Commit 04caff1e2 for imagemagick.org

commit 04caff1e25e0e43f291d97bc4235cf6f03e6a57c
Author: Dirk Lemstra <dirk@lemstra.org>
Date:   Tue Feb 3 19:48:07 2026 +0100

    Revert security patches so we can make them in clean separate commits and reference an advisory.

diff --git a/MagickCore/draw.c b/MagickCore/draw.c
index 62258c20f..c30307ac7 100644
--- a/MagickCore/draw.c
+++ b/MagickCore/draw.c
@@ -1612,7 +1612,7 @@ static Image *DrawClippingMask(Image *image,const DrawInfo *draw_info,
   clone_info=DestroyDrawInfo(clone_info);
   separate_mask=SeparateImage(clip_mask,AlphaChannel,exception);
   if (separate_mask == (Image *) NULL)
-    status=MagickFalse;
+    status=MagickFalse;
   else
     {
       clip_mask=DestroyImage(clip_mask);
@@ -3461,7 +3461,7 @@ static MagickBooleanType RenderMVGContent(Image *image,
                     continue;
                   break;
                 }
-                if ((q == (char *) NULL) || (*q == '\0') ||
+                if ((q == (char *) NULL) || (*q == '\0') ||
                     (p == (char *) NULL) || ((q-4) < p))
                   {
                     status=MagickFalse;
@@ -4383,7 +4383,7 @@ static MagickBooleanType RenderMVGContent(Image *image,
       case PathPrimitive:
       {
         coordinates=(double) TracePath(&mvg_info,token,exception);
-        primitive_info=(*mvg_info.primitive_info);
+        primitive_info=(*mvg_info.primitive_info);
         if (coordinates < 0.0)
           {
             status=MagickFalse;
@@ -5652,27 +5652,65 @@ MagickExport MagickBooleanType DrawPrimitive(Image *image,
       else
         if (*primitive_info->text != '\0')
           {
+            const char
+              *option;
+
+            MagickBooleanType
+              path_status;
+
+            struct stat
+              attributes;
+
             /*
               Read composite image.
             */
             (void) CopyMagickString(clone_info->filename,primitive_info->text,
               MagickPathExtent);
             (void) SetImageInfo(clone_info,1,exception);
+            option=GetImageOption(clone_info,"svg:embedding");
+            if ((option == (char *) NULL) &&
+                (IsStringTrue(option) == MagickFalse))
+              {
+                const MagickInfo
+                  *magick_info;
+
+                magick_info=GetMagickInfo(clone_info->magick,exception);
+                if ((magick_info != (const MagickInfo*) NULL) &&
+                    (LocaleCompare(magick_info->magick_module,"SVG") == 0))
+                  {
+                    (void) ThrowMagickException(exception,GetMagickModule(),
+                      CorruptImageError,"ImageTypeNotSupported","`%s'",
+                      clone_info->filename);
+                    clone_info=DestroyImageInfo(clone_info);
+                    break;
+                  }
+              }
             (void) CopyMagickString(clone_info->filename,primitive_info->text,
               MagickPathExtent);
             if (clone_info->size != (char *) NULL)
               clone_info->size=DestroyString(clone_info->size);
             if (clone_info->extract != (char *) NULL)
               clone_info->extract=DestroyString(clone_info->extract);
-            if ((LocaleCompare(clone_info->magick,"ftp") != 0) &&
-                (LocaleCompare(clone_info->magick,"http") != 0) &&
-                (LocaleCompare(clone_info->magick,"https") != 0) &&
-                (LocaleCompare(clone_info->magick,"mvg") != 0) &&
-                (LocaleCompare(clone_info->magick,"vid") != 0))
-              composite_images=ReadImage(clone_info,exception);
+            path_status=GetPathAttributes(clone_info->filename,&attributes);
+            if (path_status != MagickFalse)
+              {
+                if (S_ISCHR(attributes.st_mode) == 0)
+                  composite_images=ReadImage(clone_info,exception);
+                else
+                  (void) ThrowMagickException(exception,GetMagickModule(),
+                    FileOpenError,"UnableToOpenFile","`%s'",
+                      clone_info->filename);
+              }
             else
-              (void) ThrowMagickException(exception,GetMagickModule(),
-                FileOpenError,"UnableToOpenFile","`%s'",clone_info->filename);
+              if ((LocaleCompare(clone_info->magick,"ftp") != 0) &&
+                  (LocaleCompare(clone_info->magick,"http") != 0) &&
+                  (LocaleCompare(clone_info->magick,"https") != 0) &&
+                  (LocaleCompare(clone_info->magick,"mvg") != 0) &&
+                  (LocaleCompare(clone_info->magick,"vid") != 0))
+                composite_images=ReadImage(clone_info,exception);
+              else
+                (void) ThrowMagickException(exception,GetMagickModule(),
+                  FileOpenError,"UnableToOpenFile","`%s'",clone_info->filename);
           }
       clone_info=DestroyImageInfo(clone_info);
       if (composite_images == (Image *) NULL)
diff --git a/MagickCore/module.c b/MagickCore/module.c
index 480dc53bb..ca5ed0fe9 100644
--- a/MagickCore/module.c
+++ b/MagickCore/module.c
@@ -595,16 +595,15 @@ static MagickBooleanType GetMagickModulePath(const char *filename,
           (void) ConcatenateMagickString(path,DirectorySeparator,
             MagickPathExtent);
         (void) ConcatenateMagickString(path,filename,MagickPathExtent);
+#if defined(MAGICKCORE_HAVE_REALPATH)
         {
           char
-            *real_path = realpath_utf8(path);
+            resolved_path[PATH_MAX+1];

