Avoid fork bomb caused by native compilation

Add 0010-Avoid-fork-bomb-caused-by-native-compilation.patch to fix the
problem.

Thanks to Aymeric Agon-Rambosson for help backporting the patch.

diff --cc debian/.git-dpm
index 7d5efbff19626fe14ed80d4a7272faa34a7f0f55,0000000000000000000000000000000000000000..fa9e7e9c3bf5b997e55c187dcc95c3e2f905c6f8
mode 100644,000000..100644
--- 1/debian/.git-dpm
--- /dev/null
+++ b/debian/.git-dpm
@@@ -1,8 -1,0 +1,8 @@@
- 418df9d27f2003d08641742f91870cfd0e2cb4f5
- 418df9d27f2003d08641742f91870cfd0e2cb4f5
 +# see git-dpm(1) from git-dpm package
++d2f60a22a18dfbee11eeec5b597c80705a807e7f
++d2f60a22a18dfbee11eeec5b597c80705a807e7f
 +279b82e64e15b5e2df3cb522636c6db85a8ee659
 +279b82e64e15b5e2df3cb522636c6db85a8ee659
 +emacs_28.2+1.orig.tar.xz
 +d7f49858bdec2d47110c2ed7b1d0005f157e20c3
 +26988304

diff --cc debian/patches/0010-Avoid-fork-bomb-caused-by-native-compilation.patch
index 0000000000000000000000000000000000000000,0000000000000000000000000000000000000000..72fbf8cacf08a8b97746bef9adade8d61a09d5df
new file mode 100644 (file)
--- /dev/null
--- /dev/null
+++ b/debian/patches/0010-Avoid-fork-bomb-caused-by-native-compilation.patch
@@@ -1,0 -1,0 +1,201 @@@
++From d2f60a22a18dfbee11eeec5b597c80705a807e7f Mon Sep 17 00:00:00 2001
++From: Andrea Corallo <akrl@sdf.org>
++Date: Sat, 15 Oct 2022 00:59:55 +0200
++Subject: Avoid fork bomb caused by native compilation
++
++This upstream patch has been incorporated to fix the problem:
++
++  Prevent potential native compilation infinite recursions
++
++  * lisp/emacs-lisp/comp.el (comp-no-spawn): New var.
++  (comp-subr-trampoline-install, comp-final, comp-run-async-workers)
++  (comp--native-compile): Update.
++
++Origin: upstream, commit: 1a8015b83761f27d299b1ffa45fc045bb76daf8a
++Bug-Debian: https://bugs.debian.org/1017817
++Bug-Debian: https://bugs.debian.org/1017845
++Forwarded: not-needed
++---
++ lisp/emacs-lisp/comp.el | 134 ++++++++++++++++++++--------------------
++ 1 file changed, 68 insertions(+), 66 deletions(-)
++
++diff --git a/lisp/emacs-lisp/comp.el b/lisp/emacs-lisp/comp.el
++index a5ab12ae388..dc94b907cfb 100644
++--- a/lisp/emacs-lisp/comp.el
+++++ b/lisp/emacs-lisp/comp.el
++@@ -676,6 +676,9 @@ 'native-compiler-error-empty-byte
++   'native-compiler-error)
++ \f
++ 
+++(defvar comp-no-spawn nil
+++  "Non-nil don't spawn native compilation processes.")
+++
++ ;; Moved early to avoid circularity when comp.el is loaded and
++ ;; `macroexpand' needs to be advised (bug#47049).
++ ;;;###autoload
++@@ -685,12 +688,9 @@ comp-subr-trampoline-install
++               (memq subr-name native-comp-never-optimize-functions)
++               (gethash subr-name comp-installed-trampolines-h))
++     (cl-assert (subr-primitive-p (symbol-function subr-name)))
++-    (comp--install-trampoline
++-     subr-name
++-     (or (comp-trampoline-search subr-name)
++-         (comp-trampoline-compile subr-name)
++-         ;; Should never happen.
++-         (cl-assert nil)))))
+++    (when-let ((trampoline (or (comp-trampoline-search subr-name)
+++                               (comp-trampoline-compile subr-name))))
+++      (comp--install-trampoline subr-name trampoline))))
++ 
++ \f
++ (cl-defstruct (comp-vec (:copier nil))
++@@ -3680,7 +3680,8 @@ comp-final
++              (print-circle t)
++              (print-escape-multibyte t)
++              (expr `((require 'comp)
++-                     (setf native-comp-verbose ,native-comp-verbose
+++                     (setf comp-no-spawn t
+++                           native-comp-verbose ,native-comp-verbose
++                            comp-libgccjit-reproducer ,comp-libgccjit-reproducer
++                            comp-ctxt ,comp-ctxt
++                            native-comp-eln-load-path ',native-comp-eln-load-path
++@@ -3942,6 +3943,7 @@ comp-run-async-workers
