commit a8b9fad89720847a869bf288eb41473b6c82b833
Author: Paul Eggert <eggert@cs.ucla.edu>
Date:   Tue May 19 10:21:56 2026 -0700

    Make X_ERROR_MESSAGE_SIZE dependency more explicit
    
    This avoids an alloca in x_set_mouse_color.
    * src/xfns.c (x_set_mouse_color): Use local array rather than
    alloca, since the string is small.
    * src/xterm.c (X_ERROR_MESSAGE_SIZE): Move defn from here ...
    * src/xterm.h: ... to here, and make it an enum not a macro.

diff --git a/src/xfns.c b/src/xfns.c
index 7427144b103..7ec6025ab66 100644
--- a/src/xfns.c
+++ b/src/xfns.c
@@ -1398,10 +1398,9 @@ x_set_mouse_color (struct frame *f, Lisp_Object arg, Lisp_Object oldval)
   if (x_had_errors_p (dpy))
     {
       const char *bad_cursor_name = NULL;
-      /* Bounded by X_ERROR_MESSAGE_SIZE in xterm.c.  */
-      size_t message_length = strlen (cursor_data.error_string);
-      char *xmessage = alloca (1 + message_length);
-      memcpy (xmessage, cursor_data.error_string, message_length);
+      char xmessage[X_ERROR_MESSAGE_SIZE];
+      eassert (strlen (cursor_data.error_string) < sizeof xmessage);
+      strcpy (xmessage, cursor_data.error_string);
 
       x_uncatch_errors_after_check ();
 
diff --git a/src/xterm.c b/src/xterm.c
index 1401693541c..b2a0d2cadcc 100644
--- a/src/xterm.c
+++ b/src/xterm.c
@@ -26321,8 +26321,6 @@ x_unwind_errors_to (int depth)
     x_uncatch_errors ();
 }
 
-#define X_ERROR_MESSAGE_SIZE 200
-
 /* An X error handler which stores the error message in the first
    applicable handler in the x_error_message stack.  This is called
    from *x_error_handler if an x_catch_errors for DISPLAY is in
diff --git a/src/xterm.h b/src/xterm.h
index 962c856e772..28b720c9222 100644
--- a/src/xterm.h
+++ b/src/xterm.h
@@ -129,6 +129,8 @@ typedef GtkWidget *xt_or_gtk_widget;
 #include "dispextern.h"
 #include "termhooks.h"
 
+enum { X_ERROR_MESSAGE_SIZE = 200 };
+
 INLINE_HEADER_BEGIN
 
 /* Black and white pixel values for the screen which frame F is on.  */

commit 2dbfed05322bde0703c2a8a841c8a90174120454
Author: Paul Eggert <eggert@cs.ucla.edu>
Date:   Tue May 19 09:09:21 2026 -0700

    display_tty_menu_item eassert for absurdly long item texts
    
    * src/xdisp.c (display_tty_menu_item): Add an eassert.

diff --git a/src/xdisp.c b/src/xdisp.c
index c1d6fedb553..b00a4b2e1e7 100644
--- a/src/xdisp.c
+++ b/src/xdisp.c
@@ -27922,6 +27922,11 @@ display_tty_menu_item (const char *item_text, int width, int face_id,
   struct glyph_row *row;
   size_t item_len = strlen (item_text);
 
+  /* FIXME: callers do not seem to guarantee that the length is sane.
+     If it gets close to or greater than INT_MAX, things will go squirrelly.
+     Also, shouldn't this use menu_item_width rather than strlen?  */
+  eassert (item_len <= INT_MAX / 2);
+
   struct frame *rf = NULL;
 
   if (FRAME_PARENT_FRAME (f) && !FRAME_WINDOW_P (f)

commit fe33900747e4260c698508fc43e8c4391fa5c53a
Author: Paul Eggert <eggert@cs.ucla.edu>
Date:   Tue May 19 09:06:37 2026 -0700

