diff -Nru libidn-1.29/debian/changelog libidn-1.29/debian/changelog
--- libidn-1.29/debian/changelog 2014-08-17 00:47:43.000000000 +0200
+++ libidn-1.29/debian/changelog 2015-07-18 18:10:47.000000000 +0200
@@ -1,3 +1,9 @@
+libidn (1.29-1+deb8u1) jessie-security; urgency=high
+
+ * Fix out-of-bounds read on invalid UTF-8 input as per CVE-2015-2059
+
+ -- Alessandro Ghedini
Sat, 18 Jul 2015 18:00:36 +0200
+
libidn (1.29-1) unstable; urgency=low
[ Simon Josefsson ]
diff -Nru libidn-1.29/debian/patches/01_CVE-2015-2059.patch libidn-1.29/debian/patches/01_CVE-2015-2059.patch
--- libidn-1.29/debian/patches/01_CVE-2015-2059.patch 1970-01-01 01:00:00.000000000 +0100
+++ libidn-1.29/debian/patches/01_CVE-2015-2059.patch 2015-07-18 18:10:47.000000000 +0200
@@ -0,0 +1,632 @@
+From 2e97c2796581c27213962c77f5a8571a598f9a2e Mon Sep 17 00:00:00 2001
+From: Simon Josefsson
+Date: Wed, 08 Jul 2015 00:06:22 +0000
+Subject: libidn: stringprep_utf8_to_ucs4 now rejects invalid UTF-8. CVE-2015-2059
+
+---
+--- a/lib/gl/Makefile.am
++++ b/lib/gl/Makefile.am
+@@ -21,7 +21,7 @@
+ # the same distribution terms as the rest of that program.
+ #
+ # Generated by gnulib-tool.
+-# Reproduce by: gnulib-tool --import --dir=. --local-dir=lib/gl/override --lib=libgnu --source-base=lib/gl --m4-base=lib/gl/m4 --doc-base=doc --tests-base=lib/gltests --aux-dir=build-aux --with-tests --avoid=iconv-h-tests --avoid=string-tests --avoid=wchar-tests --lgpl=2 --no-conditional-dependencies --libtool --macro-prefix=lgl --no-vc-files gettext-h lib-msvc-compat lib-symbol-versions lib-symbol-visibility stdint striconv strverscmp
++# Reproduce by: gnulib-tool --import --dir=. --local-dir=lib/gl/override --lib=libgnu --source-base=lib/gl --m4-base=lib/gl/m4 --doc-base=doc --tests-base=lib/gltests --aux-dir=build-aux --with-tests --avoid=iconv-h-tests --avoid=string-tests --avoid=wchar-tests --lgpl=2 --no-conditional-dependencies --libtool --macro-prefix=lgl --no-vc-files gettext-h lib-msvc-compat lib-symbol-versions lib-symbol-visibility stdint striconv strverscmp unistr/u8-check
+
+ AUTOMAKE_OPTIONS = 1.9.6 gnits subdir-objects
+
+@@ -523,6 +523,14 @@
+
+ ## end gnulib module unistr/base
+
++## begin gnulib module unistr/u8-check
++
++if LIBUNISTRING_COMPILE_UNISTR_U8_CHECK
++libgnu_la_SOURCES += unistr/u8-check.c
++endif
++
++## end gnulib module unistr/u8-check
++
+ ## begin gnulib module unistr/u8-mbtoucr
+
+ if LIBUNISTRING_COMPILE_UNISTR_U8_MBTOUCR
+--- a/lib/gl/m4/gnulib-cache.m4
++++ b/lib/gl/m4/gnulib-cache.m4
+@@ -27,7 +27,7 @@
+
+
+ # Specification in the form of a command-line invocation:
