Commit 3cb153f21 for imagemagick.org

commit 3cb153f2112a183316769387e52d784b87ce877d
Author: Cristy <urban-warrior@imagemagick.org>
Date:   Sun Sep 6 20:35:49 2026 -0400

    check for '>' terminator on DOCTYPE

diff --git a/MagickCore/color.c b/MagickCore/color.c
index 651695012..f3b45397f 100644
--- a/MagickCore/color.c
+++ b/MagickCore/color.c
@@ -2031,7 +2031,7 @@ static MagickBooleanType LoadColorCache(LinkedListInfo *cache,const char *xml,
         /*
           Doctype element.
         */
-        while ((LocaleNCompare(q,"]>",2) != 0) && (*q != '\0'))
+        while ((LocaleNCompare(q,"]>",2) != 0) && (*q != '>') && (*q != '\0'))
           (void) GetNextToken(q,&q,extent,token);
         continue;
       }
diff --git a/MagickCore/configure.c b/MagickCore/configure.c
index 6fafa67ca..2541bbfa8 100644
--- a/MagickCore/configure.c
+++ b/MagickCore/configure.c
@@ -1198,7 +1198,7 @@ static MagickBooleanType LoadConfigureCache(LinkedListInfo *cache,
         /*
           Doctype element.
         */
-        while ((LocaleNCompare(q,"]>",2) != 0) && (*q != '\0'))
+        while ((LocaleNCompare(q,"]>",2) != 0) && (*q != '>') && (*q != '\0'))
           (void) GetNextToken(q,&q,extent,token);
         continue;
       }
diff --git a/MagickCore/delegate.c b/MagickCore/delegate.c
index ffa5a9c7e..6313dbdcc 100644
--- a/MagickCore/delegate.c
+++ b/MagickCore/delegate.c
@@ -2107,7 +2107,7 @@ static MagickBooleanType LoadDelegateCache(LinkedListInfo *cache,
         /*
           Doctype element.
         */
-        while ((LocaleNCompare(q,"]>",2) != 0) && (*q != '\0'))
+        while ((LocaleNCompare(q,"]>",2) != 0) && (*q != '>') && (*q != '\0'))
           (void) GetNextToken(q,&q,extent,token);
         continue;
       }
diff --git a/MagickCore/locale.c b/MagickCore/locale.c
index be7c812cf..762c63ced 100644
--- a/MagickCore/locale.c
+++ b/MagickCore/locale.c
@@ -1222,12 +1222,8 @@ static MagickBooleanType LoadLocaleCache(SplayTreeInfo *cache,const char *xml,
         /*
           Doctype element.
         */
-        while ((LocaleNCompare(q,"]>",2) != 0) && (*q != '\0'))
-        {
+        while ((LocaleNCompare(q,"]>",2) != 0) && (*q != '>') && (*q != '\0'))
           (void) GetNextToken(q,&q,extent,token);
-          while (isspace((int) ((unsigned char) *q)) != 0)
-            q++;
-        }
         continue;
       }
     if (LocaleNCompare(keyword,"<!--",4) == 0)
diff --git a/MagickCore/log.c b/MagickCore/log.c
index 9aaac861b..27195695c 100644
--- a/MagickCore/log.c
+++ b/MagickCore/log.c
@@ -949,7 +949,7 @@ static MagickBooleanType LoadLogCache(LinkedListInfo *cache,const char *xml,
         /*
           Doctype element.
         */
-        while ((LocaleNCompare(q,"]>",2) != 0) && (*q != '\0'))
+        while ((LocaleNCompare(q,"]>",2) != 0) && (*q != '>') && (*q != '\0'))
           (void) GetNextToken(q,&q,extent,token);
         continue;
       }
diff --git a/MagickCore/opencl.c b/MagickCore/opencl.c
index d7ab1ad84..813453954 100644
--- a/MagickCore/opencl.c
+++ b/MagickCore/opencl.c
@@ -804,7 +804,7 @@ static void LoadOpenCLDeviceBenchmark(MagickCLEnv clEnv,const char *xml)
         /*
           Doctype element.
         */
-        while ((LocaleNCompare(q,"]>",2) != 0) && (*q != '\0'))
+        while ((LocaleNCompare(q,"]>",2) != 0) && (*q != '>') && (*q != '\0'))
           (void) GetNextToken(q,&q,extent,token);
         continue;
       }
diff --git a/MagickCore/policy.c b/MagickCore/policy.c
index 32781f89e..4dc1e67dd 100644
--- a/MagickCore/policy.c
+++ b/MagickCore/policy.c
@@ -1144,56 +1144,11 @@ static MagickBooleanType LoadPolicyCache(LinkedListInfo *cache,
     (void) CopyMagickString(keyword,token,MagickPathExtent);
     if (LocaleNCompare(keyword,"<!DOCTYPE",9) == 0)
       {
-        char
-          quote = '\0';
-
-        ssize_t
-          subset_depth = 0;
-
         /*
-          Skip to the end of the DOCTYPE declaration.
+          Doctype element.
         */
-        while (*q != '\0')
-        {
-          if (quote != '\0')
-            {
-              if (*q == quote)
-                quote='\0';
-              q++;
-              continue;
-            }
-          if ((*q == '\'') || (*q == '"'))
-            {
-              quote=(*q);
-              q++;
-              continue;
-            }
-          if (*q == '[')
-            {
-              subset_depth++;
-              q++;
-              continue;
-            }
-          if ((*q == ']') && (subset_depth > 0))
-            {
-              subset_depth--;
-              q++;
-              continue;
-            }
-          if ((*q == '>') && (subset_depth == 0))
-            {
-              q++;
-              break;
-            }
-          q++;
-        }
-        if (*q == '\0')
-          {
-            ThrowMagickException(exception,GetMagickModule(),
-              ConfigureError,"UnterminatedDOCTYPE","`%s'",filename);
-            policy_cache=DestroyLinkedList(policy_cache,DestroyPolicyElement);
-            return(MagickFalse);
-          }
+        while ((LocaleNCompare(q,"]>",2) != 0) && (*q != '>') && (*q != '\0'))
+          (void) GetNextToken(q,&q,extent,token);
         continue;
       }
     if (LocaleNCompare(keyword,"<!--",4) == 0)
diff --git a/MagickCore/type.c b/MagickCore/type.c
index 57a281aea..e6429289a 100644
--- a/MagickCore/type.c
+++ b/MagickCore/type.c
@@ -1123,7 +1123,7 @@ static MagickBooleanType LoadTypeCache(SplayTreeInfo *cache,const char *xml,
         /*
           Doctype element.
         */
-        while ((LocaleNCompare(q,"]>",2) != 0) && (*q != '\0'))
+        while ((LocaleNCompare(q,"]>",2) != 0) && (*q != '>') && (*q != '\0'))
           (void) GetNextToken(q,&q,extent,token);
         continue;
       }