-          if (real_path != (char *) NULL)
-            {
-              (void) CopyMagickString(path,real_path,MagickPathExtent);
-              real_path=DestroyString(real_path);
-            }
+          if (realpath(path,resolved_path) != (char *) NULL)
+            (void) CopyMagickString(path,resolved_path,MagickPathExtent);
         }
+#endif
         if (IsPathAccessible(path) != MagickFalse)
           {
             module_path=DestroyString(module_path);
diff --git a/MagickCore/policy.c b/MagickCore/policy.c
index a557f59bd..9ef1d6e67 100644
--- a/MagickCore/policy.c
+++ b/MagickCore/policy.c
@@ -671,31 +671,18 @@ MagickExport MagickBooleanType IsRightsAuthorized(const PolicyDomain domain,
       *policy;

     policy=(const PolicyInfo *) p->value;
-    if (policy->domain == domain)
+    if ((policy->domain == domain) &&
+        (GlobExpression(pattern,policy->pattern,MagickFalse) != MagickFalse))
       {
-        char
-          *real_pattern = (char *) pattern;
-
-        if (policy->domain == PathPolicyDomain)
-          {
-            real_pattern=realpath_utf8(pattern);
-            if (real_pattern == (char *) NULL)
-              real_pattern=AcquireString(pattern);
-          }
-        if (GlobExpression(real_pattern,policy->pattern,MagickFalse) != MagickFalse)
-          {
-            if ((rights & ReadPolicyRights) != 0)
-              authorized=(policy->rights & ReadPolicyRights) != 0 ? MagickTrue :
-                MagickFalse;
-            if ((rights & WritePolicyRights) != 0)
-              authorized=(policy->rights & WritePolicyRights) != 0 ?
-                MagickTrue : MagickFalse;
-            if ((rights & ExecutePolicyRights) != 0)
-              authorized=(policy->rights & ExecutePolicyRights) != 0 ?
-                MagickTrue : MagickFalse;
-          }
-        if (policy->domain == PathPolicyDomain)
-          real_pattern=DestroyString(real_pattern);
+        if ((rights & ReadPolicyRights) != 0)
+          authorized=(policy->rights & ReadPolicyRights) != 0 ? MagickTrue :
+            MagickFalse;
+        if ((rights & WritePolicyRights) != 0)
+          authorized=(policy->rights & WritePolicyRights) != 0 ? MagickTrue :
+            MagickFalse;
+        if ((rights & ExecutePolicyRights) != 0)
+          authorized=(policy->rights & ExecutePolicyRights) != 0 ? MagickTrue :
+            MagickFalse;
       }
     p=p->next;
   }
diff --git a/MagickCore/utility-private.h b/MagickCore/utility-private.h
index 77b98f55c..444c706ca 100644
--- a/MagickCore/utility-private.h
+++ b/MagickCore/utility-private.h
@@ -267,125 +267,6 @@ static inline FILE *popen_utf8(const char *command,const char *type)
 #endif
 }

