Re: Building gettext without libtextstyle

[Bruno Haible]

Hello Santiago,

> by Zack Weinberg, which reads like this:
> 
>   libtextstyle is not packaged for Debian and depends on libcroco, which
>   is unmaintained

Wrong. See
<https://lists.gnu.org/archive/html/bug-gettext/2023-09/msg00047.html>.

>   and has known security bugs.

What is a security bug, depends on the context. The bug I know of is that
with a particularly crafted .css file, it is possible to trigger a stack
overflow. In the context of a browser, where a CSS file is shipped over the
internet, it is a security bug. In the context of libtextstyle, where the
.css files are either part of the package or created by the user, it is not
a security bug. (Otherwise you would have to consider it a security bug
in Emacs that it is possible to write endless recursions in Emacs Lisp.)

Bruno