From mboxrd@z Thu Jan 1 00:00:00 1970 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: base64 From: Peter Oliver To: git-commits@fedoraproject.org Subject: [rpms/emacs] f44: Fix CVE-2026-77219: Integer overflow in PBM/PPM/PGM image loader (rhbz#2523273) Date: Tue, 25 Aug 2026 10:32:46 GMT Message-ID: <178765396676.1.7225678184932973330.rpms-emacs-477015b3dd86@fedoraproject.org> List-ID: X-Git-Repo: rpms/emacs X-Git-Branch: f44 X-Git-Rev: 477015b3dd86d46f02d3d3b24753c6e1ab2de8d6 QSBuZXcgY29tbWl0IGhhcyBiZWVuIHB1c2hlZC4KClJlcG8gICA6IHJwbXMvZW1hY3MKQnJhbmNo IDogZjQ0CkNvbW1pdCA6IDQ3NzAxNWIzZGQ4NmQ0NmYwMmQzZDNiMjQ3NTNjNmUxYWIyZGU4ZDYK QXV0aG9yIDogUGV0ZXIgT2xpdmVyIDxnaXRAbWF2aXQub3JnLnVrPgpEYXRlICAgOiAyMDI2LTA4 LTI1VDExOjI4OjU3KzAxOjAwClN0YXRzICA6ICs1OC8tMCBpbiAyIGZpbGUocykKVVJMICAgIDog aHR0cHM6Ly9zcmMuZmVkb3JhcHJvamVjdC5vcmcvcnBtcy9lbWFjcy9jLzQ3NzAxNWIzZGQ4NmQ0 NmYwMmQzZDNiMjQ3NTNjNmUxYWIyZGU4ZDY/YnJhbmNoPWY0NAoKTG9nOgpGaXggQ1ZFLTIwMjYt NzcyMTk6IEludGVnZXIgb3ZlcmZsb3cgaW4gUEJNL1BQTS9QR00gaW1hZ2UgbG9hZGVyIChyaGJ6 IzI1MjMyNzMpCgotLS0KZGlmZiAtLWdpdCBhLzAwMDEtRml4LXVuZGVmaW5lZC1iZWhhdmlvci1p bi1wYm1fbG9hZC5wYXRjaCBiLzAwMDEtRml4LXVuZGVmaW5lZC1iZWhhdmlvci1pbi1wYm1fbG9h ZC5wYXRjaApuZXcgZmlsZSBtb2RlIDEwMDY0NAppbmRleCAwMDAwMDAwLi4xMzdlNGIzCi0tLSAv ZGV2L251bGwKKysrIGIvMDAwMS1GaXgtdW5kZWZpbmVkLWJlaGF2aW9yLWluLXBibV9sb2FkLnBh dGNoCkBAIC0wLDAgKzEsNTMgQEAKK0Zyb20gYjA3ZTYzNGU0Y2Y0NTE2MmFlMDE3OGUzMjA5MmIw NDA1ODdmMmM2YyBNb24gU2VwIDE3IDAwOjAwOjAwIDIwMDEKK0Zyb206IFBhdWwgRWdnZXJ0IDxl Z2dlcnRAY3MudWNsYS5lZHU+CitEYXRlOiBNb24sIDYgSnVsIDIwMjYgMTM6MTc6MTcgLTA3MDAK K1N1YmplY3Q6IFtQQVRDSF0gRml4IHVuZGVmaW5lZCBiZWhhdmlvciBpbiBwYm1fbG9hZAorCitp bnQqaW50IHByb2JsZW0gcmVwb3J0ZWQgYnkgVHJpc3RhbiBNYWRhbmkgaW46CitodHRwczovL2J1 Z3MuZ251Lm9yZy84MTM0NAorKiBzcmMvaW1hZ2UuYyAocGJtX2xvYWQpOiBBdm9pZCB1bmRlZmlu ZWQgYmVoYXZpb3Igd2hlbgorbXVsdGlwbHlpbmcgaW50cywgb3Igd2hlbiBhZGRpbmcgcG9pbnRl ciB0byBpbnQuCistLS0KKyBzcmMvaW1hZ2UuYyB8IDIzICsrKysrKysrKysrKystLS0tLS0tLS0t CisgMSBmaWxlIGNoYW5nZWQsIDEzIGluc2VydGlvbnMoKyksIDEwIGRlbGV0aW9ucygtKQorCitk aWZmIC0tZ2l0IGEvc3JjL2ltYWdlLmMgYi9zcmMvaW1hZ2UuYworaW5kZXggOWQwYTYyMDE4OGYu LmU3NjkxMWMzY2QzIDEwMDY0NAorLS0tIGEvc3JjL2ltYWdlLmMKKysrKyBiL3NyYy9pbWFnZS5j