-static inline char *realpath_utf8(const char *path)
-{
-#if !defined(MAGICKCORE_WINDOWS_SUPPORT) || defined(__CYGWIN__)
-#if defined(MAGICKCORE_HAVE_REALPATH)
-  return(realpath(path,(char *) NULL));
-#else
-  return(AcquireString(path));
-#endif
-#else
-  char
-    *real_path;
-
-  DWORD
-    final_path_length,
-    full_path_length;
-
-  HANDLE
-    file_handle;
-
-  int
-    length,
-    utf8_length;
-
-  wchar_t
-    *clean_path,
-    *final_path,
-    *full_path,
-    *wide_path;
-
-  /*
-    Convert UTF-8 to UTF-16.
-  */
-  if (path == (const char *) NULL)
-    return((char *) NULL);
-  length=MultiByteToWideChar(CP_UTF8,0,path,-1,NULL,0);
-  if (length <= 0)
-    return((char *) NULL);
-  wide_path=(wchar_t *) AcquireQuantumMemory(length,sizeof(wchar_t));
-  if (wide_path == (wchar_t *) NULL)
-    return((char *) NULL);
-  MultiByteToWideChar(CP_UTF8,0,path,-1,wide_path,length);
-  /*
-    Normalize syntactically.
-  */
-  full_path_length=GetFullPathNameW(wide_path,0,NULL,NULL);
-  if (full_path_length == 0)
-    {
-      wide_path=(wchar_t *) RelinquishMagickMemory(wide_path);
-      return((char *) NULL);
-    }
-  full_path=(wchar_t *) AcquireQuantumMemory(full_path_length,sizeof(wchar_t));
-  if (full_path == (wchar_t *) NULL)
-    {
-      wide_path=(wchar_t *) RelinquishMagickMemory(wide_path);
-      return((char *) NULL);
-    }
-  GetFullPathNameW(wide_path,full_path_length,full_path,NULL);
-  wide_path=(wchar_t *) RelinquishMagickMemory(wide_path);
-  /*
-    Open the file/directory to resolve symlinks.
-  */
-  file_handle=CreateFileW(full_path,GENERIC_READ,FILE_SHARE_READ |
-    FILE_SHARE_WRITE | FILE_SHARE_DELETE,NULL,OPEN_EXISTING,
-    FILE_FLAG_BACKUP_SEMANTICS,NULL);
-  if (file_handle == INVALID_HANDLE_VALUE)
-    {
-      full_path=(wchar_t *) RelinquishMagickMemory(full_path);
-      return((char *) NULL);
-    }
-  /*
-    Resolve final canonical path.
-  */
-  final_path_length=GetFinalPathNameByHandleW(file_handle,NULL,0,
-    FILE_NAME_NORMALIZED);
-  if (final_path_length == 0)
-    {
-      CloseHandle(file_handle);
-      full_path=(wchar_t *) RelinquishMagickMemory(full_path);
-      return((char *) NULL);
-    }
-  final_path=(wchar_t *) AcquireQuantumMemory(final_path_length,
-    sizeof(wchar_t));
-  if (final_path == (wchar_t *) NULL)
-    {
-      CloseHandle(file_handle);
-      full_path=(wchar_t *) RelinquishMagickMemory(full_path);
-      return((char *) NULL);
-    }
-  GetFinalPathNameByHandleW(file_handle,final_path,final_path_length,
-    FILE_NAME_NORMALIZED);
-  CloseHandle(file_handle);
-  full_path=(wchar_t *) RelinquishMagickMemory(full_path);
-  /*
-    Remove \\?\ prefix for POSIX-like behavior.
-  */
-  clean_path=final_path;
-  if (wcsncmp(final_path,L"\\\\?\\",4) == 0)
-    clean_path=final_path+4;
-  /*
-    Convert UTF-16 to UTF-8.
-  */
-  utf8_length=WideCharToMultiByte(CP_UTF8,0,clean_path,-1,NULL,0,NULL,NULL);
-  if (utf8_length <= 0)
-    {
-      final_path=(wchar_t *) RelinquishMagickMemory(final_path);
-      return NULL;
-    }
-  real_path=(char *) AcquireQuantumMemory(utf8_length,sizeof(char));
-  if (real_path == (char *) NULL)
-    {
-      final_path=(wchar_t *) RelinquishMagickMemory(final_path);
-      return NULL;
-    }
-  WideCharToMultiByte(CP_UTF8,0,clean_path,-1,real_path,utf8_length,NULL,NULL);
-  final_path=(wchar_t *) RelinquishMagickMemory(final_path);
-  return(real_path);
-#endif
-}
-
 static inline int remove_utf8(const char *path)
 {
 #if !defined(MAGICKCORE_WINDOWS_SUPPORT) || defined(__CYGWIN__)
diff --git a/MagickCore/utility.c b/MagickCore/utility.c
index 4e78d2891..5b8f117c3 100644
--- a/MagickCore/utility.c
+++ b/MagickCore/utility.c
@@ -1042,23 +1042,16 @@ MagickPrivate MagickBooleanType GetExecutionPath(char *path,const size_t extent)
 #if defined(MAGICKCORE_HAVE__NSGETEXECUTABLEPATH)
   {
     char
-      executable_path[PATH_MAX << 1];
+      executable_path[PATH_MAX << 1],
+      execution_path[PATH_MAX+1];

     uint32_t
       length;

     length=sizeof(executable_path);
-    if (_NSGetExecutablePath(executable_path,&length) == 0)
-      {
-        char
-          *real_path = realpath_utf8(executable_path);
-
-        if (real_path != (char *) NULL)
-          {
-            (void) CopyMagickString(path,real_path,extent);
-            real_path=DestroyString(real_path);
-          }
-      }
+    if ((_NSGetExecutablePath(executable_path,&length) == 0) &&
+        (realpath(executable_path,execution_path) != (char *) NULL))
+      (void) CopyMagickString(path,execution_path,extent);
   }
 #endif
 #if defined(MAGICKCORE_HAVE_GETEXECNAME)
@@ -1104,13 +1097,10 @@ MagickPrivate MagickBooleanType GetExecutionPath(char *path,const size_t extent)
     if (count != -1)
       {
         char
-          *real_path = realpath_utf8(program_name);
+          execution_path[PATH_MAX+1];