+-# gnulib-tool --import --dir=. --local-dir=lib/gl/override --lib=libgnu --source-base=lib/gl --m4-base=lib/gl/m4 --doc-base=doc --tests-base=lib/gltests --aux-dir=build-aux --with-tests --avoid=iconv-h-tests --avoid=string-tests --avoid=wchar-tests --lgpl=2 --no-conditional-dependencies --libtool --macro-prefix=lgl --no-vc-files gettext-h lib-msvc-compat lib-symbol-versions lib-symbol-visibility stdint striconv strverscmp
++# gnulib-tool --import --dir=. --local-dir=lib/gl/override --lib=libgnu --source-base=lib/gl --m4-base=lib/gl/m4 --doc-base=doc --tests-base=lib/gltests --aux-dir=build-aux --with-tests --avoid=iconv-h-tests --avoid=string-tests --avoid=wchar-tests --lgpl=2 --no-conditional-dependencies --libtool --macro-prefix=lgl --no-vc-files gettext-h lib-msvc-compat lib-symbol-versions lib-symbol-visibility stdint striconv strverscmp unistr/u8-check
+
+ # Specification in the form of a few gnulib-tool.m4 macro invocations:
+ gl_LOCAL_DIR([lib/gl/override])
+@@ -39,6 +39,7 @@
+ stdint
+ striconv
+ strverscmp
++ unistr/u8-check
+ ])
+ gl_AVOID([iconv-h-tests string-tests wchar-tests])
+ gl_SOURCE_BASE([lib/gl])
+--- a/lib/gl/m4/gnulib-comp.m4
++++ b/lib/gl/m4/gnulib-comp.m4
+@@ -113,6 +113,8 @@
+ # Code from module unistd:
+ # Code from module unistd-tests:
+ # Code from module unistr/base:
++ # Code from module unistr/u8-check:
++ # Code from module unistr/u8-check-tests:
+ # Code from module unistr/u8-mbtoucr:
+ # Code from module unistr/u8-mbtoucr-tests:
+ # Code from module unistr/u8-uctomb:
+@@ -178,6 +180,7 @@
+ gl_SYS_TYPES_H
+ AC_PROG_MKDIR_P
+ gl_LIBUNISTRING_LIBHEADER([0.9.2], [unistr.h])
++ gl_LIBUNISTRING_MODULE([0.9], [unistr/u8-check])
+ gl_MODULE_INDICATOR([unistr/u8-mbtoucr])
+ gl_LIBUNISTRING_MODULE([0.9], [unistr/u8-mbtoucr])
+ gl_MODULE_INDICATOR([unistr/u8-uctomb])
+@@ -405,6 +408,7 @@
+ lib/strverscmp.c
+ lib/sys_types.in.h
+ lib/unistr.in.h
++ lib/unistr/u8-check.c
+ lib/unistr/u8-mbtoucr.c
+ lib/unistr/u8-uctomb-aux.c
+ lib/unistr/u8-uctomb.c
+@@ -501,6 +505,7 @@
+ tests/test-unsetenv.c
+ tests/test-verify.c
+ tests/test-verify.sh
++ tests/unistr/test-u8-check.c
+ tests/unistr/test-u8-mbtoucr.c
+ tests/unistr/test-u8-uctomb.c
+ tests=lib/alloca.in.h
+--- /dev/null
++++ b/lib/gl/unistr/u8-check.c
+@@ -0,0 +1,105 @@
++/* Check UTF-8 string.
++ Copyright (C) 2002, 2006-2007, 2009-2015 Free Software Foundation, Inc.
++ Written by Bruno Haible , 2002.
++
++ This program is free software: you can redistribute it and/or modify it
++ under the terms of the GNU Lesser General Public License as published
++ by the Free Software Foundation; either version 2.1 of the License, or
++ (at your option) any later version.
++
++ This program is distributed in the hope that it will be useful,
++ but WITHOUT ANY WARRANTY; without even the implied warranty of
++ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
++ Lesser General Public License for more details.
