giflib (5.2.2-1ubuntu1.2) noble-security; urgency=medium

  * SECURITY UPDATE: double-free via shallow copy in GifMakeSavedImage
    - debian/patches/CVE-2026-23868-pre1.patch: Address detected memory leaks in
      gifalloc.c.
    - debian/patches/CVE-2026-23868.patch: Avoid potentuial double-free on weird
      images in gifalloc.c.
    - debian/patches/CVE-2026-23868-2.patch: Also copy ExtensionBlockCount in
      gifalloc.c.
    - CVE-2026-23868
  * SECURITY UPDATE: buffer overflow in EGifGCBToExtension
    - debian/patches/CVE-2026-26740.patch: Fix heap OOB write in
      EGifGCBToSavedExtension in egif_lib.c.
    - CVE-2026-26740
  * SECURITY UPDATE: misc security issues
    - debian/patches/misc-security-issues.patch: Fix integer overflow and type
      safety issues across giflib in dgif_lib.c, egif_lib.c, gifalloc.c,
      quantize.c.
    - No CVE number

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Thu, 16 Jul 2026 13:50:17 -0400

giflib (5.2.2-1ubuntu1) noble; urgency=medium

  * d/p/snprintf.patch: 
    - cherry pick a patch from Adam Sampson to fix incorrect length arg
      to snprintf (LP:#2060282).

 -- Nathan Pratta Teodosio <nathan.teodosio@canonical.com>  Fri, 05 Apr 2024 10:31:09 +0200

giflib (5.2.2-1) unstable; urgency=medium

  [ Debian Janitor]
  * Update standards version to 4.6.1, no changes needed.
  * Remove obsolete fields Contact, Name from debian/upstream/metadata
    (already present in machine-readable debian/copyright).
  * Use secure URI in Homepage field.

  [ Andreas Metzler ]
  * debian/patches:
    + Drop patches applied upstream (fix-get-args-segment-violation.patch
      fix-spelling-errors-on-doc-pages.patch recover-giffilter-docs.patch
      add-gifsponge-docs.patch)
    + Drop superseded patch (install-only-distributed-binaries-manuals.patch).
    + Unfuzzz patches
    + Features fixes for CVE-2023-48161, CVE-2022-28506.
  * Cherry-pick Correct-document-page-install.patch to install manpages
    instead of xml source.
  * Install giflib.7 manpage.
  * Update symbol file (added DGifDecreaseImageCounter@Base).
  * Cherry-pick Clean-up-memory-better-at-end-of-run-CVE-2021-40633.patch to
    fix CVE-2021-40633.
  * Add lintian overrides for html files built from xml (source-is-missing).

  [ David Suárez ]
  * New upstream version;
      Closes: #1024988, #988151, #1014586, #1045040, 1049653
  * Update email to debian domain.
  * Wrap and sort.
  * Add 'dont-build-html-pages-images' patch.
  * Acknowledges NMU's uploads.
  * Add 'salsa-ci.yml'.

 -- David Suárez <deiv@debian.org>  Sun, 25 Feb 2024 17:44:51 +0000

giflib (5.2.1-2.5) unstable; urgency=medium

  * Non-maintainer upload
  * Move declaration of GifQuantizeBuffer() back to gif_lib.h
    (Closes: #1011705)

 -- Graham Inggs <ginggs@debian.org>  Sun, 12 Jun 2022 16:32:15 +0000

giflib (5.2.1-2.4) unstable; urgency=medium

  * Non-maintainer upload.
  * Upload to unstable.

 -- Mattia Rizzolo <mattia@debian.org>  Wed, 27 Apr 2022 20:17:29 +0200

giflib (5.2.1-2.3) experimental; urgency=medium

  * Non-maintainer upload.
  * Merge experimental git branch into master
  * tests: do not spoil test result files with stderr

 -- Vasyl Gello <vasek.gello@gmail.com>  Fri, 22 Apr 2022 04:06:59 +0000

giflib (5.2.1-2.2) experimental; urgency=medium

  * Non-maintainer upload.
  * Add patch from Fedora (giflib_quantize.patch) to reinstate
    GifQuantizeBuffer into giflib.so.  Closes: #935088
  * Re-add the symbols in libgif7.symbols.

 -- Mattia Rizzolo <mattia@debian.org>  Thu, 14 Apr 2022 16:06:15 +0200

giflib (5.1.9-2.1) unstable; urgency=medium

  * Non-maintainer upload.
  * Ship pkg-config information.
  * Mark libgif-dev as Multi-Arch:same.  (Closes: #998128)
  * Bump standards version to 4.6.0, no changes required.