-        if (real_path != (char *) NULL)
-          {
-            (void) CopyMagickString(path,real_path,extent);
-            real_path=DestroyString(real_path);
-          }
+        if (realpath(program_name,execution_path) != (char *) NULL)
+          (void) CopyMagickString(path,execution_path,extent);
       }
     if (program_name != program_invocation_name)
       program_name=(char *) RelinquishMagickMemory(program_name);
@@ -1892,7 +1882,7 @@ MagickPrivate MagickBooleanType ShredFile(const char *path)
     {
       char
         *property;
-
+
       passes=0;
       property=GetEnvironmentValue("MAGICK_SHRED_PASSES");
       if (property != (char *) NULL)
diff --git a/coders/dcm.c b/coders/dcm.c
index f4fa2cb6e..f9090667d 100644
--- a/coders/dcm.c
+++ b/coders/dcm.c
@@ -2705,7 +2705,6 @@ typedef struct _DCMInfo

   size_t
     bits_allocated,
-    bits_per_entry,
     bytes_per_pixel,
     depth,
     mask,
@@ -3160,7 +3159,6 @@ static Image *ReadDCMImage(const ImageInfo *image_info,ExceptionInfo *exception)
   */
   (void) CopyMagickString(photometric,"MONOCHROME1 ",MagickPathExtent);
   info.bits_allocated=8;
-  info.bits_per_entry=1;
   info.bytes_per_pixel=1;
   info.depth=8;
   info.mask=0xffff;
@@ -3702,7 +3700,7 @@ static Image *ReadDCMImage(const ImageInfo *image_info,ExceptionInfo *exception)
                 else
                   index=(unsigned short) (*p | (*(p+1) << 8));
                 map.red[i]=(int) index;
-                p+=(ptrdiff_t) info.bits_per_entry;
+                p+=(ptrdiff_t) 2;
               }
               break;
             }
@@ -3734,7 +3732,7 @@ static Image *ReadDCMImage(const ImageInfo *image_info,ExceptionInfo *exception)
                 else
                   index=(unsigned short) (*p | (*(p+1) << 8));
                 map.green[i]=(int) index;
-                p+=(ptrdiff_t) info.bits_per_entry;
+                p+=(ptrdiff_t) 2;
               }
               break;
             }
@@ -3766,20 +3764,10 @@ static Image *ReadDCMImage(const ImageInfo *image_info,ExceptionInfo *exception)
                 else
                   index=(unsigned short) (*p | (*(p+1) << 8));
                 map.blue[i]=(int) index;
-                p+=(ptrdiff_t) info.bits_per_entry;
+                p+=(ptrdiff_t) 2;
               }
               break;
             }
-            case 0x3002:
-            {
-              /*
-                Bytes per entry.
-              */
-              info.bits_per_entry=(size_t) datum;
-              if ((info.bits_per_entry == 0) || (info.bits_per_entry > 2))
-                ThrowDCMException(CorruptImageError,"ImproperImageHeader")
-              break;
-            }
             default:
               break;
           }
diff --git a/coders/msl.c b/coders/msl.c
index 5f3a8779d..76645b3e7 100644
--- a/coders/msl.c
+++ b/coders/msl.c
@@ -84,7 +84,6 @@
 #include "MagickCore/segment.h"
 #include "MagickCore/shear.h"
 #include "MagickCore/signature.h"
-#include "MagickCore/splay-tree.h"
 #include "MagickCore/statistic.h"
 #include "MagickCore/static.h"
 #include "MagickCore/string_.h"
@@ -142,12 +141,6 @@ typedef struct _MSLInfo
     *group_info;
 } MSLInfo;

-/*
-  Global declarations.
-*/
-static SplayTreeInfo
-  *msl_tree = (SplayTreeInfo *) NULL;
-
 /*
   Forward declarations.
 */
@@ -4777,24 +4770,13 @@ static void MSLStartElement(void *context,const xmlChar *tag,
                 if (LocaleCompare(keyword,"filename") == 0)
                   {
                     Image
-                      *next = (Image *) NULL;
+                      *next;

                     if (value == (char *) NULL)
                       break;
-                    if (GetValueFromSplayTree(msl_tree,value) != (const char *) NULL)
-                      {
-                        (void) ThrowMagickException(msl_info->exception,
-                          GetMagickModule(),DrawError,
-                          "VectorGraphicsNestedTooDeeply","`%s'",value);
-                        break;
-                      }
-                    (void) AddValueToSplayTree(msl_tree,ConstantString(value),
-                      (void *) 1);
-                    *msl_info->image_info[n]->magick='\0';
                     (void) CopyMagickString(msl_info->image_info[n]->filename,
                       value,MagickPathExtent);
                     next=ReadImage(msl_info->image_info[n],exception);
-                    (void) DeleteNodeFromSplayTree(msl_tree,value);
                     CatchException(exception);
                     if (next == (Image *) NULL)
                       continue;
@@ -5843,11 +5825,10 @@ static void MSLStartElement(void *context,const xmlChar *tag,
                   Quantum  opac = OpaqueAlpha;
                   ssize_t len = (ssize_t) strlen( value );

