[rpms/emacs] rawhide: Prevent arbitrary code execution in flymake (rhbz#2537390).

[rpms/emacs] rawhide: Prevent arbitrary code execution in flymake (rhbz#2537390).

[Peter Oliver]

A new commit has been pushed.

Repo   : rpms/emacs
Branch : rawhide
Commit : 78cdbd0007dbdb50e810cb1c4d60bb8f5da084f4
Author : Peter Oliver <git@mavit.org.uk>
Date   : 2026-09-23T13:02:32+01:00
Stats  : +60/-0 in 2 file(s)
URL    : https://src.fedoraproject.org/rpms/emacs/c/78cdbd0007dbdb50e810cb1c4d60bb8f5da084f4?branch=rawhide

Log:
Prevent arbitrary code execution in flymake (rhbz#2537390).

---
diff --git a/0001-flymake.el-Generalize-trusted-content-p-check-to-all.patch b/0001-flymake.el-Generalize-trusted-content-p-check-to-all.patch
new file mode 100644
index 0000000..296afd1
--- /dev/null
+++ b/0001-flymake.el-Generalize-trusted-content-p-check-to-all.patch
@@ -0,0 +1,56 @@
+From abc802ee2eb0b1663349ddf22a461f8e54a383fb Mon Sep 17 00:00:00 2001
+From: Stefan Monnier <monnier@iro.umontreal.ca>
+Date: Mon, 14 Sep 2026 11:30:39 +0100
+Subject: [PATCH] flymake.el: Generalize trusted-content-p check to all
+ backends
+
+Minimal safe backport of this change:
+
+    Author:     Stefan Monnier <monnier@iro.umontreal.ca>
+    AuthorDate: Fri Sep 11 21:48:55 2026 -0400
+
+      flymake.el: Generalize trusted-content-p check to all backends
+
+      Rather than have each and every backend check
+      'trusted-content-p' if it feels necessary, implement the check
+      once and forall in flymake.el and provide a wat for backends to
+      skip that test, so we replace an "opt-in" with an "opt-out"
+      that's a bit more secure by design.
+
+      * lisp/progmodes/elisp-mode.el (elisp-flymake-byte-compile):
+      Move 'trusted-content-p' to flymake.el.
+      * lisp/progmodes/flymake.el (flymake--run-backend):
+      Move 'trusted-content-p' from elisp-mode.el.
+
+      * lisp/progmodes/eglot.el (eglot-flymake-backend): Mark as safe.
+
+* lisp/progmodes/flymake.el (flymake--run-backend): Copy
+trusted-content-p check from elisp-mode.el.  Do not merge to
+master.
+---
+ lisp/progmodes/flymake.el | 9 +++++++--
+ 1 file changed, 7 insertions(+), 2 deletions(-)
+
+diff --git a/lisp/progmodes/flymake.el b/lisp/progmodes/flymake.el
+index fff42696761..40761031dc2 100644
+--- a/lisp/progmodes/flymake.el
++++ b/lisp/progmodes/flymake.el
+@@ -1271,8 +1271,13 @@ flymake--run-backend
+             (flymake--state-disabled state) nil
+             (flymake--state-reported-p state) nil))
+     (condition-case-unless-debug err
+-        (apply backend (flymake-make-report-fn backend run-token)
+-               args)
++        (if (or (trusted-content-p) (function-get backend 'flymake-always-safe))
++            (apply backend (flymake-make-report-fn backend run-token)
++                   args)
++          (message "Disabling %S in %s (untrusted content)"
++                   backend (buffer-name))
++          (user-error "Disabling %S in %s (untrusted content)"
++                      backend (buffer-name)))
+       (error
+        (flymake--disable-backend backend err)))))
+ 
+-- 
+2.55.0
+

diff --git a/emacs.spec b/emacs.spec
index 0ca9eb6..f20148d 100644
--- a/emacs.spec
+++ b/emacs.spec
@@ -75,6 +75,10 @@ Patch:         0002-Fall-back-to-the-terminal-from-pure-GTK-when-no-disp.patch
 # https://debbugs.gnu.org/cgi/bugreport.cgi?bug=49505#67
 Patch:         0001-Don-t-specify-StartupWMClass-in-emacs.desktop.patch
 
+# Emacs arbitrary code execution: incomplete fix for CVE-2024-53920
+# https://www.openwall.com/lists/oss-security/2026/09/14/1
+Patch:         0001-flymake.el-Generalize-trusted-content-p-check-to-all.patch
+
 BuildRequires: alsa-lib-devel
 BuildRequires: atk-devel
 BuildRequires: autoconf