 -- Vasyl Gello <vasek.gello@gmail.com>  Thu, 14 Apr 2022 15:59:53 +0200

giflib (5.2.1-2.1) experimental; urgency=medium

  * Non-maintainer upload.
  * Set Maintainer to David Suárez <david.sephirot@gmail.com>, to match
    unstable and fix a QA check that is warning about orphaned package but
    missing O bug.

 -- Mattia Rizzolo <mattia@debian.org>  Mon, 07 Jun 2021 14:41:34 +0200

giflib (5.1.9-2) unstable; urgency=medium

  * New Debian version.
  * d/control:
    - Update debhelper compatibility.
    - Update standards version; no changes needed.
  * d/patches:
    - Add 'fix-spelling-errors-on-doc-pages'; Closes: #857609.
    - Add 'fix-get-args-segment-violation';
        Closes: #715963, #715964, #715967.
    - Add 'recover-giffilter-docs'.
    - Add 'add-gifsponge-docs'.
  * d/rules:
    - Install only html docs for installed binaries.
    - Clean generated patched doc files.
  * Update d/source/lintian-overrides tag.
  * Remove d/giflib-tools.lintian-overrides: we have the manpages.

 -- David Suárez <david.sephirot@gmail.com>  Sun, 20 Dec 2020 22:07:35 +0100

giflib (5.1.9-1) unstable; urgency=medium

  [ Ondřej Nový ]
  * d/watch: Use https protocol.

  [ Andreas Metzler ]
  * AUTHORS file not shipped anymore, update debian/*.docs.
  * Uses straight make instead of autotools, adapt debian/rules accordingly.
  * Use dh 12 compat level.
  + Update debian/copyright, add Format specifier.

  [ David Suárez ]
  * New upstream version:
    - Add myself as maintainer; Closes: #834410.
    - Fixes heap-based buffer overflow in DGifDecompressLine function.
        CVE-2018-11490 sf#113; Closes: #904114
    - Fixes MemorySanitizer: FPE on unknown address;
        CVE-2019-15133 sf#119: Closes: #904113
  * Acknowledges NMU's uploads.
  * d/watch:
    - Bump version.
    - Don't run uupdate.
    - Don't use debian redirector.
  * d/patches:
    - Drop '03-spelling_fixes.patch' and 'CVE-2016-3977.patch';
        Applied upstream.
    - Add 'install-only-distributed-binaries-manuals' patch.
    - Add 'revert-GifQuantizeBuffer-remove-from-lib' patch.
  * d/rules
    - Don't force the rebuilding of manpages, the clean rule does the job.
    - Remove the txt docs from giflib-tools; Not distributed.
    - Remove 'dh_strip --dbgsym-migration'; Not needed anymore.
    - Set DPKG_GENSYMBOLS_CHECK_LEVEL to 4.
  * giflib-tools.manpages: point to the correct ones.
  * d/control:
    - Add 'Rules-Requires-Root' field.
    - Update Standars version; no changes needed.
    - Change VCS URL's.
  * d/libgif7.symbols:
    - Add 'Build-Depends-Package' field.
    - Update symbols.
  * d/copyright:
    - Remove 'doc/gif87.txt'; Nows not distributed.
    - Add myself on debian/* files.
    - Add 'upstream-{Name,Contact}'.
  * Wrap and sort.
  * Add upstream metadata.
  * Add lintian overrides for some giflib-tools manpages.
  * Add lintian source override for sourceforge redirector.
  * Drop libgif7.shlibs; not needed.

 -- David Suárez <david.sephirot@gmail.com>  Sun, 08 Dec 2019 21:18:23 +0100

giflib (5.2.1-2) experimental; urgency=low

  * QA upload.
  * Run "wrap-and-sort --max-line-length=72 --short-indent"; also wrap package
    descriptions.
  * Pass -c4 to dpkg-gensymbols.

 -- Andreas Metzler <ametzler@debian.org>  Sun, 25 Aug 2019 18:13:08 +0200

giflib (5.2.1-1) experimental; urgency=low

  * QA upload.
  * New upstream version.
    + Drop 03-spelling_fixes.patch and 40_fixtestsuite.diff.
    + Unfuzz and extend (for libutil addition)
      30_link_utils_dynamically.diff.
    + Do not ship gif standards in txt format with giflib-tools.
    + Update symbol file. Symbols which were only accidentally exported were
      removed. For consumption by giflib-tools a small (static) helper library
      (libutil) still provides the symbols.
    + Pass CC=$(CC) to dh_auto_build

 -- Andreas Metzler <ametzler@debian.org>  Sun, 18 Aug 2019 14:32:47 +0200

# Older entries have been removed from this changelog.
# To read the complete changelog use `apt changelog libgif7`.