-                  if ((len > 0) && (value[len-1] == '%')) {
-                    char *tmp = AcquireString(value);
+                  if (value[len-1] == '%') {
+                    char  tmp[100];
                     (void) CopyMagickString(tmp,value,(size_t) len);
                     opac = (Quantum) StringToLong( tmp );
-                    tmp=DestroyString(tmp);
                     opac = (Quantum)(QuantumRange * ((float)opac/100));
                   } else
                     opac = (Quantum) StringToLong( value );
@@ -7058,7 +7039,6 @@ static void MSLStartElement(void *context,const xmlChar *tag,

           /* process */
           {
-            *msl_info->image_info[n]->magick='\0';
             (void) CopyMagickString(msl_info->image_info[n]->filename,
               msl_info->image[n]->filename,MagickPathExtent);
             (void) SetImageInfo(msl_info->image_info[n],1,exception);
@@ -7542,9 +7522,6 @@ ModuleExport size_t RegisterMSLImage(void)
   MagickInfo
     *entry;

-  if (msl_tree == (SplayTreeInfo *) NULL)
-    msl_tree=NewSplayTree(CompareSplayTreeString,RelinquishMagickMemory,
-      (void *(*)(void *)) NULL);
   entry=AcquireMagickInfo("MSL","MSL","Magick Scripting Language");
 #if defined(MAGICKCORE_XML_DELEGATE)
   entry->decoder=(DecodeImageHandler *) ReadMSLImage;
@@ -7865,8 +7842,6 @@ static MagickBooleanType SetMSLAttributes(MSLInfo *msl_info,const char *keyword,
 ModuleExport void UnregisterMSLImage(void)
 {
   (void) UnregisterMagickInfo("MSL");
-  if (msl_tree != (SplayTreeInfo *) NULL)
-    msl_tree=DestroySplayTree(msl_tree);
 }

 #if defined(MAGICKCORE_XML_DELEGATE)
@@ -7914,7 +7889,6 @@ static MagickBooleanType WriteMSLImage(const ImageInfo *image_info,Image *image,
     (void) LogMagickEvent(TraceEvent,GetMagickModule(),"%s",image->filename);
   msl_image=CloneImage(image,0,0,MagickTrue,exception);
   status=ProcessMSLScript(image_info,&msl_image,exception);
-  msl_image=DestroyImage(msl_image);
   return(status);
 }
 #endif
diff --git a/coders/ps.c b/coders/ps.c
index d2ea34588..66b08e8c7 100644
--- a/coders/ps.c
+++ b/coders/ps.c
@@ -1086,82 +1086,6 @@ static inline unsigned char *PopHexPixel(const char hex_digits[][3],
   return(pixels);
 }

