Re: Fixing security vulnerabilities before new releases

Stefan, as you were working on this topic earlier this week (thank you
for that), could you possibly share an opinion on this proposed
mitigation for the emacs-31 branch?

Eshel Yaron [30/Jul  4:14pm +02] wrote:
> Sean Whitton <[email protected]> writes:
>
>> Óscar Fuentes [29/Jul  4:24pm +02] wrote:
>>> For the record: this vulnerability is *very* serious and deserves an
>>> urgent release with a mitigation.
>>
>> Then please feel free to prepare a version of the fix for the emacs-31
>> branch.
>
> For Emacs 31, the mitigation can be as simple as:
>
> diff --git a/lisp/vc/vc-hooks.el b/lisp/vc/vc-hooks.el
> index 132b9211f88..48b9e3a3638 100644
> --- a/lisp/vc/vc-hooks.el
> +++ b/lisp/vc/vc-hooks.el
> @@ -299,7 +299,8 @@ vc-find-backend-function
>    "Return BACKEND-specific implementation of FUN.
>  If there is no such implementation, return the default implementation;
>  if that doesn't exist either, return nil."
> -  (let ((f (vc-make-backend-sym backend fun)))
> +  (let* ((read-symbol-shorthands nil)   ; Mitigate CVE-2026-XXXXX
> +         (f (vc-make-backend-sym backend fun)))
>      (if (fboundp f) f
>        ;; Load vc-BACKEND.el if needed.
>        (require (intern (concat "vc-" (downcase (symbol-name backend)))))
>
>
> Best,
>
> Eshel

-- 
Sean Whitton