Subject: Re: bug#72255: 30.0.60; Crash on macOS with malformed XPM image file

From: Stefan Kangas <[email-masked]>
Date: Tue, 23 Jul 2024 20:51:06 -0700

Version: 30.1

Po Lu <[email-masked]> writes:

> Stefan Kangas <[email-masked]> writes:
>
>> Severity: normal
>>
>> Emacs crashes on macOS when opening a malformed XPM image file.
>>
>> I'm attaching an example image with the file extension ".xpm.txt" below;
>> to reproduce, simply rename the file to ".xpm" and open it in Emacs.
>> (This bad file is an edited version of back-arrow.xpm in emacs.git.)
>>
>> I've included an lldb backtrace below.  Note that I reproduced this on
>> master, but the code has not changed from emacs-30.
>>
>> The crash happens in nsterm.m:601:5, but I can't figure out why we're
>> trying to access some other address than the pointer that was passed to
>> that function.  Maybe this is trivial to someone that knows Objective-C.
>
> Please test the emacs-30 branch.  It was a double free on NS affecting
> not only XPM, but all image loading functions in varying measures.

That seems to have fixed the crash.  Closing the bug, thanks!