-static inline void FilenameToTitle(const char *filename,char *title,
-  const size_t extent)
-{
-  int
-    depth = 0;
-
-  ssize_t
-    i,
-    offset = 0;
-
-  if (extent == 0)
-    return;
-  for (i=0; (filename[i] != '\0') && ((offset+1) < (ssize_t) extent); i++)
-  {
-    unsigned char
-      c = filename[i];
-
-    /*
-      Only allow printable ASCII.
-    */
-    if ((c < 32) || (c > 126))
-      {
-        title[offset++]='_';
-        continue;
-      }
-    /*
-      Percent signs break DSC parsing.
-    */
-    if (c == '%')
-      {
-        title[offset++]='_';
-        continue;
-      }
-    /*
-      Parentheses must remain balanced.
-    */
-    if (c == '(')
-      {
-        depth++;
-        title[offset++] = '(';
-        continue;
-      }
-    if (c == ')')
-      {
-        if (depth <= 0)
-          title[offset++]='_';
-        else
-          {
-            depth--;
-            title[offset++]=')';
-          }
-         continue;
-     }
-    /*
-      Everything else is allowed.
-    */
-    title[offset++]=c;
-  }
-  /*
-    If parentheses remain unbalanced, close them.
-  */
-  while ((depth > 0) && ((offset+1) < (ssize_t) extent)) {
-    title[offset++]=')';
-    depth--;
-  }
-  title[offset]='\0';
-  /*
-    Ensure non-empty result.
-  */
-  if (offset == 0)
-    {
-      (void) CopyMagickString(title,"Untitled",extent-1);
-      title[extent-1]='\0';
-    }
-}
-
 static MagickBooleanType WritePSImage(const ImageInfo *image_info,Image *image,
   ExceptionInfo *exception)
 {
@@ -1630,9 +1554,6 @@ static MagickBooleanType WritePSImage(const ImageInfo *image_info,Image *image,
       text_size=(size_t) (MultilineCensus(value)*pointsize+12);
     if (page == 1)
       {
-        char
-          title[MagickPathExtent];
-
         /*
           Output Postscript header.
         */
@@ -1643,9 +1564,8 @@ static MagickBooleanType WritePSImage(const ImageInfo *image_info,Image *image,
             MagickPathExtent);
         (void) WriteBlobString(image,buffer);
         (void) WriteBlobString(image,"%%Creator: (ImageMagick)\n");
-        FilenameToTitle(image->filename,title,MagickPathExtent);
         (void) FormatLocaleString(buffer,MagickPathExtent,"%%%%Title: (%s)\n",
-          title);
+          image->filename);
         (void) WriteBlobString(image,buffer);
         timer=GetMagickTime();
         (void) FormatMagickTime(timer,sizeof(date),date);
diff --git a/coders/ps2.c b/coders/ps2.c
index 009129a98..82935dc8e 100644
--- a/coders/ps2.c
+++ b/coders/ps2.c
@@ -225,82 +225,6 @@ static MagickBooleanType Huffman2DEncodeImage(const ImageInfo *image_info,
   return(status);
 }

-static inline void FilenameToTitle(const char *filename,char *title,
-  const size_t extent)
-{
-  int
-    depth = 0;
-
-  ssize_t
-    i,
-    offset = 0;
-
-  if (extent == 0)
-    return;
-  for (i=0; (filename[i] != '\0') && ((offset+1) < (ssize_t) extent); i++)
-  {
-    unsigned char
-      c = filename[i];
-
-    /*
-      Only allow printable ASCII.
-    */
-    if ((c < 32) || (c > 126))
-      {
-        title[offset++]='_';
-        continue;
-      }
-    /*
-      Percent signs break DSC parsing.
-    */
-    if (c == '%')
-      {
-        title[offset++]='_';
-        continue;
-      }
-    /*
-      Parentheses must remain balanced.
-    */
-    if (c == '(')
-      {
-        depth++;
-        title[offset++] = '(';
-        continue;
-      }
-    if (c == ')')
-      {
-        if (depth <= 0)
-          title[offset++]='_';
-        else
-          {
-            depth--;
-            title[offset++]=')';
-          }
-         continue;
-     }
-    /*
-      Everything else is allowed.
-    */
-    title[offset++]=c;
-  }
-  /*
-    If parentheses remain unbalanced, close them.
-  */
-  while ((depth > 0) && ((offset+1) < (ssize_t) extent)) {
-    title[offset++]=')';
-    depth--;
-  }
-  title[offset]='\0';
-  /*
-    Ensure non-empty result.
-  */
-  if (offset == 0)
-    {
-      (void) CopyMagickString(title,"Untitled",extent-1);
-      title[extent-1]='\0';
-    }
-}
-
 static MagickBooleanType WritePS2Image(const ImageInfo *image_info,Image *image,
   ExceptionInfo *exception)
 {
@@ -623,9 +547,6 @@ static MagickBooleanType WritePS2Image(const ImageInfo *image_info,Image *image,
       text_size=(size_t) (MultilineCensus(value)*pointsize+12);
     if (page == 1)
       {
-        char
-          title[MagickPathExtent];
-
         /*
           Output Postscript header.
         */
@@ -636,9 +557,8 @@ static MagickBooleanType WritePS2Image(const ImageInfo *image_info,Image *image,
             MagickPathExtent);
         (void) WriteBlobString(image,buffer);
         (void) WriteBlobString(image,"%%Creator: (ImageMagick)\n");
-        FilenameToTitle(image->filename,title,MagickPathExtent);
         (void) FormatLocaleString(buffer,MagickPathExtent,"%%%%Title: (%s)\n",
-          title);
+          image->filename);
         (void) WriteBlobString(image,buffer);
         timer=GetMagickTime();
         (void) FormatMagickTime(timer,sizeof(date),date);
diff --git a/coders/ps3.c b/coders/ps3.c
index 2b02d49b5..77ddf050b 100644
--- a/coders/ps3.c
+++ b/coders/ps3.c
@@ -203,82 +203,6 @@ ModuleExport void UnregisterPS3Image(void)
 %
 */

