Commit 6ff963c14 for imagemagick.org

commit 6ff963c14ccb5fefb4eb8654c8b0219033df2b20
Author: Cristy <urban-warrior@imagemagick.org>
Date:   Tue Sep 22 06:48:07 2026 -0400

    https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-pmqj-84pr-qc7c

diff --git a/MagickCore/constitute.c b/MagickCore/constitute.c
index 2993213a5..eae024f36 100644
--- a/MagickCore/constitute.c
+++ b/MagickCore/constitute.c
@@ -648,6 +648,12 @@ MagickExport Image *ReadImage(const ImageInfo *image_info,
     (void) LogMagickEvent(TraceEvent,GetMagickModule(),"%s",
       image_info->filename);
   assert(exception != (ExceptionInfo *) NULL);
+  if (((ImageInfo *) image_info)->coder_depth++ >= MagickMaxRecursionDepth)
+    {
+      (void) ThrowMagickException(exception,GetMagickModule(),CoderError,
+        "ImageRecursionDepthExceeded","`%s'",image_info->filename);
+      return((Image *) NULL);
+    }
   read_info=CloneImageInfo(image_info);
   (void) CopyMagickString(magick_filename,read_info->filename,MagickPathExtent);
   (void) SetImageInfo(read_info,0,exception);
diff --git a/MagickCore/draw.c b/MagickCore/draw.c
index 767ed65c2..1829eeb63 100644
--- a/MagickCore/draw.c
+++ b/MagickCore/draw.c
@@ -5771,7 +5771,7 @@ MagickExport MagickBooleanType DrawPrimitive(Image *image,

       if (primitive_info->text == (char *) NULL)
         break;
-      clone_info=AcquireImageInfo();
+      clone_info=CloneImageInfo(draw_info->image_info);
       composite_images=(Image *) NULL;
       if (LocaleNCompare(primitive_info->text,"data:",5) == 0)
         composite_images=ReadInlineImage(clone_info,primitive_info->text,
diff --git a/MagickCore/image.c b/MagickCore/image.c
index 2ef307636..642e4870a 100644
--- a/MagickCore/image.c
+++ b/MagickCore/image.c
@@ -1023,6 +1023,7 @@ MagickExport ImageInfo *CloneImageInfo(const ImageInfo *image_info)
     MagickPathExtent);
   clone_info->channel=image_info->channel;
   (void) CloneImageOptions(clone_info,image_info);
+  clone_info->coder_depth=image_info->coder_depth;
   clone_info->debug=image_info->debug;
   clone_info->signature=image_info->signature;
   return(clone_info);
@@ -1386,6 +1387,7 @@ MagickExport void GetImageInfo(ImageInfo *image_info)
   GetPixelInfoRGBA(BorderColorRGBA,&image_info->border_color);
   GetPixelInfoRGBA(MatteColorRGBA,&image_info->matte_color);
   GetPixelInfoRGBA(TransparentColorRGBA,&image_info->transparent_color);
+  image_info->coder_depth=0;
   image_info->debug=(GetLogEventMask() & ImageEvent) != 0 ? MagickTrue :
     MagickFalse;
   image_info->signature=MagickCoreSignature;
diff --git a/MagickCore/image.h b/MagickCore/image.h
index bbc3dfe33..8ecf6acfa 100644
--- a/MagickCore/image.h
+++ b/MagickCore/image.h
@@ -475,6 +475,9 @@ struct _ImageInfo

   PixelInfo
     matte_color;        /* matte (frame) color */
+
+  size_t
+    coder_depth;
 };

 extern MagickExport ChannelType
diff --git a/coders/svg.c b/coders/svg.c
index 3a68547c8..d8e10b9cd 100644
--- a/coders/svg.c
+++ b/coders/svg.c
@@ -195,9 +195,6 @@ typedef struct _SVGInfo
 static SemaphoreInfo
   *rsvg_semaphore = (SemaphoreInfo *) NULL;
 #endif
-
-static SplayTreeInfo
-  *svg_tree = (SplayTreeInfo *) NULL;

 /*
   Static declarations.
@@ -2720,9 +2717,6 @@ static void SVGEndElement(void *context,const xmlChar *name)
     {
       if (LocaleCompare((const char *) name,"image") == 0)
         {
-          char
-            thread_filename[MagickPathExtent];
-
           Image
             *image = (Image *) NULL;

@@ -2735,16 +2729,6 @@ static void SVGEndElement(void *context,const xmlChar *name)
               (void) FormatLocaleFile(svg_info->file,"pop graphic-context\n");
               break;
             }
-          GetMagickThreadFilename(svg_info->url,thread_filename);
-          if (GetValueFromSplayTree(svg_tree,thread_filename) != (const char *) NULL)
-            {
-              image_info=DestroyImageInfo(image_info);
-              (void) ThrowMagickException(svg_info->exception,GetMagickModule(),
-                DrawError,"VectorGraphicsNestedTooDeeply","`%s'",svg_info->url);
-              break;
-            }
-          (void) AddValueToSplayTree(svg_tree,ConstantString(thread_filename),
-            (void *) 1);
           (void) CopyMagickString(image_info->filename,svg_info->url,
             MagickPathExtent);
           if (LocaleNCompare(image_info->filename,"data:",5) == 0)
@@ -2754,7 +2738,6 @@ static void SVGEndElement(void *context,const xmlChar *name)
           image_info=DestroyImageInfo(image_info);
           if (image != (Image *) NULL)
             image=DestroyImage(image);
-          (void) DeleteNodeFromSplayTree(svg_tree,thread_filename);
           (void) FormatLocaleFile(svg_info->file,
             "image Over %g,%g %g,%g \"%s\"\n",svg_info->bounds.x,
             svg_info->bounds.y,svg_info->bounds.width,svg_info->bounds.height,
@@ -3435,9 +3418,6 @@ ModuleExport size_t RegisterSVGImage(void)
   MagickInfo
     *entry;

-  if (svg_tree == (SplayTreeInfo *) NULL)
-    svg_tree=NewSplayTree(CompareSplayTreeString,RelinquishMagickMemory,
-      (void *(*)(void *)) NULL);
   *version='\0';
 #if defined(LIBXML_DOTTED_VERSION)
   (void) CopyMagickString(version,"XML " LIBXML_DOTTED_VERSION,
@@ -3518,8 +3498,6 @@ ModuleExport void UnregisterSVGImage(void)
   (void) UnregisterMagickInfo("RSVG");
 #endif
   (void) UnregisterMagickInfo("MSVG");
-  if (svg_tree != (SplayTreeInfo *) NULL)
-    svg_tree=DestroySplayTree(svg_tree);
 }

 /*