From: Eli Zaretskii <eliz@gnu.org>
Date: Sat, 18 Apr 2026 07:35:05 +0000 (+0300)
Subject: * src/image.c (svg_load_image): Fix off-by-one mistake (bug#80851).
X-Git-Tag: archive/raspbian/1%30.1+1-6+rpi1+deb13u1^2~4
X-Git-Url: https://dgit.raspbian.org/?a=commitdiff_plain;h=df007cb127bee7e5c67118cc02cefad9fcdeba6a;p=emacs.git

* src/image.c (svg_load_image): Fix off-by-one mistake (bug#80851).

Origin: upstream, commit: 8f535370b9efbc91673b20c6987a5cae4f6dc562
Added-by: Rob Browning <rlb@defaultvalue.org>
Bug: https://debbugs.gnu.org/80851
Bug-Debian: https://bugs.debian.org/1134692
README-Debian: An SVG-related security vulnerability has been fixed (CVE-2026-6861)
 This vulnerability, a memory corruption issue, could occur when Emacs
 processed specially crafted SVG (Scalable Vector Graphics)
 CSS (Cascading Style Sheets) data. A local user could exploit this by
 convincing a victim to open a malicious SVG file, which might lead to a
 denial of service (DoS) or potentially information disclosure.

Gbp-Pq: Name 0023-src-image.c-svg_load_image-Fix-off-by-one-mistake-bu.patch
---

diff --git a/src/image.c b/src/image.c
index b5b7de3351f..d98c63f06c6 100644
--- a/src/image.c
+++ b/src/image.c
@@ -12052,7 +12052,7 @@ svg_load_image (struct frame *f, struct image *img, char *contents,
     {
       css = xmalloc (SBYTES (lcss) + 1);
       strncpy (css, SSDATA (lcss), SBYTES (lcss));
-      *(css + SBYTES (lcss) + 1) = 0;
+      *(css + SBYTES (lcss)) = 0;
     }
 #endif