++                                  native-comp-verbose ,native-comp-verbose
++                                  comp-libgccjit-reproducer ,comp-libgccjit-reproducer
++                                  comp-async-compilation t
+++                                 comp-no-spawn t
++                                  native-comp-eln-load-path ',native-comp-eln-load-path
++                                  native-comp-compiler-options
++                                  ',native-comp-compiler-options
++@@ -4020,57 +4022,58 @@ comp--native-compile
++               (stringp function-or-file))
++     (signal 'native-compiler-error
++             (list "Not a function symbol or file" function-or-file)))
++-  (catch 'no-native-compile
++-    (let* ((data function-or-file)
++-           (comp-native-compiling t)
++-           (byte-native-qualities nil)
++-           ;; Have byte compiler signal an error when compilation fails.
++-           (byte-compile-debug t)
++-           (comp-ctxt (make-comp-ctxt :output output
++-                                      :with-late-load with-late-load)))
++-      (comp-log "\n\f\n" 1)
++-      (condition-case err
++-          (cl-loop
++-           with report = nil
++-           for t0 = (current-time)
++-           for pass in comp-passes
++-           unless (memq pass comp-disabled-passes)
++-           do
++-           (comp-log (format "(%s) Running pass %s:\n"
++-                             function-or-file pass)
++-                     2)
++-           (setf data (funcall pass data))
++-           (push (cons pass (float-time (time-since t0))) report)
++-           (cl-loop for f in (alist-get pass comp-post-pass-hooks)
++-                    do (funcall f data))
++-           finally
++-           (when comp-log-time-report
++-             (comp-log (format "Done compiling %s" data) 0)
++-             (cl-loop for (pass . time) in (reverse report)
++-                      do (comp-log (format "Pass %s took: %fs." pass time) 0))))
++-        (native-compiler-skip)
++-        (t
++-         (let ((err-val (cdr err)))
++-           ;; If we are doing an async native compilation print the
++-           ;; error in the correct format so is parsable and abort.
++-           (if (and comp-async-compilation
++-                    (not (eq (car err) 'native-compiler-error)))
++-               (progn
++-                 (message (if err-val
++-                              "%s: Error: %s %s"
++-                            "%s: Error %s")
++-                          function-or-file
++-                          (get (car err) 'error-message)
++-                          (car-safe err-val))
++-                 (kill-emacs -1))
++-             ;; Otherwise re-signal it adding the compilation input.
++-          (signal (car err) (if (consp err-val)
++-                                (cons function-or-file err-val)
++-                              (list function-or-file err-val)))))))
++-      (if (stringp function-or-file)
++-          data
++-        ;; So we return the compiled function.
++-        (native-elisp-load data)))))
+++  (unless comp-no-spawn
+++    (catch 'no-native-compile
+++      (let* ((data function-or-file)
+++             (comp-native-compiling t)
+++             (byte-native-qualities nil)
+++             ;; Have byte compiler signal an error when compilation fails.
+++             (byte-compile-debug t)
+++             (comp-ctxt (make-comp-ctxt :output output
+++                                        :with-late-load with-late-load)))
+++        (comp-log "\n\f\n" 1)
+++        (condition-case err
+++            (cl-loop
+++             with report = nil
+++             for t0 = (current-time)
+++             for pass in comp-passes
+++             unless (memq pass comp-disabled-passes)
+++             do
+++             (comp-log (format "(%s) Running pass %s:\n"
