Version in base suite: 0.8.3-22 Base version: libgpod_0.8.3-22 Target version: libgpod_0.8.3-22+deb13u1 Base file: /srv/ftp-master.debian.org/ftp/pool/main/libg/libgpod/libgpod_0.8.3-22.dsc Target file: /srv/ftp-master.debian.org/policy/pool/main/libg/libgpod/libgpod_0.8.3-22+deb13u1.dsc changelog | 10 ++++++ patches/0008-Initialize-AFC-service-descriptor.patch | 30 +++++++++++++++++++ patches/series | 1 3 files changed, 41 insertions(+) dpkg-source: warning: cannot verify inline signature for /srv/release.debian.org/tmp/tmpe296p4ic/libgpod_0.8.3-22.dsc: no acceptable signature found dpkg-source: warning: cannot verify inline signature for /srv/release.debian.org/tmp/tmpe296p4ic/libgpod_0.8.3-22+deb13u1.dsc: no acceptable signature found diff -Nru libgpod-0.8.3/debian/changelog libgpod-0.8.3/debian/changelog --- libgpod-0.8.3/debian/changelog 2024-08-15 14:13:14.000000000 +0000 +++ libgpod-0.8.3/debian/changelog 2026-11-07 22:26:22.000000000 +0000 @@ -1,3 +1,13 @@ +libgpod (0.8.3-22+deb13u1) trixie; urgency=medium + + * QA upload. + * debian/patches: + + 0008-Initialize-AFC-service-descriptor.patch: Initialize the AFC service + descriptor before lockdownd_start_service() to prevent an invalid write + in iphone-set-info. (Closes: #1150915) + + -- Boyuan Yang Sat, 07 Nov 2026 17:26:22 -0500 + libgpod (0.8.3-22) unstable; urgency=medium * QA upload diff -Nru libgpod-0.8.3/debian/patches/0008-Initialize-AFC-service-descriptor.patch libgpod-0.8.3/debian/patches/0008-Initialize-AFC-service-descriptor.patch --- libgpod-0.8.3/debian/patches/0008-Initialize-AFC-service-descriptor.patch 1970-01-01 00:00:00.000000000 +0000 +++ libgpod-0.8.3/debian/patches/0008-Initialize-AFC-service-descriptor.patch 2026-11-07 22:26:22.000000000 +0000 @@ -0,0 +1,30 @@ +From: Boyuan Yang +Date: Wed, 14 Oct 2026 11:58:14 -0400 +Subject: [PATCH] tools: Initialize the AFC service descriptor before startup + +lockdownd_start_service() reads the incoming descriptor pointer and resets +its fields if it is non-NULL. Passing an uninitialized pointer can therefore +write through an arbitrary address before a request is sent to the device. +Initialize service to NULL so the library allocates a fresh descriptor. + +The same initialization was added to Ubuntu's downstream API-migration +patch by Sebastien Bacher for LP: #1221031 in libgpod 0.8.2-7ubuntu4. +This patch isolates that fix for the current 0.8.3 source. + +Forwarded: no +Bug-Debian: https://bugs.debian.org/1150915 +Bug-Ubuntu: https://bugs.launchpad.net/bugs/1221031 +Last-Update: 2026-10-14 + +diff --git a/tools/ipod-lockdown.c b/tools/ipod-lockdown.c +--- a/tools/ipod-lockdown.c ++++ b/tools/ipod-lockdown.c +@@ -157,7 +157,7 @@ + idevice_error_t ret = IDEVICE_E_UNKNOWN_ERROR; + afc_error_t afc_ret; + #ifdef HAVE_LIBIMOBILEDEVICE_1_1_5 +- lockdownd_service_descriptor_t service; ++ lockdownd_service_descriptor_t service = NULL; + #else + uint16_t afcport = 0; + #endif diff -Nru libgpod-0.8.3/debian/patches/series libgpod-0.8.3/debian/patches/series --- libgpod-0.8.3/debian/patches/series 2024-08-15 14:13:14.000000000 +0000 +++ libgpod-0.8.3/debian/patches/series 2026-11-07 22:26:22.000000000 +0000 @@ -6,3 +6,4 @@ 0006-fix-new-libplist.patch 0007-Patch-for-newer-libplist-pkgconfig-file.patch gcc14.patch +0008-Initialize-AFC-service-descriptor.patch