++
++ You should have received a copy of the GNU Lesser General Public License
++ along with this program. If not, see . */
++
++#include
++
++/* Specification. */
++#include "unistr.h"
++
++const uint8_t *
++u8_check (const uint8_t *s, size_t n)
++{
++ const uint8_t *s_end = s + n;
++
++ while (s < s_end)
++ {
++ /* Keep in sync with unistr.h and u8-mbtouc-aux.c. */
++ uint8_t c = *s;
++
++ if (c < 0x80)
++ {
++ s++;
++ continue;
++ }
++ if (c >= 0xc2)
++ {
++ if (c < 0xe0)
++ {
++ if (s + 2 <= s_end
++ && (s[1] ^ 0x80) < 0x40)
++ {
++ s += 2;
++ continue;
++ }
++ }
++ else if (c < 0xf0)
++ {
++ if (s + 3 <= s_end
++ && (s[1] ^ 0x80) < 0x40 && (s[2] ^ 0x80) < 0x40
++ && (c >= 0xe1 || s[1] >= 0xa0)
++ && (c != 0xed || s[1] < 0xa0))
++ {
++ s += 3;
++ continue;
++ }
++ }
++ else if (c < 0xf8)
++ {
++ if (s + 4 <= s_end
++ && (s[1] ^ 0x80) < 0x40 && (s[2] ^ 0x80) < 0x40
++ && (s[3] ^ 0x80) < 0x40
++ && (c >= 0xf1 || s[1] >= 0x90)
++#if 1
++ && (c < 0xf4 || (c == 0xf4 && s[1] < 0x90))
++#endif
++ )
++ {
++ s += 4;
++ continue;
++ }
++ }
++#if 0
++ else if (c < 0xfc)
++ {
++ if (s + 5 <= s_end
++ && (s[1] ^ 0x80) < 0x40 && (s[2] ^ 0x80) < 0x40
++ && (s[3] ^ 0x80) < 0x40 && (s[4] ^ 0x80) < 0x40
++ && (c >= 0xf9 || s[1] >= 0x88))
++ {
++ s += 5;
++ continue;
++ }
++ }
++ else if (c < 0xfe)
++ {
++ if (s + 6 <= s_end
++ && (s[1] ^ 0x80) < 0x40 && (s[2] ^ 0x80) < 0x40
++ && (s[3] ^ 0x80) < 0x40 && (s[4] ^ 0x80) < 0x40
++ && (s[5] ^ 0x80) < 0x40
++ && (c >= 0xfd || s[1] >= 0x84))
++ {
++ s += 6;
++ continue;
++ }
++ }
++#endif
++ }
++ /* invalid or incomplete multibyte character */
++ return s;
++ }
++ return NULL;
++}
+--- a/lib/gltests/Makefile.am
++++ b/lib/gltests/Makefile.am
+@@ -804,6 +804,16 @@
+
+ ## end gnulib module unistd-tests
+
++## begin gnulib module unistr/u8-check-tests
++
++TESTS += test-u8-check
++check_PROGRAMS += test-u8-check
++test_u8_check_SOURCES = unistr/test-u8-check.c
++test_u8_check_LDADD = $(LDADD) $(LIBUNISTRING)
++EXTRA_DIST += unistr/test-u8-check.c macros.h
++
++## end gnulib module unistr/u8-check-tests
++
+ ## begin gnulib module unistr/u8-mbtoucr-tests
+
+ TESTS += test-u8-mbtoucr
+--- /dev/null
++++ b/lib/gltests/unistr/test-u8-check.c
+@@ -0,0 +1,188 @@
++/* Test of u8_check() function.
++ Copyright (C) 2010-2015 Free Software Foundation, Inc.
++
++ This program is free software: you can redistribute it and/or modify
++ it under the terms of the GNU General Public License as published by
++ the Free Software Foundation; either version 3 of the License, or
++ (at your option) any later version.
++
++ This program is distributed in the hope that it will be useful,
++ but WITHOUT ANY WARRANTY; without even the implied warranty of
++ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
++ GNU General Public License for more details.
