Subject: Re: bug#72245: [PATCH] Fix integer overflow when reading XPM

From: Eli Zaretskii <[email-masked]>
Date: Tue, 23 Jul 2024 18:33:41 +0300

> Cc: [email-masked]
> From: Stefan Kangas <[email-masked]>
> Date: Tue, 23 Jul 2024 07:51:29 -0700
> 
> That said, since you are asking, we are indeed discussing security
> sensitive code, that is executed without prompting, for example, when
> users receive emails or browse the web.

Only in some MUAs, yes?  For example, Rmail doesn't by default show
the images (or any other attachments), it requires a user action to do
so.

> XPM being a relatively simple format, I'm sure that this code can be
> fully audited.  I invite you to do so, and I'm hoping that this will
> reveal that your faith in this code is well-founded.  Meanwhile, I
> reported an unrelated crash in XPM image processing in Bug#72255.

That file doesn't cause a crash on MS-Windows, FWIW, but the code
which processes XPM images in Emacs on Windows is very different.