Debian Patches

Status for librsvg/2.60.0+dfsg-1+deb13u1

Patch Description Author Forwarded Bugs Origin Last update
debian/Revert-ABI-breakage.patch Revert ABI breakage
Provide the rsvg_handle_new_gz function.
Do not provide the C prototype to force
applications using it to use rsvg_handle_new instead.		 Josselin Mouette <joss@debian.org> not-needed 2017-12-19
debian/tests-Replace-a-CC-BY-SA-2.0-test-image-with-a-simpler-on.patch tests: Replace a CC-BY-SA-2.0 test image with a simpler one
It isn't clear whether CC-BY-SA-2.0 is considered to be Free Software by
Debian (version 1.0 isn't, version 3.0 is).		 Simon McVittie <smcv@debian.org> not-needed 2022-01-03
debian/use-vendored-crates.diff Use the vendored crates to build librsvg without network access Matthias Geiger <werdahias@riseup.net> not-needed 2024-02-10
workarounds/skip-broken-reftests.diff Skip broken reftests
Additionally, skip tests that fail on big-endian architectures.		 Matthias Geiger <werdahias@riseup.net> not-needed 2024-02-29
workarounds/Skip-invalid_viewbox-test-on-32-bit-x86.patch Skip invalid_viewbox test on 32-bit x86
This test appears to be failing on i386, possibly due to extended
precision in the i387 FPU. Building with -mfpmath=sse might resolve this,
but that isn't currently allowed in Debian due to our i386 baseline
being 20 years old (in particular no SSE and no SSE2).		 Simon McVittie <smcv@debian.org> not-needed 2020-05-11
workarounds/tests-Skip-known-failing-tests-on-i386.patch tests: Skip known-failing tests on i386
These seem to have regressed sometime between October 2022 and now,
possibly as a result of upgrading rustc from 1.61 to 1.63.		 Simon McVittie <smcv@debian.org> not-needed debian 2023-06-18
workarounds/Temporarily-disable-rtl-span-reftest-which-fails-with-Pan.patch Temporarily disable rtl-span reftest which fails with Pango 1.52.1
Ideally we would like to avoid a versioned build-dependency on
Pango 1.52.1 until that version has reached testing, so for now we
disable this test instead of updating its expected rendering to match
Pango 1.52.1 behaviour. When 1.52.1 reaches testing, we should reinstate
this (updating its expected rendering if necessary) and add a versioned
Build-Depends.		 Simon McVittie <smcv@debian.org> not-needed debian upstream 2024-03-10
CVE-2026-96889.patch (#1241): Fix use-after-free with duplicate XML entities
When an included XML document declares an entity with a duplicate name
as an existing one, librsvg would deallocate the old xmlEntityPtr in
XmlEntity::drop() when the duplicate entity is inserted in the hash
table. However, libxml2 still keeps pointers around to the entity
declared in the base document, and makes use of them.

This commit makes librsvg ignore entity declarations when they come in
with the same name as an entity that has already been declared. This
is probably not 100% correct in terms of XML semantics, but I don't
recall seeing text about that in the Xinclude spec.

Thanks to Rafael B. Dias for reporting this in detail.

