Commit 6f431d445 for imagemagick.org

commit 6f431d445f3ddd609c004a1dde617b0a73e60beb
Author: Cristy <urban-warrior@imagemagick.org>
Date:   Sun Dec 21 12:43:08 2025 -0500

    https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-p27m-hp98-6637

diff --git a/coders/msl.c b/coders/msl.c
index 2424e9883..8ede13b81 100644
--- a/coders/msl.c
+++ b/coders/msl.c
@@ -120,6 +120,7 @@ typedef struct _MSLInfo
     *exception;

   ssize_t
+    depth,
     n,
     number_groups;

@@ -328,6 +329,10 @@ static void MSLStartElement(void *context,const xmlChar *tag,
   RectangleInfo
     geometry;

+  size_t
+    height,
+    width;
+
   ssize_t
     i,
     j,
@@ -336,11 +341,6 @@ static void MSLStartElement(void *context,const xmlChar *tag,
     x,
     y;

-
-  size_t
-    height,
-    width;
-
   xmlParserCtxtPtr
     parser;

@@ -352,6 +352,13 @@ static void MSLStartElement(void *context,const xmlChar *tag,
   exception=AcquireExceptionInfo();
   parser=(xmlParserCtxtPtr) context;
   msl_info=(MSLInfo *) parser->_private;
+  if (msl_info->depth++ >= MagickMaxRecursionDepth)
+    {
+      (void) ThrowMagickException(msl_info->exception,GetMagickModule(),
+        DrawError,"VectorGraphicsNestedTooDeeply","`%s'",tag);
+      xmlStopParser((xmlParserCtxtPtr) context);
+      return;
+    }
   n=msl_info->n;
   keyword=(const char *) NULL;
   value=(char *) NULL;
@@ -7057,15 +7064,15 @@ static void MSLStartElement(void *context,const xmlChar *tag,

 static void MSLEndElement(void *context,const xmlChar *tag)
 {
-  ssize_t
-    n;
-
   MSLInfo
     *msl_info;

   xmlParserCtxtPtr
     parser;

+  ssize_t
+    n;
+
   /*
     Called when the end of an element has been detected.
   */
@@ -7158,6 +7165,7 @@ static void MSLEndElement(void *context,const xmlChar *tag)
   }
   if (msl_info->content != (char *) NULL)
     msl_info->content=DestroyString(msl_info->content);
+  msl_info->depth--;
 }

 static void MSLCharacters(void *context,const xmlChar *c,int length)
diff --git a/coders/svg.c b/coders/svg.c
index ed662770d..5d042cce8 100644
--- a/coders/svg.c
+++ b/coders/svg.c
@@ -1250,7 +1250,13 @@ static void SVGStartElement(void *context,const xmlChar *name,
     name);
   parser=(xmlParserCtxtPtr) context;
   svg_info=(SVGInfo *) parser->_private;
-  svg_info->n++;
+  if (svg_info->n++ > MagickMaxRecursionDepth)
+    {
+      (void) ThrowMagickException(svg_info->exception,GetMagickModule(),
+        DrawError,"VectorGraphicsNestedTooDeeply","`%s'",name);
+      xmlStopParser((xmlParserCtxtPtr) context);
+      return;
+    }
   svg_info->scale=(double *) ResizeQuantumMemory(svg_info->scale,(size_t)
     svg_info->n+1,sizeof(*svg_info->scale));
   if (svg_info->scale == (double *) NULL)