From df007cb127bee7e5c67118cc02cefad9fcdeba6a Mon Sep 17 00:00:00 2001 From: Eli Zaretskii Date: Sat, 18 Apr 2026 10:35:05 +0300 Subject: [PATCH] * src/image.c (svg_load_image): Fix off-by-one mistake (bug#80851). Origin: upstream, commit: 8f535370b9efbc91673b20c6987a5cae4f6dc562 Added-by: Rob Browning Bug: https://debbugs.gnu.org/80851 Bug-Debian: https://bugs.debian.org/1134692 README-Debian: An SVG-related security vulnerability has been fixed (CVE-2026-6861) This vulnerability, a memory corruption issue, could occur when Emacs processed specially crafted SVG (Scalable Vector Graphics) CSS (Cascading Style Sheets) data. A local user could exploit this by convincing a victim to open a malicious SVG file, which might lead to a denial of service (DoS) or potentially information disclosure. Gbp-Pq: Name 0023-src-image.c-svg_load_image-Fix-off-by-one-mistake-bu.patch --- src/image.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/image.c b/src/image.c index b5b7de3351f..d98c63f06c6 100644 --- a/src/image.c +++ b/src/image.c @@ -12052,7 +12052,7 @@ svg_load_image (struct frame *f, struct image *img, char *contents, { css = xmalloc (SBYTES (lcss) + 1); strncpy (css, SSDATA (lcss), SBYTES (lcss)); - *(css + SBYTES (lcss) + 1) = 0; + *(css + SBYTES (lcss)) = 0; } #endif -- 2.30.2