==3942== Invalid read of size 1
==3942== at 0x5B49A40: xmlParseElementStart (parser.c:9758)
==3942== by 0x5B4E87D: xmlParseContentInternal (parser.c:9580)
==3942== by 0x5B4DF4D: xmlCtxtParseContentInternal (parser.c:11712)
==3942== by 0x5B4E151: xmlCtxtParseEntity (parser.c:11818)
==3942== by 0x5B4E367: xmlParseReference (parser.c:7226)
==3942== by 0x5B4E857: xmlParseContentInternal (parser.c:9590)
==3942== by 0x5B4EA67: xmlParseElement (parser.c:9672)
==3942== by 0x5B515B7: xmlParseDocument (parser.c:10468)
==3942== by 0x463164B: <rsvg::xml::xml2_load::Xml2Parser>::parse (xml2_load.rs:471)
==3942== by 0x45E0B90: <rsvg::xml::XmlState>::parse_from_stream::{closure#0} (mod.rs:648)
==3942== by 0x45916BF: <core::result::Result<alloc::boxed::Box<rsvg::xml::xml2_load::Xml2Parser>, rsvg::error::LoadingError>>::and_then::<(), <rsvg::xml::XmlState>::parse_from_stream::{closure#0}> (library/core/src/result.rs:1493)
==3942== by 0x45E2B54: <rsvg::xml::XmlState>::parse_from_stream (mod.rs:648)
==3942== by 0x45E25FF: <rsvg::xml::XmlState>::build_document (mod.rs:661)
==3942== by 0x45E667B: rsvg::xml::xml_load_from_possibly_compressed_stream (mod.rs:764)
==3942== by 0x46F3DC1: <rsvg::document::Document>::load_from_stream (document.rs:216)
==3942== by 0x44A97FC: <rsvg::api::Loader>::read_stream::<gio::auto::input_stream::InputStream, gio::auto::file::File, gio::auto::cancellable::Cancellable> (api.rs:303)
==3942== Address 0x697f109 is 233 bytes inside a block of size 235 free'd
==3942== at 0x578F9BF: free (in /usr/libexec/valgrind/vgpreload_memcheck-amd64-linux.so)
==3942== by 0x5B3687C: xmlFreeEntity (entities.c:107)
==3942== by 0x44BAD1D: <rsvg::xml::XmlEntity as core::ops::drop::Drop>::drop (mod.rs:97)
==3942== by 0x44B4DFA: core::ptr::drop_glue::<rsvg::xml::XmlEntity> (library/core/src/ptr/mod.rs:825)
==3942== by 0x44ABB37: core::ptr::drop_glue::<core::option::Option<rsvg::xml::XmlEntity>> (library/core/src/ptr/mod.rs:825)
==3942== by 0x45E1E2C: <rsvg::xml::XmlState>::entity_insert (mod.rs:375)
==3942== by 0x4632A20: rsvg::xml::xml2_load::sax_entity_decl_cb (xml2_load.rs:168)
==3942== by 0x5B4FC16: xmlParseEntityDecl (parser.c:5495)
==3942== by 0x5B50A91: xmlParseInternalSubset (parser.c:8027)
==3942== by 0x5B5188E: xmlParseDocument (parser.c:10439)
==3942== by 0x463164B: <rsvg::xml::xml2_load::Xml2Parser>::parse (xml2_load.rs:471)
==3942== by 0x45E0B90: <rsvg::xml::XmlState>::parse_from_stream::{closure#0} (mod.rs:648)
==3942== by 0x45916BF: <core::result::Result<alloc::boxed::Box<rsvg::xml::xml2_load::Xml2Parser>, rsvg::error::LoadingError>>::and_then::<(), <rsvg::xml::XmlState>::parse_from_stream::{closure#0}> (library/core/src/result.rs:1493)
==3942== by 0x45E2B54: <rsvg::xml::XmlState>::parse_from_stream (mod.rs:648)
==3942== by 0x45E121D: <rsvg::xml::XmlState>::acquire_xml (mod.rs:631)
==3942== by 0x45E1682: <rsvg::xml::XmlState>::include_xml (mod.rs:578)
==3942== Block was alloc'd at
==3942== at 0x578C958: malloc (in /usr/libexec/valgrind/vgpreload_memcheck-amd64-linux.so)
==3942== by 0x5B78C60: xmlStrndup (xmlstring.c:54)
==3942== by 0x5B36A03: xmlCreateEntity (entities.c:151)
==3942== by 0x4632994: rsvg::xml::xml2_load::sax_entity_decl_cb (xml2_load.rs:157)
==3942== by 0x5B4FC16: xmlParseEntityDecl (parser.c:5495)
==3942== by 0x5B50A91: xmlParseInternalSubset (parser.c:8027)
==3942== by 0x5B5188E: xmlParseDocument (parser.c:10439)
==3942== by 0x463164B: <rsvg::xml::xml2_load::Xml2Parser>::parse (xml2_load.rs:471)
==3942== by 0x45E0B90: <rsvg::xml::XmlState>::parse_from_stream::{closure#0} (mod.rs:648)
==3942== by 0x45916BF: <core::result::Result<alloc::boxed::Box<rsvg::xml::xml2_load::Xml2Parser>, rsvg::error::LoadingError>>::and_then::<(), <rsvg::xml::XmlState>::parse_from_stream::{closure#0}> (library/core/src/result.rs:1493)
==3942== by 0x45E2B54: <rsvg::xml::XmlState>::parse_from_stream (mod.rs:648)
==3942== by 0x45E25FF: <rsvg::xml::XmlState>::build_document (mod.rs:661)
==3942== by 0x45E667B: rsvg::xml::xml_load_from_possibly_compressed_stream (mod.rs:764)
==3942== by 0x46F3DC1: <rsvg::document::Document>::load_from_stream (document.rs:216)
==3942== by 0x44A97FC: <rsvg::api::Loader>::read_stream::<gio::auto::input_stream::InputStream, gio::auto::file::File, gio::auto::cancellable::Cancellable> (api.rs:303)
==3942== by 0x44824A7: <rsvg_convert::Converter>::convert (main.rs:585)

Fixes https://gitlab.gnome.org/GNOME/librsvg/-/work_items/1241		 Federico Mena Quintero <federico@gnome.org> no 2026-09-17

All known versions for source package 'librsvg'

Links