++
++ You should have received a copy of the GNU General Public License
++ along with this program. If not, see . */
++
++/* Written by Bruno Haible , 2010. */
++
++#include
++
++#include "unistr.h"
++
++#include "macros.h"
++
++int
++main ()
++{
++ /* Test empty string. */
++ {
++ static const uint8_t input[] = "";
++ ASSERT (u8_check (input, 0) == NULL);
++ }
++
++ /* Test valid non-empty string. */
++ {
++ static const uint8_t input[] = /* "Данило Шеган" */
++ "\320\224\320\260\320\275\320\270\320\273\320\276 \320\250\320\265\320\263\320\260\320\275";
++ ASSERT (u8_check (input, sizeof (input) - 1) == NULL);
++ }
++
++ /* Test out-of-range character with 4 bytes: U+110000. */
++ {
++ static const uint8_t input[] = "\320\224\320\260\364\220\200\200";
++ ASSERT (u8_check (input, sizeof (input) - 1) == input + 4);
++ }
++
++ /* Test out-of-range character with 5 bytes: U+200000. */
++ {
++ static const uint8_t input[] = "\320\224\320\260\370\210\200\200\200";
++ ASSERT (u8_check (input, sizeof (input) - 1) == input + 4);
++ }
++
++ /* Test out-of-range character with 6 bytes: U+4000000. */
++ {
++ static const uint8_t input[] = "\320\224\320\260\374\204\200\200\200\200";
++ ASSERT (u8_check (input, sizeof (input) - 1) == input + 4);
++ }
++
++ /* Test invalid lead byte. */
++ {
++ static const uint8_t input[] = "\320\224\320\260\376\200\200\200\200\200";
++ ASSERT (u8_check (input, sizeof (input) - 1) == input + 4);
++ }
++ {
++ static const uint8_t input[] = "\320\224\320\260\377\200\200\200\200\200";
++ ASSERT (u8_check (input, sizeof (input) - 1) == input + 4);
++ }
++
++ /* Test overlong 2-byte character. */
++ {
++ static const uint8_t input[] = "\320\224\320\260\301\200";
++ ASSERT (u8_check (input, sizeof (input) - 1) == input + 4);
++ }
++
++ /* Test overlong 3-byte character. */
++ {
++ static const uint8_t input[] = "\320\224\320\260\340\200\277";
++ ASSERT (u8_check (input, sizeof (input) - 1) == input + 4);
++ }
++
++ /* Test overlong 4-byte character. */
++ {
++ static const uint8_t input[] = "\320\224\320\260\360\200\277\277";
++ ASSERT (u8_check (input, sizeof (input) - 1) == input + 4);
++ }
++
++ /* Test invalid bytes in 2-byte character. */
++ {
++ static const uint8_t input[] = "\320\224\320\260\302\200";
++ ASSERT (u8_check (input, sizeof (input) - 1) == NULL);
++ }
++ {
++ static const uint8_t input[] = "\320\224\320\260\302\100";
++ ASSERT (u8_check (input, sizeof (input) - 1) == input + 4);
++ }
++ {
++ static const uint8_t input[] = "\320\224\320\260\302\300";
++ ASSERT (u8_check (input, sizeof (input) - 1) == input + 4);
++ }
++
++ /* Test invalid bytes in 3-byte character. */
++ {
++ static const uint8_t input[] = "\320\224\320\260\342\200\200";
++ ASSERT (u8_check (input, sizeof (input) - 1) == NULL);
++ }
++ {
++ static const uint8_t input[] = "\320\224\320\260\342\100\200";
++ ASSERT (u8_check (input, sizeof (input) - 1) == input + 4);
++ }
++ {
++ static const uint8_t input[] = "\320\224\320\260\342\300\200";
++ ASSERT (u8_check (input, sizeof (input) - 1) == input + 4);
++ }
++ {
++ static const uint8_t input[] = "\320\224\320\260\342\200\100";
