peg colours in decode_ui() (CVE-2023-24284)
- Netslide: Reject moves wider than the grid (CVE-2023-24285)
- Sixteen: limit length of moves
- Undead: check for valid commands in execute_move()
- Undead: fix buffer overrun in "M" command (CVE-2023-24287)
- Correct RANGECHECK macro in Black Box
- Range-check normal moves in Undead
- Range-check record lengths when deserialising games (CVE-2023-24291)
- Don't load too many states just because there's no STATEPOS
(CVE-2023-24288)
- Palisade: forbid moves that remove grid edges
- Last-ditch maximum size limit for Bridges
- Last-ditch grid-size limit for Dominosa
- Last-ditch grid-size limit for Galaxies
- Last-ditch grid-size limit for Fifteen
- Last-ditch maximum size limit for Flip
- Last-ditch grid-size limit for Flood
- Insist that Flood grids must have non-zero size
- Last-ditch grid-size limit for Inertia
- Last-ditch maximum size limit for Light Up
- Limit maximum grid size in Loopy
- Last-ditch maximum size limit for Magnets
- Last-ditch maximum size limit for Map
- Last-ditch maximum size limit for Mines
- Also check for tiny grids in Mines
- Last-ditch maximum size limit for Net
- Last-ditch maximum size limit for Netslide
- Integer overflow protection in Pattern
- Last-ditch maximum size limit for Palisade
- Last-ditch maximum size limit for Pearl
- Last-ditch maximum size limit for Pegs
- Also limit Pegs to at least 1x1 even when not doing full validation
- Last-ditch maximum size limit for Same Game
- Last-ditch maximum size limit for Signpost
- Last-ditch maximum size limit for Sixteen
- Limit size of puzzle in Tents to avoid integer overflow
- Last-ditch maximum size limit for Tracks
- Last-ditch maximum size limit for Twiddle
- Adjust Undead upper grid-size limit to avoid overflow
- Last-ditch point-count limit for Untangle
- Black Box: correct order of validation checks for "F" commands
- Palisade: don't leak memory on a bad move
- Don't allow negative clues in Pattern
- When loading, don't decode_ui unless we have a UI
- Palisade: remove assertion from decode_ui()
- Same Game: reject moves with unexpected characters in
- Filling: validate length of auto-solve move strings
- Tighten Bridges' validate_desc()
- Untangle: forbid descriptions that connect a node to itself
- Mines: No moving once you're dead!
- Towers: reject descriptions with odd characters at the end
- Tracks: make sure moves are valid in execute_move()
- Tracks: let solve make illegal moves
- Tracks: tighten up the 'illegal solve submoves' fix.
- Allow repeated "solve" operations in Guess
- Black Box: reject negative ball counts in game_params.
- Add validate_params bounds checks in a few more games.
- Don't allow Bridges games with < 2 islands
- Forbid moves that fill with the current colour in Flood
- Cleanly reject ill-formed solve moves in Flood
- Don't segfault on premature solve moves in Mines
- Limit number of mines in Mines game description
- Validate the number of pegs and holes in a Pegs game ID
- Mines: forbid moves that flag or unflag an exposed square
- Mines: Don't check if the player has won if they've already lost
- Avoid invalid moves when solving Tracks
- Fix move validation in Netslide
- Tighten validation of Tents game descriptions
- Dominosa: require the two halves of a domino to be adjacent
- Forbid lines off the grid in Pearl
- Tolerate incorrect solutions in Inertia
- Palisade: replace dfs_dsf() with a simple iteration.
- latin_solver_alloc: handle clashing numbers in input grid.
- Pearl: fix assertion failure on bad puzzle.
- Pearl: fix bounds check in previous commit.
- Unequal: Don't insist that solve moves must actually solve
- Range: Don't fail an assertion on an all-black board
- Limit width and height to SHRT_MAX in Mines
- Mines: Add assertions to range-check conversions to short
- Unequal: fix sense error in latin_solver_alloc fix.
- Forbid impossible moves in Bridges
- Forbid game descriptions with joined islands in Bridges
- Check state is valid at the end of a move in Pearl
- Cleanly reject more ill-formed solve moves in Flood
- Don't allow moves that change the constraints in Unequal
- Fix memory leaks in Keen's validate_desc()
- Don't leak grids in Loopy's validate_desc()
- Remember to free the to_draw member from Net's drawstate
- Undead: check the return value of sscanf() in execute_move()
- Don't leak duplicate edges in Untangle
- Remember to free the numcolours array from Pattern's drawstate
- Twiddle: don't read off the end of parameter strings ending 'm'
- Loopy: free the grid description string if it's invalid
- Avoid division by zero in Cube grid-size checks
- Validate that save file values are ASCII (mostly)
- More validation of solve moves in Flood
- Make sure that moves in Flood use only valid colours
- Tighten grid-size limit in Mines
- Tracks: set drag_s{x,y} even if starting off-grid
- Undead: be a bit more careful about sprintf buffer sizes
- Fix memory leak in midend_game_id_int()
- Flood: don't read off the end of some parameter strings
- Be more careful with type of left operand of <<
- Map: reduce maximum size
- Correctly handle some short save files
- Inertia: insist that solutions must be non-empty
- Galaxies: fix recursion depth limit in solver.
