Version in base suite: 0.20-1

Base version: jbig2dec_0.20-1
Target version: jbig2dec_0.20-1+deb13u1
Base file: /srv/ftp-master.debian.org/ftp/pool/main/j/jbig2dec/jbig2dec_0.20-1.dsc
Target file: /srv/ftp-master.debian.org/policy/pool/main/j/jbig2dec/jbig2dec_0.20-1+deb13u1.dsc

 changelog                    |    6 ++++++
 patches/CVE-2026-38076.patch |   43 +++++++++++++++++++++++++++++++++++++++++++
 patches/series               |    1 +
 3 files changed, 50 insertions(+)

dpkg-source: warning: cannot verify inline signature for /srv/release.debian.org/tmp/tmphuyiz0zl/jbig2dec_0.20-1.dsc: no acceptable signature found
dpkg-source: warning: cannot verify inline signature for /srv/release.debian.org/tmp/tmphuyiz0zl/jbig2dec_0.20-1+deb13u1.dsc: no acceptable signature found
diff -Nru jbig2dec-0.20/debian/changelog jbig2dec-0.20/debian/changelog
--- jbig2dec-0.20/debian/changelog	2023-11-30 13:40:40.000000000 +0000
+++ jbig2dec-0.20/debian/changelog	2026-08-30 18:10:35.000000000 +0000
@@ -1,3 +1,9 @@
+jbig2dec (0.20-1+deb13u1) trixie-security; urgency=medium
+
+  * CVE-2026-38076 (Closes: #1142282)
+
+ -- Moritz Mühlenhoff <jmm@debian.org>  Sun, 30 Aug 2026 20:10:35 +0200
+
 jbig2dec (0.20-1) unstable; urgency=medium
 
   [ upstream ]
diff -Nru jbig2dec-0.20/debian/patches/CVE-2026-38076.patch jbig2dec-0.20/debian/patches/CVE-2026-38076.patch
--- jbig2dec-0.20/debian/patches/CVE-2026-38076.patch	1970-01-01 00:00:00.000000000 +0000
+++ jbig2dec-0.20/debian/patches/CVE-2026-38076.patch	2026-08-16 20:52:28.000000000 +0000
@@ -0,0 +1,43 @@
+From cc37d0931aa71582f7128736a068c92cd8712d9b Mon Sep 17 00:00:00 2001
+From: Robin Watts <Robin.Watts@artifex.com>
+Date: Tue, 10 Mar 2026 16:33:37 +0000
+Subject: [PATCH] Bug 709176: Validate SBSYMCODELEN before use.
+
+--- jbig2dec-0.20.orig/jbig2_arith_iaid.c
++++ jbig2dec-0.20/jbig2_arith_iaid.c
+@@ -47,7 +47,7 @@ jbig2_arith_iaid_ctx_new(Jbig2Ctx *ctx,
+     Jbig2ArithIaidCtx *result;
+     size_t ctx_size;
+ 
+-    if (sizeof(ctx_size) * 8 <= SBSYMCODELEN)
++    if (SBSYMCODELEN > 31 || sizeof(ctx_size) * 8 <= SBSYMCODELEN)
+     {
+         jbig2_error(ctx, JBIG2_SEVERITY_FATAL, JBIG2_UNKNOWN_SEGMENT_NUMBER, "requested IAID arithmetic coding state size too large");
+         return NULL;
+@@ -82,7 +82,7 @@ jbig2_arith_iaid_decode(Jbig2Ctx *ctx, J
+     Jbig2ArithCx *IAIDx = actx->IAIDx;
+     uint8_t SBSYMCODELEN = actx->SBSYMCODELEN;
+     /* A.3 (1) */
+-    int PREV = 1;
++    uint32_t PREV = 1;
+     int D;
+     int i;
+ 
+@@ -94,14 +94,14 @@ jbig2_arith_iaid_decode(Jbig2Ctx *ctx, J
+ #ifdef VERBOSE
+         fprintf(stderr, "IAID%x: D = %d\n", PREV, D);
+ #endif
+-        PREV = (PREV << 1) | D;
++        PREV = (PREV << 1) | (uint32_t)D;
+     }
+     /* A.3 (3) */
+-    PREV -= 1 << SBSYMCODELEN;
++    PREV -= (1U << SBSYMCODELEN);
+ #ifdef VERBOSE
+     fprintf(stderr, "IAID result: %d\n", PREV);
+ #endif
+-    *p_result = PREV;
++    *p_result = (int)PREV;
+     return 0;
+ }
+ 
diff -Nru jbig2dec-0.20/debian/patches/series jbig2dec-0.20/debian/patches/series
--- jbig2dec-0.20/debian/patches/series	2023-11-30 13:40:40.000000000 +0000
+++ jbig2dec-0.20/debian/patches/series	2026-08-16 20:52:17.000000000 +0000
@@ -3,3 +3,4 @@
 1004_extract_infile_from_autogen-sh.patch
 2001_disable_memento.patch
 2002_abi_compat.patch
+CVE-2026-38076.patch