++ ASSERT (u8_check (input, sizeof (input) - 1) == input + 4);
++ }
++ {
++ static const uint8_t input[] = "\320\224\320\260\342\200\300";
++ ASSERT (u8_check (input, sizeof (input) - 1) == input + 4);
++ }
++
++ /* Test invalid bytes in 4-byte character. */
++ {
++ static const uint8_t input[] = "\320\224\320\260\362\200\200\200";
++ ASSERT (u8_check (input, sizeof (input) - 1) == NULL);
++ }
++ {
++ static const uint8_t input[] = "\320\224\320\260\362\100\200\200";
++ ASSERT (u8_check (input, sizeof (input) - 1) == input + 4);
++ }
++ {
++ static const uint8_t input[] = "\320\224\320\260\362\300\200\200";
++ ASSERT (u8_check (input, sizeof (input) - 1) == input + 4);
++ }
++ {
++ static const uint8_t input[] = "\320\224\320\260\362\200\100\200";
++ ASSERT (u8_check (input, sizeof (input) - 1) == input + 4);
++ }
++ {
++ static const uint8_t input[] = "\320\224\320\260\362\200\300\200";
++ ASSERT (u8_check (input, sizeof (input) - 1) == input + 4);
++ }
++ {
++ static const uint8_t input[] = "\320\224\320\260\362\200\200\100";
++ ASSERT (u8_check (input, sizeof (input) - 1) == input + 4);
++ }
++ {
++ static const uint8_t input[] = "\320\224\320\260\362\200\200\300";
++ ASSERT (u8_check (input, sizeof (input) - 1) == input + 4);
++ }
++
++ /* Test truncated/incomplete 2-byte character. */
++ {
++ static const uint8_t input[] = "\320\224\320\260\302";
++ ASSERT (u8_check (input, sizeof (input) - 1) == input + 4);
++ }
++
++ /* Test truncated/incomplete 3-byte character. */
++ {
++ static const uint8_t input[] = "\320\224\320\260\342\200";
++ ASSERT (u8_check (input, sizeof (input) - 1) == input + 4);
++ }
++
++ /* Test truncated/incomplete 4-byte character. */
++ {
++ static const uint8_t input[] = "\320\224\320\260\362\200\200";
++ ASSERT (u8_check (input, sizeof (input) - 1) == input + 4);
++ }
++
++ /* Test missing lead byte. */
++ {
++ static const uint8_t input[] = "\320\224\320\260\200\200\200\200\200";
++ ASSERT (u8_check (input, sizeof (input) - 1) == input + 4);
++ }
++
++ /* Test surrogate codepoints. */
++ {
++ static const uint8_t input[] = "\320\224\320\260\355\240\200\355\260\200";
++ ASSERT (u8_check (input, sizeof (input) - 1) == input + 4);
++ }
++ {
++ static const uint8_t input[] = "\320\224\320\260\355\260\200";
++ ASSERT (u8_check (input, sizeof (input) - 1) == input + 4);
++ }
++
++ return 0;
++}
+--- a/lib/nfkc.c
++++ b/lib/nfkc.c
+@@ -1002,6 +1002,8 @@
+ return g_unichar_to_utf8 (c, outbuf);
+ }
+
++#include
++
+ /**
+ * stringprep_utf8_to_ucs4:
+ * @str: a UTF-8 encoded string
+@@ -1010,9 +1012,10 @@
+ * @items_written: location to store the number of characters in the
+ * result, or %NULL.
+ *
+- * Convert a string from UTF-8 to a 32-bit fixed width
+- * representation as UCS-4, assuming valid UTF-8 input.
+- * This function does no error checking on the input.
++ * Convert a string from UTF-8 to a 32-bit fixed width representation
++ * as UCS-4. The function now performs error checking to verify that
++ * the input is valid UTF-8 (before it was documented to not do error
++ * checking).
+ *
+ * Return value: a pointer to a newly allocated UCS-4 string.
+ * This value must be deallocated by the caller.