    Simplify serial_open
    
    * src/sysdep.c (serial_open): On failure, simply return -1
    and set errno; do not call report_file_error, as the
    caller is supposed to do that if needed.

diff --git a/src/sysdep.c b/src/sysdep.c
index 10269e4d0ce..b2cd769784c 100644
--- a/src/sysdep.c
+++ b/src/sysdep.c
@@ -2980,10 +2980,9 @@ int
 serial_open (Lisp_Object port)
 {
   int fd = emacs_open (SSDATA (port), O_RDWR | O_NOCTTY | O_NONBLOCK, 0);
-  if (fd < 0)
-    report_file_error ("Opening serial port", port);
 #ifdef TIOCEXCL
-  ioctl (fd, TIOCEXCL, (char *) 0);
+  if (0 <= fd)
+    ioctl (fd, TIOCEXCL, (char *) 0);
 #endif
 
   return fd;

commit b3b3e203cc92b6dddee3059dc53255ea9657093f
Author: Paul Eggert <eggert@cs.ucla.edu>
Date:   Tue May 19 08:58:18 2026 -0700

    Fix unlikely dump_off overflow in pdumper
    
    * src/pdumper.c (dump_grow_buffer): Remove.
    (dump_write): Use xpalloc instead.  Avoid undefined behavior
    if (ctx->offset + nbyte) exceeds DUMP_OFF_MAX.

diff --git a/src/pdumper.c b/src/pdumper.c
index b0f40c6e3ce..259ecf7301d 100644
--- a/src/pdumper.c
+++ b/src/pdumper.c
@@ -607,13 +607,6 @@ static struct link_weight const
 
 /* Dump file creation */
 
-static void dump_grow_buffer (struct dump_context *ctx)
-{
-  ctx->buf = xrealloc (ctx->buf, ctx->buf_size = (ctx->buf_size ?
-						  (ctx->buf_size * 2)
-						  : 8 * 1024 * 1024));
-}
-
 static dump_off dump_object (struct dump_context *ctx, Lisp_Object object);
 static dump_off dump_object_for_offset (struct dump_context *ctx,
 					Lisp_Object object);
@@ -786,9 +779,17 @@ dump_write (struct dump_context *ctx, const void *buf, dump_off nbyte)
   eassert (nbyte == 0 || buf != NULL);
   eassert (ctx->obj_offset == 0);
   eassert (ctx->flags.dump_object_contents);
-  while (ctx->offset + nbyte > ctx->buf_size)
-    dump_grow_buffer (ctx);
-  memcpy ((char *)ctx->buf + ctx->offset, buf, nbyte);
+  dump_off avail = ctx->buf_size - ctx->offset;
+  if (avail < nbyte)
+    {
+      static_assert (DUMP_OFF_MAX <= PTRDIFF_MAX);
+      ptrdiff_t buf_size = ctx->buf_size;
+      ctx->buf = xpalloc (ctx->buf, &buf_size,
+			  max (nbyte - avail, 8 * 1024 * 1024),
+			  DUMP_OFF_MAX, 1);
+      ctx->buf_size = buf_size;
+    }
+  memcpy ((char *) {ctx->buf} + ctx->offset, buf, nbyte);
   ctx->offset += nbyte;
 }
 

commit c80d22dcfcc3a0b5ef8629bb4e12d18b2be01e2c
Author: Paul Eggert <eggert@cs.ucla.edu>
Date:   Tue May 19 08:49:09 2026 -0700

    Remove stray inrange_pipe comment

diff --git a/src/process.c b/src/process.c
index 9e807bef44e..c4d9d657e4f 100644
--- a/src/process.c
+++ b/src/process.c
@@ -492,8 +492,7 @@ inrange_fd (int fd)
 }
 
 /* Create a pipe into FD[0] and fd[1], refusing to create file
-   descriptors out of range.  This is like inrange_fd, that it
-   only.  */
+   descriptors out of range.  */
 static int
 inrange_pipe (int fd[2])
 {