[Midnightbsd-cvs] [MidnightBSD/mports] b0f1f5: editors/emacs: fix CVE-2026-6861 (SVG stylesheet h...

[Lucas Holt]

  Branch: refs/heads/master
  Home:   https://github.com/MidnightBSD/mports
  Commit: b0f1f5fc8dc12b76c14168b0f7384ef4abf01def
      https://github.com/MidnightBSD/mports/commit/b0f1f5fc8dc12b76c14168b0f7384ef4abf01def
  Author: Lucas Holt <luke at foolishgames.com>
  Date:   2026-08-21 (Fri, 21 Aug 2026)

  Changed paths:
    M editors/emacs/Makefile
    A editors/emacs/files/patch-src_image.c

  Log Message:
  -----------
  editors/emacs: fix CVE-2026-6861 (SVG stylesheet heap overflow) (#757)

## Summary

`svg_load_image()` in `src/image.c` writes its NUL terminator one byte
past the end of the buffer allocated for an SVG's inline stylesheet
data:

```c
css = xmalloc (SBYTES (lcss) + 1);
strncpy (css, SSDATA (lcss), SBYTES (lcss));
*(css + SBYTES (lcss) + 1) = 0;   /* one past the allocation */
```

Opening a crafted SVG corrupts the heap, which can crash Emacs or
disclose adjacent memory.

- **CVE-2026-6861** — affects 28.1 through 30.2 inclusive
- Only reachable when built with SVG support (librsvg), which is on by
default via `OPTIONS_DEFAULT`
- Upstream bug: https://debbugs.gnu.org/cgi/bugreport.cgi?bug=80851
- Obtained from: FreeBSD ports
[`915d199e510d`](https://cgit.freebsd.org/ports/commit/?id=915d199e510d)

There is no fixed stable release upstream — `ftp.gnu.org/gnu/emacs/`
still tops out at 30.2, so the fix is carried as a port patch rather
than a version bump.

## Changes

- Add `files/patch-src_image.c`
- Bump `PORTREVISION` 5 → 6

## Testing

- Confirmed the unpatched line is present verbatim in the 30.2 distfile
- `bmake patch` applies cleanly; result verified in `WRKSRC/src/image.c`
- `src/image.c` compiles without errors and `src/emacs` links, with
librsvg SVG support enabled

`portlint` reports 3 fatal + 2 warnings, all pre-existing and unrelated
to this change (the `COMMENT_nox`/`COMMENT_canna`/`COMMENT_wayland`
placement complaints are present in FreeBSD's port too).

## Not included

- The FreeBSD tree-sitter 0.26+ backport — mports `devel/tree-sitter` is
0.25.5, so it is inapplicable
- The 31.0.91/31.1-rc1 pretest bump — those are pretest/RC, not stable
releases

🤖 Generated with [Claude Code](https://claude.com/claude-code)

## Summary by Sourcery

Patch Emacs 30.2 to prevent heap corruption when loading crafted SVG
images.

Bug Fixes:
- Fix the SVG inline stylesheet heap overflow in Emacs by correcting the
NUL terminator placement.

Chores:
- Bump the Emacs port revision to include the security fix.

Signed-off-by: Lucas Holt <luke at foolishgames.com>



To unsubscribe from these emails, change your notification settings at https://github.com/MidnightBSD/mports/settings/notifications