+@@ -1020,6 +1023,16 @@
+ uint32_t *
+ stringprep_utf8_to_ucs4 (const char *str, ssize_t len, size_t * items_written)
+ {
++ size_t n;
++
++ if (len < 0)
++ n = strlen (str);
++ else
++ n = len;
++
++ if (u8_check ((const uint8_t *) str, n))
++ return NULL;
++
+ return g_utf8_to_ucs4_fast (str, (glong) len, (glong *) items_written);
+ }
+
+--- a/lib/strerror-idna.c
++++ b/lib/strerror-idna.c
+@@ -115,7 +115,7 @@
+ break;
+
+ case IDNA_ICONV_ERROR:
+- p = _("System iconv failed");
++ p = _("Could not convert string in locale encoding");
+ break;
+
+ case IDNA_MALLOC_ERROR:
+--- a/lib/strerror-stringprep.c
++++ b/lib/strerror-stringprep.c
+@@ -65,6 +65,7 @@
+ * This usually indicate a problem in the calling application.
+ * STRINGPREP_UNKNOWN_PROFILE: The supplied profile name was not
+ * known to the library.
++ * STRINGPREP_ICONV_ERROR: Could not convert string in locale encoding.
+ * STRINGPREP_NFKC_FAILED: The Unicode NFKC operation failed. This
+ * usually indicate an internal error in the library.
+ * STRINGPREP_MALLOC_ERROR: The malloc() was out of memory. This is
+@@ -121,6 +122,9 @@
+ case STRINGPREP_UNKNOWN_PROFILE:
+ p = _("Unknown profile");
+ break;
++ case STRINGPREP_ICONV_ERROR:
++ p = _("Could not convert string in locale encoding.");
++ break;
+
+ case STRINGPREP_NFKC_FAILED:
+ p = _("Unicode normalization failed (internal error)");
+--- a/lib/stringprep.c
++++ b/lib/stringprep.c
+@@ -380,6 +380,8 @@
+
+ free (ucs4);
+ ucs4 = stringprep_utf8_to_ucs4 (in, -1, &ucs4len);
++ if (ucs4 == NULL)
++ return STRINGPREP_ICONV_ERROR;
+ maxucs4len = ucs4len + adducs4len;
+ newp = realloc (ucs4, maxucs4len * sizeof (uint32_t));
+ if (!newp)
+@@ -402,7 +404,7 @@
+ utf8 = stringprep_ucs4_to_utf8 (ucs4, ucs4len, 0, 0);
+ free (ucs4);
+ if (!utf8)
+- return STRINGPREP_MALLOC_ERROR;
++ return STRINGPREP_ICONV_ERROR;
+
+ if (strlen (utf8) >= maxlen)
+ {
+@@ -590,6 +592,7 @@
+ * This usually indicate a problem in the calling application.
+ * @STRINGPREP_UNKNOWN_PROFILE: The supplied profile name was not
+ * known to the library.
++ * @STRINGPREP_ICONV_ERROR: Could not convert string in locale encoding.
+ * @STRINGPREP_NFKC_FAILED: The Unicode NFKC operation failed. This
+ * usually indicate an internal error in the library.
+ * @STRINGPREP_MALLOC_ERROR: The malloc() was out of memory. This is
+--- a/lib/stringprep.h
++++ b/lib/stringprep.h
+@@ -68,6 +68,7 @@
+ STRINGPREP_PROFILE_ERROR = 101,
+ STRINGPREP_FLAG_ERROR = 102,
+ STRINGPREP_UNKNOWN_PROFILE = 103,
++ STRINGPREP_ICONV_ERROR = 104,
+ /* Internal errors. */
+ STRINGPREP_NFKC_FAILED = 200,
+ STRINGPREP_MALLOC_ERROR = 201
+--- a/tests/Makefile.am
++++ b/tests/Makefile.am
+@@ -27,7 +27,7 @@
+
+ ctests = tst_stringprep tst_punycode tst_idna tst_idna2 tst_idna3 \
+ tst_idna4 tst_nfkc tst_pr29 tst_strerror tst_toutf8 \
+- tst_symbols
++ tst_symbols tst_badutf8
+ if TLD
+ ctests += tst_tld
+ endif
+--- /dev/null
++++ b/tests/tst_badutf8.c
+@@ -0,0 +1,50 @@
++/* tst_badutf8.c --- Self tests for malformed UTF-8 regressions.
++ * Copyright (C) 2015 Simon Josefsson
++ *
++ * This file is part of GNU Libidn.
