Fix for data size calculation integer overflow in float/deflated DNG loader (TALOS-2026-2364); Check for read results

Origin: https://github.com/LibRaw/LibRaw/commit/aa4458eb511daeae90676c1ce5c587106e4aaec1
Bug: https://talosintelligence.com/vulnerability_reports/TALOS-2026-2364
Bug-Debian: https://bugs.debian.org/1133845
Bug-Debian-Security: https://security-tracker.debian.org/tracker/CVE-2026-20884

Gbp-Pq: Topic CVE-2026-20884
Gbp-Pq: Name 03-aa4458eb5.patch

FP DNG data limit: perform calculations in 64 bit

Origin: https://github.com/LibRaw/LibRaw/commit/dae685a198309b978805f098bafe5d951dbc8747
Bug: https://talosintelligence.com/vulnerability_reports/TALOS-2026-2364
Bug-Debian: https://bugs.debian.org/1133845
Bug-Debian-Security: https://security-tracker.debian.org/tracker/CVE-2026-20884

Gbp-Pq: Topic CVE-2026-20884
Gbp-Pq: Name 02-dae685a19.patch

implemented RAW size limit check and allocation result check for 4-shot pentax loaded and FP-dng loader

Origin: https://github.com/LibRaw/LibRaw/commit/afba34ec30bf6409891dc096f6be69155ecf6bdb
Bug: https://talosintelligence.com/vulnerability_reports/TALOS-2026-2364
Bug-Debian: https://bugs.debian.org/1133845
Bug-Debian-Security: https://security-tracker.debian.org/tracker/CVE-2026-20884

Gbp-Pq: Topic CVE-2026-20884
Gbp-Pq: Name 01-afba34ec3.patch

Fix for TALOS-2026-2363: avoid integer overflow in allocation size calculation. Also: check for EOF in read loop

Origin: https://github.com/LibRaw/LibRaw/commit/c911c9b9edffa5fab99f828d0fee6dd2d0f6105f
Bug: https://talosintelligence.com/vulnerability_reports/TALOS-2026-2363
Bug-Debian: https://bugs.debian.org/1133845
Bug-Debian-Security: https://security-tracker.debian.org/tracker/CVE-2026-24450

Gbp-Pq: Name CVE-2026-24450.patch

X3F decoder: implemented hard single allocation limit via LIBRAW_X3F_ALLOC_LIMIT_MB define; allocation size calculation converted to 64 bit arithm; fix for TALOS-2026-2359

Origin: https://github.com/LibRaw/LibRaw/commit/ac151a829b8d3e4c74fa3aefa8a029c3cc3f857f
Bug: https://talosintelligence.com/vulnerability_reports/TALOS-2026-2359
Bug-Debian: https://bugs.debian.org/1133845
Bug-Debian-Security: https://security-tracker.debian.org/tracker/CVE-2026-24660

Gbp-Pq: Name CVE-2026-24660.patch

Fix for TALOS-2026-2358

Origin: https://github.com/LibRaw/LibRaw/commit/b9809e410d07ca7bf408e6d036615fb34f8c47cc
Bug: https://talosintelligence.com/vulnerability_reports/TALOS-2026-2358
Bug-Debian: https://bugs.debian.org/1133845
Bug-Debian-Security: https://security-tracker.debian.org/tracker/CVE-2026-20889

Gbp-Pq: Name CVE-2026-20889.patch

Fix for TALOS-2026-2331

Origin: https://github.com/LibRaw/LibRaw/commit/75ed2c12a35b765b3b6ad695cc1f044f19efe644
Bug: https://talosintelligence.com/vulnerability_reports/TALOS-2026-2331
Bug-Debian: https://bugs.debian.org/1133845
Bug-Debian-Security: https://security-tracker.debian.org/tracker/CVE-2026-21413

Gbp-Pq: Name CVE-2026-21413.patch

libraw (0.21.4-2+deb13u1) trixie; urgency=high

  * Non-maintainer upload.
  * Fix CVE-2026-5342: nikon_load_padded_packed_raw() out-of-bounds read
    due to missing buffer and dimension validation (closes: #1132655).
  * Fix CVE-2026-20884: deflate_dng_load_raw() integer overflow vulnerability
    (closes: #1133845).
  * Fix CVE-2026-20889: x3f_thumb_loader() heap-based buffer overflow
    vulnerability (closes: #1133845).
  * Fix CVE-2026-21413: lossless_jpeg_load_raw() heap-based buffer overflow
    vulnerability (closes: #1133845).
  * Fix CVE-2026-24450: uncompressed_fp_dng_load_raw() integer overflow
    vulnerability (closes: #1133845).
  * Fix CVE-2026-24660: x3f_load_huffman() heap-based buffer overflow
    vulnerability (closes: #1133845).
  * Add d/salsa-ci.yml for Salsa CI.

[dgit import unpatched libraw 0.21.4-2+deb13u1]

Import libraw_0.21.4-2+deb13u1.debian.tar.xz

[dgit import tarball libraw 0.21.4-2+deb13u1 libraw_0.21.4-2+deb13u1.debian.tar.xz]

Import libraw_0.21.4.orig.tar.gz

[dgit import orig libraw_0.21.4.orig.tar.gz]