[rpms/emacs] f44: Fix CVE-2026-77219: Integer overflow in PBM/PPM/PGM image loader (rhbz#2523273)

[Peter Oliver <git@mavit.org.uk>]

A new commit has been pushed.

Repo   : rpms/emacs
Branch : f44
Commit : 477015b3dd86d46f02d3d3b24753c6e1ab2de8d6
Author : Peter Oliver <git@mavit.org.uk>
Date   : 2026-08-25T11:28:57+01:00
Stats  : +58/-0 in 2 file(s)
URL    : https://src.fedoraproject.org/rpms/emacs/c/477015b3dd86d46f02d3d3b24753c6e1ab2de8d6?branch=f44

Log:
Fix CVE-2026-77219: Integer overflow in PBM/PPM/PGM image loader (rhbz#2523273)

---
diff --git a/0001-Fix-undefined-behavior-in-pbm_load.patch b/0001-Fix-undefined-behavior-in-pbm_load.patch
new file mode 100644
index 0000000..137e4b3
--- /dev/null
+++ b/0001-Fix-undefined-behavior-in-pbm_load.patch
@@ -0,0 +1,53 @@
+From b07e634e4cf45162ae0178e32092b040587f2c6c Mon Sep 17 00:00:00 2001
+From: Paul Eggert <eggert@cs.ucla.edu>
+Date: Mon, 6 Jul 2026 13:17:17 -0700
+Subject: [PATCH] Fix undefined behavior in pbm_load
+
+int*int problem reported by Tristan Madani in:
+https://bugs.gnu.org/81344
+* src/image.c (pbm_load): Avoid undefined behavior when
+multiplying ints, or when adding pointer to int.
+---
+ src/image.c | 23 +++++++++++++----------
+ 1 file changed, 13 insertions(+), 10 deletions(-)
+
+diff --git a/src/image.c b/src/image.c
+index 9d0a620188f..e76911c3cd3 100644
+--- a/src/image.c
++++ b/src/image.c
+@@ -7774,19 +7774,22 @@ pbm_load (struct frame *f, struct image *img)
+     }
+   else
+     {
+-      int expected_size = height * width;
+       bool two_byte = 255 < max_color_idx;
+-      if (two_byte)
+-	expected_size *= 2;
+-      if (type == PBM_COLOR)
+-	expected_size *= 3;
+ 
+-      if (raw_p && p + expected_size > end)
++      if (raw_p)
+ 	{
+-	  image_destroy_x_image (ximg);
+-	  image_clear_image (f, img);
+-	  image_error ("Invalid image size in image `%s'", img->spec);
+-	  goto error;
++	  ptrdiff_t expected_size;
++	  bool bad = ckd_mul (&expected_size, height, width);
++	  bad |= ckd_mul (&expected_size, expected_size,
++			  (two_byte ? 2 : 1) * (type == PBM_COLOR ? 3 : 1));
++	  bad |= end - p < expected_size;
++	  if (bad)
++	    {
++	      image_destroy_x_image (ximg);
++	      image_clear_image (f, img);
++	      image_error ("Invalid image size in image `%s'", img->spec);
++	      goto error;
++	    }
+ 	}
+ 
+       for (y = 0; y < height; ++y)
+-- 
+2.55.0
+

diff --git a/emacs.spec b/emacs.spec
index c62ad23..e7579f0 100644
--- a/emacs.spec
+++ b/emacs.spec
@@ -66,6 +66,11 @@ Patch:         0001-src-image.c-svg_load_image-Fix-off-by-one-mistake-bu.patch
 # https://debbugs.gnu.org/cgi/bugreport.cgi?bug=80574#227
 Patch:         0001-Mitigate-arbitrary-code-execution-vulnerability.patch
 
+# CVE-2026-77219
+# https://debbugs.gnu.org/cgi/bugreport.cgi?bug=81344
+# https://bugzilla.redhat.com/show_bug.cgi?id=2523273
+Patch:         0001-Fix-undefined-behavior-in-pbm_load.patch
+
 BuildRequires: alsa-lib-devel
 BuildRequires: atk-devel
 BuildRequires: autoconf