-static inline void FilenameToTitle(const char *filename,char *title,
-  const size_t extent)
-{
-  int
-    depth = 0;
-
-  ssize_t
-    i,
-    offset = 0;
-
-  if (extent == 0)
-    return;
-  for (i=0; (filename[i] != '\0') && ((offset+1) < (ssize_t) extent); i++)
-  {
-    unsigned char
-      c = filename[i];
-
-    /*
-      Only allow printable ASCII.
-    */
-    if ((c < 32) || (c > 126))
-      {
-        title[offset++]='_';
-        continue;
-      }
-    /*
-      Percent signs break DSC parsing.
-    */
-    if (c == '%')
-      {
-        title[offset++]='_';
-        continue;
-      }
-    /*
-      Parentheses must remain balanced.
-    */
-    if (c == '(')
-      {
-        depth++;
-        title[offset++] = '(';
-        continue;
-      }
-    if (c == ')')
-      {
-        if (depth <= 0)
-          title[offset++]='_';
-        else
-          {
-            depth--;
-            title[offset++]=')';
-          }
-         continue;
-     }
-    /*
-      Everything else is allowed.
-    */
-    title[offset++]=c;
-  }
-  /*
-    If parentheses remain unbalanced, close them.
-  */
-  while ((depth > 0) && ((offset+1) < (ssize_t) extent)) {
-    title[offset++]=')';
-    depth--;
-  }
-  title[offset]='\0';
-  /*
-    Ensure non-empty result.
-  */
-  if (offset == 0)
-    {
-      (void) CopyMagickString(title,"Untitled",extent-1);
-      title[extent-1]='\0';
-    }
-}
-
 static MagickBooleanType Huffman2DEncodeImage(const ImageInfo *image_info,
   Image *image,Image *inject_image,ExceptionInfo *exception)
 {
@@ -1083,9 +1007,6 @@ static MagickBooleanType WritePS3Image(const ImageInfo *image_info,Image *image,
     is_gray=IdentifyImageCoderGray(image,exception);
     if (page == 1)
       {
-        char
-          title[MagickPathExtent];
-
         /*
           Postscript header on the first page.
         */
@@ -1098,9 +1019,8 @@ static MagickBooleanType WritePS3Image(const ImageInfo *image_info,Image *image,
         (void) FormatLocaleString(buffer,MagickPathExtent,
           "%%%%Creator: ImageMagick %s\n",MagickLibVersionText);
         (void) WriteBlobString(image,buffer);
-        FilenameToTitle(image->filename,title,MagickPathExtent);
         (void) FormatLocaleString(buffer,MagickPathExtent,"%%%%Title: %s\n",
-          title);
+          image->filename);
         (void) WriteBlobString(image,buffer);
         timer=GetMagickTime();
         (void) FormatMagickTime(timer,sizeof(date),date);
diff --git a/coders/svg.c b/coders/svg.c
index becb96988..2f8a27ebc 100644
--- a/coders/svg.c
+++ b/coders/svg.c
@@ -185,12 +185,6 @@ typedef struct _SVGInfo
     svgDepth;
 } SVGInfo;

-/*
-  Global declarations.
-*/
-static SplayTreeInfo
-  *svg_tree = (SplayTreeInfo *) NULL;
-
 /*
   Static declarations.
 */
@@ -2659,26 +2653,6 @@ static void SVGEndElement(void *context,const xmlChar *name)
     {
       if (LocaleCompare((const char *) name,"image") == 0)
         {
-          Image
-            *image;
-
-          ImageInfo
-            *image_info = AcquireImageInfo();
-
-          if (GetValueFromSplayTree(svg_tree,svg_info->url) != (const char *) NULL)
-            {
-              (void) ThrowMagickException(svg_info->exception,GetMagickModule(),
-                DrawError,"VectorGraphicsNestedTooDeeply","`%s'",svg_info->url);
-              break;
-            }
-          (void) AddValueToSplayTree(svg_tree,ConstantString(svg_info->url),
-            (void *) 1);
-          (void) CopyMagickString(image_info->filename,svg_info->url,
-            MagickPathExtent);
-          image=ReadImage(image_info,svg_info->exception);
-          if (image != (Image *) NULL)
-            image=DestroyImage(image);
-          (void) DeleteNodeFromSplayTree(svg_tree,svg_info->url);
           (void) FormatLocaleFile(svg_info->file,
             "image Over %g,%g %g,%g \"%s\"\n",svg_info->bounds.x,
             svg_info->bounds.y,svg_info->bounds.width,svg_info->bounds.height,
@@ -3352,9 +3326,6 @@ ModuleExport size_t RegisterSVGImage(void)
   MagickInfo
     *entry;

