-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Format: 1.8 Date: Wed, 17 Jun 2026 05:12:30 +0200 Source: cgoban Architecture: source Version: 1.9.14-22 Distribution: unstable Urgency: low Maintainer: Martin A. Godisch <godisch@debian.org> Changed-By: Martin A. Godisch <godisch@debian.org> Closes: 426045 677004 697815 1119374 Changes: cgoban (1.9.14-22) unstable; urgency=low . * Harden the IGS client parser against malicious server input: add field widths to unbounded sscanf() conversions that copied server-controlled data into fixed-size stack buffers (potential remote buffer overflow), including the game-list rank and flag fields parsed by gotGameInfo, and turn the related parse asserts into graceful returns to prevent a remote denial of service (igs-client-input.diff). * Bound SGF coordinate handling: length-limit the lVal copy and return the existing invalid-location sentinel instead of aborting on a malformed coordinate (sgf-input-bounds.diff). * Respect externally supplied CFLAGS so that the dpkg-buildflags hardening (notably -g, -fstack-clash-protection, -fcf-protection and -Werror=format-security) is no longer discarded by the upstream WMS_GET_CFLAGS macro (configure-respect-cflags.diff), closes: #1119374. * Remove the unused, predictable /tmp reference in grab_cgoban (grab-cgoban-tmpfile.diff). * Convert debian/copyright to the machine-readable DEP-5 format. * Drop the now redundant postinst/postrm: the desktop database is refreshed by the desktop-file-utils trigger. * Use https in the Homepage field and in debian/watch. * Remove trailing whitespace from the package long description. * Replace the dead NNGS server connection (nngs.cosmic.org, shut down in 2005) with an informational message window (nngs-shutdown-notice.diff), closes: #426045. * Silence the eight -Wformat-overflow/-Wformat-truncation warnings by converting the affected sprintf calls to snprintf and enlarging the destination buffers to the worst-case formatted size (format-overflow.diff). * Clamp porthole dimensions to at least 1x1 before creating the backing pixmap, fixing a BadAlloc/BadValue crash from X_CreatePixmap under tiling window managers, (debian/patches/crashes-in-awesome.diff), closes: #677004, #697815. * Do not abort the IGS session on an unparsable server line: replace the misleading "ELF sscanf bug" pop-ups with a single stderr diagnostic and skip only the offending line (igs-gamelist-graceful.diff). * Zero newly created XImages so unpainted pixels are not sent to the X server as heap garbage (random coloured noise in the UI); the stone renderer only fills the pixels inside each shape (init-image-data.diff). * Fix the IGS read loop to correctly accumulate server responses larger than the 8 KB input buffer; previously a busy server's game/who list left stale bytes that showed as garbage in the terminal (igs-read-buffer.diff). * Display the observable-games list compactly, without the blank rows that game-number gaps produced on busy servers (games-list-compact.diff). Checksums-Sha1: 68f36cf50bb548240dd55b0cba327f0ba91a5fde 1754 cgoban_1.9.14-22.dsc 69f28f7ebd59b18b1b5c9373dcd6a765fd54f153 21144 cgoban_1.9.14-22.debian.tar.xz 0fed53a1f1f6e0516983de0fe38669873f1da707 6279 cgoban_1.9.14-22_amd64.buildinfo Checksums-Sha256: 63fcd0e5ee066b21c9e6df878d14714fbee5da7b534b9dee490e2cd64970920c 1754 cgoban_1.9.14-22.dsc 53c65a79a6982b2a64e1618b932050cf11656180329c1491f5b1b89631797268 21144 cgoban_1.9.14-22.debian.tar.xz 1cd30ebbc02ccba336faffac563d8a4c4a671eb4f2f39a26c2cc4b750927ced4 6279 cgoban_1.9.14-22_amd64.buildinfo Files: c06088dbe266ed3d181eddbe06aaadd1 1754 games optional cgoban_1.9.14-22.dsc dbe9428fb726c575db2a09df3f15d59c 21144 games optional cgoban_1.9.14-22.debian.tar.xz 2c4ecc0f99f5be9d0cdcc7c09fb2abb7 6279 games optional cgoban_1.9.14-22_amd64.buildinfo -----BEGIN PGP SIGNATURE----- iQJHBAEBCgAxFiEEGEIyO0/Pm5CZX6F/o1C5kfBaSFcFAmoyEv0THGdvZGlzY2hA ZGViaWFuLm9yZwAKCRCjULmR8FpIVzvED/0ScL76Xjdyh9oknyNxcgW7Fn5TAAk/ 7G6AbYunlFp74sp9GdEKJ968x1Tm+WlI/qTDif3PL9feU9r1tEYUmaaffAr8qj94 8+I5v5dXTbrZVqjF8s7oQYLLEu9htrzWz4ycbhRM6V18bL0G4/CoZKGxvS0HjXdQ rAwibQJ5OxGNViJKnCsQkSMt7w/t0OlSJm6XZMm4NzD0+IpZfQbma/Xbi6qZ+HlV ufmgLhMDoCKGPEYhmNBaYyLf/Fyg0ZQV60tSEIOHFrMxPNExV44S+aP0j5iYnUmA HK0r+Hzcmz+zOexNUQex1e6UBfxCbOV4SKTTyM80muTXM6bcxp3xJM9eQc/P6o4N ocWEjXpVgq9te5Io/WRipFWKKQEj7Kg4S3GdAfxUle7OfPOMjygnpI0PUAoCdtI1 9I76kbNTtQc0GJmqMPYwQKbeZ44qZQsdFZeHEwx/o2tlK14sV7U1K+Utw2mX+yBI v4N1LkSR8PLeYv8eVpyIXhCCqxO5XsX2O0KX/7Cn8ET95XrweYs1Q7AjhzBIgE48 GhlDSxU8wZ8nq1HvUjXorV79FohVQCriBu+EvYSV+3PZPpzTfL4+Ew3MfQPdiPcE UuHVBF1ema6kj4qx4PzCFTJcDUOb3Rkof1cqy26ZXI2W/XfTX432+xNU4FojOoQ+ 6VFZDY1vTBaS2w== =liYJ -----END PGP SIGNATURE-----
