Subject: Re: bug#72245: [PATCH] Fix integer overflow when reading XPM

From: Stefan Kangas <[email-masked]>
Date: Tue, 23 Jul 2024 14:39:42 -0700

Eli Zaretskii <[email-masked]> writes:

>> Cc: [email-masked]
>> From: Stefan Kangas <[email-masked]>
>> Date: Tue, 23 Jul 2024 07:51:29 -0700
>>
>> That said, since you are asking, we are indeed discussing security
>> sensitive code, that is executed without prompting, for example, when
>> users receive emails or browse the web.
>
> Only in some MUAs, yes?  For example, Rmail doesn't by default show
> the images (or any other attachments), it requires a user action to do
> so.

Yes, and it's presumably also dependent on user options.

I'd hope that most MUAs disable showing images by default (notmuch
does), but I didn't check.