-  if (svg_tree == (SplayTreeInfo *) NULL)
-    svg_tree=NewSplayTree(CompareSplayTreeString,RelinquishMagickMemory,
-      (void *(*)(void *)) NULL);
   *version='\0';
 #if defined(LIBXML_DOTTED_VERSION)
   (void) CopyMagickString(version,"XML " LIBXML_DOTTED_VERSION,
@@ -3370,6 +3341,9 @@ ModuleExport size_t RegisterSVGImage(void)
   entry=AcquireMagickInfo("SVG","SVG","Scalable Vector Graphics");
   entry->decoder=(DecodeImageHandler *) ReadSVGImage;
   entry->encoder=(EncodeImageHandler *) WriteSVGImage;
+#if defined(MAGICKCORE_RSVG_DELEGATE)
+  entry->flags^=CoderDecoderThreadSupportFlag;
+#endif
   entry->mime_type=ConstantString("image/svg+xml");
   if (*version != '\0')
     entry->version=ConstantString(version);
@@ -3380,6 +3354,9 @@ ModuleExport size_t RegisterSVGImage(void)
   entry->decoder=(DecodeImageHandler *) ReadSVGImage;
 #endif
   entry->encoder=(EncodeImageHandler *) WriteSVGImage;
+#if defined(MAGICKCORE_RSVG_DELEGATE)
+  entry->flags^=CoderDecoderThreadSupportFlag;
+#endif
   entry->mime_type=ConstantString("image/svg+xml");
   if (*version != '\0')
     entry->version=ConstantString(version);
@@ -3389,6 +3366,7 @@ ModuleExport size_t RegisterSVGImage(void)
   entry=AcquireMagickInfo("SVG","RSVG","Librsvg SVG renderer");
   entry->decoder=(DecodeImageHandler *) ReadSVGImage;
   entry->encoder=(EncodeImageHandler *) WriteSVGImage;
+  entry->flags^=CoderDecoderThreadSupportFlag;
   entry->mime_type=ConstantString("image/svg+xml");
   if (*version != '\0')
     entry->version=ConstantString(version);
@@ -3401,6 +3379,9 @@ ModuleExport size_t RegisterSVGImage(void)
   entry->decoder=(DecodeImageHandler *) ReadSVGImage;
 #endif
   entry->encoder=(EncodeImageHandler *) WriteSVGImage;
+#if defined(MAGICKCORE_RSVG_DELEGATE)
+  entry->flags^=CoderDecoderThreadSupportFlag;
+#endif
   entry->magick=(IsImageFormatHandler *) IsSVG;
   (void) RegisterMagickInfo(entry);
   return(MagickImageCoderSignature);
@@ -3433,8 +3414,6 @@ ModuleExport void UnregisterSVGImage(void)
   (void) UnregisterMagickInfo("RSVG");
 #endif
   (void) UnregisterMagickInfo("MSVG");
-  if (svg_tree != (SplayTreeInfo *) NULL)
-    svg_tree=DestroySplayTree(svg_tree);
 }

 /*
diff --git a/config/policy-secure.xml b/config/policy-secure.xml
index bc2763b72..a650102b1 100644
--- a/config/policy-secure.xml
+++ b/config/policy-secure.xml
@@ -90,7 +90,6 @@
   <policy domain="filter" rights="none" pattern="*"/>
   <!-- Don't read/write from/to stdin/stdout. -->
   <policy domain="path" rights="none" pattern="-"/>
-  <policy domain="path" rights="none" pattern="fd:*"/>
   <!-- don't read sensitive paths. -->
   <policy domain="path" rights="none" pattern="/etc/*"/>
   <!-- Indirect reads are not permitted. -->
diff --git a/config/policy-websafe.xml b/config/policy-websafe.xml
index 9c7a5b8c9..e23a475a0 100644
--- a/config/policy-websafe.xml
+++ b/config/policy-websafe.xml
@@ -86,7 +86,6 @@
   <policy domain="filter" rights="none" pattern="*"/>
   <!-- Don't read/write from/to stdin/stdout. -->
   <policy domain="path" rights="none" pattern="-"/>
-  <policy domain="path" rights="none" pattern="fd:*"/>
   <!-- don't read sensitive paths. -->
   <policy domain="path" rights="none" pattern="/etc/*"/>
   <!-- Indirect reads are not permitted. -->
diff --git a/www/security-policy.html b/www/security-policy.html
index e253c4177..3e67dbd88 100644
--- a/www/security-policy.html
+++ b/www/security-policy.html
@@ -331,7 +331,6 @@
   &lt;policy domain="filter" rights="none" pattern="*"/>
   &lt;!-- Don't read/write from/to stdin/stdout. -->
   &lt;policy domain="path" rights="none" pattern="-"/>
-  &lt;policy domain="path" rights="none" pattern="fd:*"/>
   &lt;!-- don't read sensitive paths. -->
   &lt;policy domain="path" rights="none" pattern="/etc/*"/>
   &lt;!-- Indirect reads are not permitted. -->
@@ -534,4 +533,4 @@ Path: [built-in]
 ~
   </body>
 </html>
-<!-- Magick Cache 3rd October 2025 23:49 -->
+<!-- Magick Cache 3rd October 2025 23:49 -->
\ No newline at end of file