+++                               function-or-file pass)
+++                       2)
+++             (setf data (funcall pass data))
+++             (push (cons pass (float-time (time-since t0))) report)
+++             (cl-loop for f in (alist-get pass comp-post-pass-hooks)
+++                      do (funcall f data))
+++             finally
+++             (when comp-log-time-report
+++               (comp-log (format "Done compiling %s" data) 0)
+++               (cl-loop for (pass . time) in (reverse report)
+++                        do (comp-log (format "Pass %s took: %fs." pass time) 0))))
+++          (native-compiler-skip)
+++          (t
+++           (let ((err-val (cdr err)))
+++             ;; If we are doing an async native compilation print the
+++             ;; error in the correct format so is parsable and abort.
+++             (if (and comp-async-compilation
+++                      (not (eq (car err) 'native-compiler-error)))
+++                 (progn
+++                   (message (if err-val
+++                                "%s: Error: %s %s"
+++                              "%s: Error %s")
+++                            function-or-file
+++                            (get (car err) 'error-message)
+++                            (car-safe err-val))
+++                   (kill-emacs -1))
+++               ;; Otherwise re-signal it adding the compilation input.
+++            (signal (car err) (if (consp err-val)
+++                                  (cons function-or-file err-val)
+++                                (list function-or-file err-val)))))))
+++        (if (stringp function-or-file)
+++            data
+++          ;; So we return the compiled function.
+++          (native-elisp-load data))))))
++ 
++ (defun native-compile-async-skip-p (file load selector)
++   "Return non-nil if FILE's compilation should be skipped.
++@@ -4180,14 +4183,13 @@ comp-lookup-eln
++ (defun native-compile (function-or-file &optional output)
++   "Compile FUNCTION-OR-FILE into native code.
++ This is the synchronous entry-point for the Emacs Lisp native
++-compiler.
++-FUNCTION-OR-FILE is a function symbol, a form, or the filename of
++-an Emacs Lisp source file.
++-If OUTPUT is non-nil, use it as the filename for the compiled
++-object.
++-If FUNCTION-OR-FILE is a filename, return the filename of the
++-compiled object.  If FUNCTION-OR-FILE is a function symbol or a
++-form, return the compiled function."
+++compiler.  FUNCTION-OR-FILE is a function symbol, a form, or the
+++filename of an Emacs Lisp source file.  If OUTPUT is non-nil, use
+++it as the filename for the compiled object.  If FUNCTION-OR-FILE
+++is a filename, if the compilation was successful return the
+++filename of the compiled object.  If FUNCTION-OR-FILE is a
+++function symbol or a form, if the compilation was successful
+++return the compiled function."
++   (comp--native-compile function-or-file nil output))
++ 
++ ;;;###autoload

diff --cc debian/patches/series
index 3ba43a32e45609ecb2760e5f724252e322267fa3,0000000000000000000000000000000000000000..352148753c6e8668f5d7c457c6b5cc038784d628
mode 100644,000000..100644
--- 1/debian/patches/series
--- /dev/null
+++ b/debian/patches/series
@@@ -1,9 -1,0 +1,10 @@@
 +0001-Prefer-usr-share-info-emacs.patch
 +0002-Run-debian-startup-and-set-debian-emacs-flavor.patch
 +0003-Remove-files-that-appear-to-be-incompatible-with-the.patch
 +0004-Adjust-documentation-references-for-Debian.patch
 +0005-Modify-the-output-of-version-to-indicate-Debian-modi.patch
 +0006-Don-t-try-to-build-src-macuvs.h-via-IVD_Sequences.tx.patch
 +0007-Kill-gpg-agent-in-package-test.el-to-avoid-a-race.patch
 +0008-Mark-vc-bzr-test-fauilt-bzr-autoloads-as-unstable-fo.patch
 +0009-pdumper-set-DUMP_RELOC_ALIGNMENT_BITS-1-for-m68k.patch
++0010-Avoid-fork-bomb-caused-by-native-compilation.patch