jbig2dec (0.19-3ubuntu0.1) jammy-security; urgency=medium

  * SECURITY UPDATE: OOB read in command-line tool
    - debian/patches/CVE-2023-46361.patch: Avoid uninitialized allocator in
      command-line tool in jbig2dec.c.
    - CVE-2023-46361
  * SECURITY UPDATE: DoS via integer overflow in jbig2_arith_iaid_ctx_new()
    - debian/patches/CVE-2026-38076.patch: Validate SBSYMCODELEN before use
      in jbig2_arith_iaid.c.
    - CVE-2026-38076

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Thu, 16 Jul 2026 12:50:11 -0400

jbig2dec (0.19-3build2) jammy; urgency=high

  * No change rebuild for ppc64el baseline bump.

 -- Julian Andres Klode <juliank@ubuntu.com>  Thu, 24 Mar 2022 13:02:43 +0100

jbig2dec (0.19-3build1) impish; urgency=medium

  * No-change rebuild to build packages with zstd compression.

 -- Matthias Klose <doko@ubuntu.com>  Thu, 07 Oct 2021 12:13:23 +0200

jbig2dec (0.19-3) unstable; urgency=medium

  * add patch cherry-picked upstream
    to use correct freeing function for JBIG2 images
  * add autopkgtest;
    closes: bug#959468, thanks to Dylan Aïssi

 -- Jonas Smedegaard <dr@jones.dk>  Thu, 22 Apr 2021 13:11:05 +0200

jbig2dec (0.19-2) unstable; urgency=medium

  * cherry-pick patches from upstream:
    + silence a compiler warning
    + fix honor memory alignment (needed on SPARC)
  * declare compliance with Debian Policy 4.5.1

 -- Jonas Smedegaard <dr@jones.dk>  Tue, 02 Feb 2021 14:55:02 +0100

jbig2dec (0.19-1) unstable; urgency=medium

  [ upstream ]
  * new release

  [ Jonas Smedegaard ]
  * simplify source script copyright-chceck

 -- Jonas Smedegaard <dr@jones.dk>  Thu, 10 Sep 2020 19:45:19 +0200

jbig2dec (0.18+20200417-1) unstable; urgency=medium

  [ upstream ]
  * development snapshot
    + Separate command line tool error callback state from parameters.
    + Mention all long options in usage and manpage.
    + Add command line option to limit memory usage.
    + Add more references to specification.
    + Keep type of index and array length the same.
    + Use unsigned suffix when defining UINT32_MAX.
    + Handle under-/overflow detection and messaging better.
    + Let arithmetic decoder and the underlying stream report errors.
    + Add overflow detection for IAID context size.
    + Treat end of stream as fatal error, and remember errors.
    + Avoid artificially limiting jbig2dec.
    + Avoid passing NULL buffer to snprintf().
    + Remove trailing whitespace.
    + Address all signedness comparison issues.
    + Enable warnings for signedness in comparisons.
    + Avoid warning by copying bytes instead of characters.
    + Fix under/overflow handling in arithmetic integer decoder.
    + Pass segment numbers as unsigned values to error callback.
    + Avoid formatting error messages twice in error callback.
    + Use size_t for string length.
    + Handle errors from reading jbig2 streams.
    + Always use uint32_t when counting pages.
    + Use uint32_t when counting segments.
    + Fix signedness conversions.
    + Fix two overlooked warnings.
    + Use correct define for maximum value of type.
    + Record stream errors in separate struct field.
    + Cast literal to avoid shifting outside of valid range.
    + Need to store local copy of error message.
    + Plug leak of image upon error.
    + Adjust number of bytes consumed by MMR decoder.
    + Initiate variable before avoids using uninited data
      during cleanup.
    + Refill input buffer upon failure to parse segment header.

  [ Jonas Smedegaard ]
  * copyright: update coverage
  * use debhelper compatibility level 10 (not 9);
    stop build-depend explicitly on dh-autoreconf libtool
  * avoid running python test apparently relying on missing data files;
    drop patch 1001; stop build-depend on python;
    closes: bug#943139, thanks to Sandro Tosi

 -- Jonas Smedegaard <dr@jones.dk>  Thu, 23 Apr 2020 10:01:35 +0200

jbig2dec (0.18-1) unstable; urgency=medium

  [ upstream ]
  * new release
    closes: bug#952674, thanks to Mathieu Malaterre

  [ Jonas Smedegaard ]
  * declare compliance with Debian Policy 4.5.0

 -- Jonas Smedegaard <dr@jones.dk>  Sun, 15 Mar 2020 10:48:03 +0100

jbig2dec (0.17-1) unstable; urgency=medium

  [ upstream ]
  * New release.

  [ Jonas Smedegaard ]
  * Switch to track upstream release tags.
  * Declare compliance with Debian Policy 4.4.1.
  * Update copyright info:
    + List uptream bugtracker as preferred upstream contact.

 -- Jonas Smedegaard <dr@jones.dk>  Wed, 02 Oct 2019 11:31:55 +0200

jbig2dec (0.16+20190905-3) unstable; urgency=medium

  * Fix Vcs-Browser URL.
  * Add patch 2002 to restore ABI compatibility.
    Closes: Bug#940605. Thanks to Julien Cristau.
  * Update symbols file: 1 symbol added (i.e. restored).

 -- Jonas Smedegaard <dr@jones.dk>  Thu, 19 Sep 2019 12:41:12 +0200

# For older changelog entries, run 'apt-get changelog libjbig2dec0'
