* src/image.c (svg_load_image): Fix off-by-one mistake (bug#80851).

Origin: upstream, commit: 8f535370b9efbc91673b20c6987a5cae4f6dc562
Added-by: Rob Browning <rlb@defaultvalue.org>
Bug: https://debbugs.gnu.org/80851
Bug-Debian: https://bugs.debian.org/1134692
README-Debian: An SVG-related security vulnerability has been fixed (CVE-2026-6861)
 This vulnerability, a memory corruption issue, could occur when Emacs
 processed specially crafted SVG (Scalable Vector Graphics)
 CSS (Cascading Style Sheets) data. A local user could exploit this by
 convincing a victim to open a malicious SVG file, which might lead to a
 denial of service (DoS) or potentially information disclosure.

Gbp-Pq: Name 0023-src-image.c-svg_load_image-Fix-off-by-one-mistake-bu.patch

diff --git a/src/image.c b/src/image.c
index b5b7de3351ff3ba980993afc3ce7651895a0493a..d98c63f06c649218cdd16b3cc218ef888909c261 100644 (file)
--- a/src/image.c
+++ b/src/image.c
@@ -12052,7 +12052,7 @@ svg_load_image (struct frame *f, struct image *img, char *contents,
     {
       css = xmalloc (SBYTES (lcss) + 1);
       strncpy (css, SSDATA (lcss), SBYTES (lcss));
-      *(css + SBYTES (lcss) + 1) = 0;
+      *(css + SBYTES (lcss)) = 0;
     }
 #endif