Commit 02100e28f for imagemagick.org

commit 02100e28feb25970ddb138a9f3a61f869d989258
Author: Cristy <urban-warrior@imagemagick.org>
Date:   Sat Sep 26 13:46:30 2026 -0400

    check coder nesting

diff --git a/MagickCore/constitute-private.h b/MagickCore/constitute-private.h
index f4d4d036b..98b858a26 100644
--- a/MagickCore/constitute-private.h
+++ b/MagickCore/constitute-private.h
@@ -32,10 +32,12 @@ extern "C" {
 static inline Image *StrictReadImage(ImageInfo *image_info,
   ExceptionInfo *exception)
 {
+#define MagickMaxCoderDepth  250
+
   char
     magic[MagickPathExtent];

-  if (image_info->coder_depth >= MagickMaxRecursionDepth)
+  if (image_info->coder_depth++ >= MagickMaxCoderDepth)
     {
       errno=EPERM;
       (void) ThrowMagickException(exception,GetMagickModule(),OptionError,
@@ -46,23 +48,15 @@ static inline Image *StrictReadImage(ImageInfo *image_info,
   if (*magic != '\0')
     {
       const MagickInfo *magick_info = GetMagickInfo(magic,exception);
-      if ((magick_info == (const MagickInfo *) NULL) ||
-          (GetMagickExplicitAllowed(magick_info) == MagickFalse))
+      if ((magick_info != (const MagickInfo *) NULL) &&
+          (GetMagickExplicitAllowed(magick_info) != MagickFalse))
+          return(ReadImage(image_info,exception));
+      else
         {
           (void) ThrowMagickException(exception,GetMagickModule(),ImageError,
             "ExplicitCoderNotAllowed","`%s'",image_info->filename);
           return((Image *) NULL);
         }
-      else
-        {
-          Image
-            *image;
-
-          image_info->coder_depth++;
-          image=ReadImage(image_info,exception);
-          image_info->coder_depth--;
-          return(image);
-        }
     }
   if (IsPathAccessible(image_info->filename) == MagickFalse)
     {
diff --git a/MagickCore/draw.c b/MagickCore/draw.c
index 2375bafb5..24d36812f 100644
--- a/MagickCore/draw.c
+++ b/MagickCore/draw.c
@@ -5773,7 +5773,7 @@ MagickExport MagickBooleanType DrawPrimitive(Image *image,

       if (primitive_info->text == (char *) NULL)
         break;
-      clone_info=CloneImageInfo(draw_info->image_info);
+      clone_info=AcquireImageInfo();
       composite_images=(Image *) NULL;
       if (LocaleNCompare(primitive_info->text,"data:",5) == 0)
         composite_images=ReadInlineImage(clone_info,primitive_info->text,
@@ -5793,6 +5793,7 @@ MagickExport MagickBooleanType DrawPrimitive(Image *image,
               clone_info->size=DestroyString(clone_info->size);
             if (clone_info->extract != (char *) NULL)
               clone_info->extract=DestroyString(clone_info->extract);
+            clone_info->coder_depth=draw_info->image_info->coder_depth;
             composite_images=StrictReadImage(clone_info,exception);
             draw_info->image_info->coder_depth=clone_info->coder_depth;
           }
diff --git a/coders/svg.c b/coders/svg.c
index 5853cd8f1..465ead102 100644
--- a/coders/svg.c
+++ b/coders/svg.c
@@ -141,7 +141,7 @@ typedef struct _SVGInfo
   Image
     *image;

-  const ImageInfo
+  ImageInfo
     *image_info;

   AffineMatrix
@@ -2731,10 +2731,12 @@ static void SVGEndElement(void *context,const xmlChar *name)
             }
           (void) CopyMagickString(image_info->filename,svg_info->url,
             MagickPathExtent);
+          image_info->coder_depth=svg_info->image_info->coder_depth;
           if (LocaleNCompare(image_info->filename,"data:",5) == 0)
             image=ReadInlineImage(image_info,svg_info->url,svg_info->exception);
           else
             image=StrictReadImage(image_info,svg_info->exception);
+          svg_info->image_info->coder_depth=image_info->coder_depth;
           image_info=DestroyImageInfo(image_info);
           if (image != (Image *) NULL)
             image=DestroyImage(image);
diff --git a/config/english.xml b/config/english.xml
index 3f8765cc9..30316ca96 100644
--- a/config/english.xml
+++ b/config/english.xml
@@ -86,6 +86,9 @@
         <message name="CoderDoesNotSupportThisStreamType">
           coder does not support this stream tyype
         </message>
+        <message name="CoderNestedTooDeeply">
+          coder nested too deeply
+        </message>
         <message name="ColormapTypeNotSupported">
           colormap type not supported
         </message>
diff --git a/config/francais.xml b/config/francais.xml
index 4f7a65209..d01b11334 100644
--- a/config/francais.xml
+++ b/config/francais.xml
@@ -86,6 +86,9 @@
         <message name="CoderDoesNotSupportThisStreamType">
           coder does not support this stream tyype
         </message>
+        <message name="CoderNestedTooDeeply">
+          coder nested too deeply
+        </message>
         <message name="ColormapTypeNotSupported">
           table de couleurs non supportée
         </message>