Subject: bug#72255: 30.0.60; Crash on macOS with malformed XPM image file

From: Po Lu <[email-masked]>
Date: Wed, 24 Jul 2024 11:41:13 +0800

Stefan Kangas <[email-masked]> writes:

> Severity: normal
>
> Emacs crashes on macOS when opening a malformed XPM image file.
>
> I'm attaching an example image with the file extension ".xpm.txt" below;
> to reproduce, simply rename the file to ".xpm" and open it in Emacs.
> (This bad file is an edited version of back-arrow.xpm in emacs.git.)
>
> I've included an lldb backtrace below.  Note that I reproduced this on
> master, but the code has not changed from emacs-30.
>
> The crash happens in nsterm.m:601:5, but I can't figure out why we're
> trying to access some other address than the pointer that was passed to
> that function.  Maybe this is trivial to someone that knows Objective-C.

Please test the emacs-30 branch.  It was a double free on NS affecting
not only XPM, but all image loading functions in varying measures.