- Correct a range check in Magnets' layout verification
- Magnets: add a check that magnets don't wrap between lines
- Net: assert that cx and cy are in range in compute_active()
- Don't allow zero clues in Pattern
* Solo: cope with pencil marks when tilesize == 1 (Closes: #905852)
Checksums-Sha1:
182b5fba6981e4d54c0295b2e19e16eefb682032 7307296 sgt-puzzles-dbgsym_20191231.79a5378-3+deb11u1_mips64el.deb
493c15a9054fa81e67345566dd1c8b32feab8b1b 15028 sgt-puzzles_20191231.79a5378-3+deb11u1_mips64el-buildd.buildinfo
bb4d628f040bdef1db207bd7d2545a50e02518b4 1782124 sgt-puzzles_20191231.79a5378-3+deb11u1_mips64el.deb
Checksums-Sha256:
b8ccd3eaba0d83936b1ae7b0ca0dce41e696a3a63295c9255f41069874ae6bb2 7307296 sgt-puzzles-dbgsym_20191231.79a5378-3+deb11u1_mips64el.deb
a73f79801f36dfc5f62a885c338accefe9e0bb1403a93f62e8d289d9a7578fc2 15028 sgt-puzzles_20191231.79a5378-3+deb11u1_mips64el-buildd.buildinfo
aa17aac7abd211708d1b692c3a40523614230acbd6edc80b758fc0d02ec14d9b 1782124 sgt-puzzles_20191231.79a5378-3+deb11u1_mips64el.deb
Files:
3365e7f22dba27d8963a1e20eb1396ad 7307296 debug optional sgt-puzzles-dbgsym_20191231.79a5378-3+deb11u1_mips64el.deb
7e76ca82734ba07660f8de2042a78a9d 15028 games optional sgt-puzzles_20191231.79a5378-3+deb11u1_mips64el-buildd.buildinfo
97a35886d1bfc5efefb160c90b6ec8f2 1782124 games optional sgt-puzzles_20191231.79a5378-3+deb11u1_mips64el.deb
-----BEGIN PGP SIGNATURE-----
iQIzBAEBCgAdFiEEXUZVEjohYGA7PDpMojl408mCs9YFAmRi7bAACgkQojl408mC
s9ZSWQ/8D8i6PWUsx9pzG8lDSzE7nhRfPXKe4SBszgOwJcHP/S+A8eIF4HPdWnTu
SuhSb1IninIBCMeqd9Djm+JBbO3MsVk8/eW+FA/qukx0a8KKrgsJQFcY8wZAeA4L
FMnBm6192gvTzUZIBV/2pk1POj4Yf0tA5hJyU5I6OL7EMjLpPdZJ3CjHs4Dv0JSJ
hReXv81u5y22Q5cSJYlcdH+TAu2wqr47t1QubZvd5uY8ELKMAZorZS6b3KCKKTKc
CGvbdRdYqlRW4URQqJeBdOC9LDLUtlJcBFgKNmcYsYQw7JnUY3d8+VYdTHLWX82d
4a7ad+FN72YWBYoOEzCxRQfFymX3KwrwyfZ3XpyVb2nhNcVFVmLacLXXmJrgyNPm
wEocOd4JnQ/geoZRkfjLe2bU3nCxfAbD0b2JKm+AS+7whAseZV+m0GuCVlOX1frS
2vGstCjD+ztxDQ94N6PMEuRPVC9LTGPTuAo/R2nVeKyBXFtJ6Z48qxN96NP71L+o
RW9e+U8lBaBOPfJdsVP1zEUrdYBR2JWcvxpDxFp4su6vzFcCaml6JBLz/dZnXTPU
rmmMNcFWTIufe3DtT/naR46JUTtfQ62p5Cc9w+aO2puXOx0Mb+oYxHXtefMKTPPU
J1U5OFsDhucdZG7Z9jTGpeA/9+96HJ8cdoVM/O9QrK7BF7cEbB8=
=jY+9
-----END PGP SIGNATURE-----