++ *
++ * This program is free software: you can redistribute it and/or modify
++ * it under the terms of the GNU General Public License as published by
++ * the Free Software Foundation, either version 3 of the License, or
++ * (at your option) any later version.
++ *
++ * This program is distributed in the hope that it will be useful,
++ * but WITHOUT ANY WARRANTY; without even the implied warranty of
++ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
++ * GNU General Public License for more details.
++ *
++ * You should have received a copy of the GNU General Public License
++ * along with this program. If not, see .
++ *
++ */
++
++#ifdef HAVE_CONFIG_H
++# include "config.h"
++#endif
++
++#include
++#include
++#include
++#include
++
++#include
++#include
++
++#include "utils.h"
++
++void
++doit (void)
++{
++ char *badutf8 = strdup ("\x7e\x64\x61\x72\x10\x2f\x2f\xf9\x2b\x71"
++ "\x60\x79\x7b\x2e\x63\x75\x2b\x61\x65\x72"
++ "\x75\x65\x56\x66\x7f\x62\xc5\x76\xe5\x00");
++ char *s = NULL;
++ int rc;
++
++ rc = idna_to_ascii_8z (badutf8, &s, 0);
++ free (badutf8);
++ if (rc != IDNA_ICONV_ERROR)
++ fail ("rc %d\n", rc);
++
++ idn_free (s);
++}
+--- a/tests/tst_stringprep.c
++++ b/tests/tst_stringprep.c
+@@ -100,7 +100,8 @@
+ "\xF4\x8F\xBF\xBF", NULL, "Nameprep", 0,
+ STRINGPREP_CONTAINS_PROHIBITED},
+ {"Surrogate code U+DF42",
+- "\xED\xBD\x82", NULL, "Nameprep", 0, STRINGPREP_CONTAINS_PROHIBITED},
++ "\xED\xBD\x82", NULL, "Nameprep", 0, STRINGPREP_ICONV_ERROR
++ /* was STRINGPREP_CONTAINS_PROHIBITED */},
+ {"Non-plain text character U+FFFD",
+ "\xEF\xBF\xBD", NULL, "Nameprep", 0, STRINGPREP_CONTAINS_PROHIBITED},
+ {"Ideographic description character U+2FF5",
+@@ -234,15 +235,22 @@
+ hexprint (strprep[i].in, strlen (strprep[i].in));
+ binprint (strprep[i].in, strlen (strprep[i].in));
+ }
+-
+ {
+ uint32_t *l;
+- char *x;
++ char *x = NULL;
+ l = stringprep_utf8_to_ucs4 (strprep[i].in, -1, NULL);
+- x = stringprep_ucs4_to_utf8 (l, -1, NULL, NULL);
++ if (l)
++ x = stringprep_ucs4_to_utf8 (l, -1, NULL, NULL);
+ free (l);
+-
+- if (strcmp (strprep[i].in, x) != 0)
++ if (i == 29)
++ /* Ignoring known bad UTF-8 in entry 29 */
++ continue;
++ else if (l == NULL)
++ {
++ fail ("bad UTF-8 in entry %ld\n", i);
++ continue;
++ }
++ else if (strcmp (strprep[i].in, x) != 0)
+ {
+ fail ("bad UTF-8 in entry %ld\n", i);
+ if (debug)
+@@ -254,10 +262,12 @@
+ escapeprint (x, strlen (x));
+ hexprint (x, strlen (x));
+ }
++ continue;
+ }
+
+ free (x);
+ }
++
+ rc = stringprep_profile (strprep[i].in, &p,
+ strprep[i].profile ?
+ strprep[i].profile :
diff -Nru libidn-1.29/debian/patches/series libidn-1.29/debian/patches/series
--- libidn-1.29/debian/patches/series 1970-01-01 01:00:00.000000000 +0100
+++ libidn-1.29/debian/patches/series 2015-07-18 18:10:47.000000000 +0200
@@ -0,0 +1 @@
+01_CVE-2015-2059.patch