CitAQCAtNzc3NCwxOSArNzc3NCwyMiBAQCBwYm1fbG9hZCAoc3RydWN0IGZyYW1lICpmLCBzdHJ1 Y3QgaW1hZ2UgKmltZykKKyAgICAgfQorICAgZWxzZQorICAgICB7CistICAgICAgaW50IGV4cGVj dGVkX3NpemUgPSBoZWlnaHQgKiB3aWR0aDsKKyAgICAgICBib29sIHR3b19ieXRlID0gMjU1IDwg bWF4X2NvbG9yX2lkeDsKKy0gICAgICBpZiAodHdvX2J5dGUpCistCWV4cGVjdGVkX3NpemUgKj0g MjsKKy0gICAgICBpZiAodHlwZSA9PSBQQk1fQ09MT1IpCistCWV4cGVjdGVkX3NpemUgKj0gMzsK KyAKKy0gICAgICBpZiAocmF3X3AgJiYgcCArIGV4cGVjdGVkX3NpemUgPiBlbmQpCisrICAgICAg aWYgKHJhd19wKQorIAl7CistCSAgaW1hZ2VfZGVzdHJveV94X2ltYWdlICh4aW1nKTsKKy0JICBp bWFnZV9jbGVhcl9pbWFnZSAoZiwgaW1nKTsKKy0JICBpbWFnZV9lcnJvciAoIkludmFsaWQgaW1h Z2Ugc2l6ZSBpbiBpbWFnZSBgJXMnIiwgaW1nLT5zcGVjKTsKKy0JICBnb3RvIGVycm9yOworKwkg IHB0cmRpZmZfdCBleHBlY3RlZF9zaXplOworKwkgIGJvb2wgYmFkID0gY2tkX211bCAoJmV4cGVj dGVkX3NpemUsIGhlaWdodCwgd2lkdGgpOworKwkgIGJhZCB8PSBja2RfbXVsICgmZXhwZWN0ZWRf c2l6ZSwgZXhwZWN0ZWRfc2l6ZSwKKysJCQkgICh0d29fYnl0ZSA/IDIgOiAxKSAqICh0eXBlID09 IFBCTV9DT0xPUiA/IDMgOiAxKSk7CisrCSAgYmFkIHw9IGVuZCAtIHAgPCBleHBlY3RlZF9zaXpl OworKwkgIGlmIChiYWQpCisrCSAgICB7CisrCSAgICAgIGltYWdlX2Rlc3Ryb3lfeF9pbWFnZSAo eGltZyk7CisrCSAgICAgIGltYWdlX2NsZWFyX2ltYWdlIChmLCBpbWcpOworKwkgICAgICBpbWFn ZV9lcnJvciAoIkludmFsaWQgaW1hZ2Ugc2l6ZSBpbiBpbWFnZSBgJXMnIiwgaW1nLT5zcGVjKTsK KysJICAgICAgZ290byBlcnJvcjsKKysJICAgIH0KKyAJfQorIAorICAgICAgIGZvciAoeSA9IDA7 IHkgPCBoZWlnaHQ7ICsreSkKKy0tIAorMi41NS4wCisKCmRpZmYgLS1naXQgYS9lbWFjcy5zcGVj IGIvZW1hY3Muc3BlYwppbmRleCBjNjJhZDIzLi5lNzU3OWYwIDEwMDY0NAotLS0gYS9lbWFjcy5z cGVjCisrKyBiL2VtYWNzLnNwZWMKQEAgLTY2LDYgKzY2LDExIEBAIFBhdGNoOiAgICAgICAgIDAw MDEtc3JjLWltYWdlLmMtc3ZnX2xvYWRfaW1hZ2UtRml4LW9mZi1ieS1vbmUtbWlzdGFrZS1idS5w YXRjaAogIyBodHRwczovL2RlYmJ1Z3MuZ251Lm9yZy9jZ2kvYnVncmVwb3J0LmNnaT9idWc9ODA1 NzQjMjI3CiBQYXRjaDogICAgICAgICAwMDAxLU1pdGlnYXRlLWFyYml0cmFyeS1jb2RlLWV4ZWN1 dGlvbi12dWxuZXJhYmlsaXR5LnBhdGNoCiAKKyMgQ1ZFLTIwMjYtNzcyMTkKKyMgaHR0cHM6Ly9k ZWJidWdzLmdudS5vcmcvY2dpL2J1Z3JlcG9ydC5jZ2k/YnVnPTgxMzQ0CisjIGh0dHBzOi8vYnVn emlsbGEucmVkaGF0LmNvbS9zaG93X2J1Zy5jZ2k/aWQ9MjUyMzI3MworUGF0Y2g6ICAgICAgICAg MDAwMS1GaXgtdW5kZWZpbmVkLWJlaGF2aW9yLWluLXBibV9sb2FkLnBhdGNoCisKIEJ1aWxkUmVx dWlyZXM6IGFsc2EtbGliLWRldmVsCiBCdWlsZFJlcXVpcmVzOiBhdGstZGV2ZWwKIEJ1aWxkUmVx dWlyZXM6IGF1dG9jb25mCg==