Commit c8868afaf for imagemagick.org
commit c8868afaf0fe901cddb52177971de25c33f8aa02
Author: Cristy <urban-warrior@imagemagick.org>
Date: Sat Jun 13 17:09:21 2026 -0400
https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-mx48-2qq3-23hf
diff --git a/MagickCore/draw.c b/MagickCore/draw.c
index 56b1b44ac..81f125373 100644
--- a/MagickCore/draw.c
+++ b/MagickCore/draw.c
@@ -2366,7 +2366,8 @@ static int MVGMacroCompare(const void *target,const void *source)
return(strcmp(p,q));
}
-static SplayTreeInfo *GetMVGMacros(const char *primitive)
+static SplayTreeInfo *GetMVGMacros(const char *primitive,
+ ExceptionInfo *exception)
{
char
*macro,
@@ -2435,7 +2436,14 @@ static SplayTreeInfo *GetMVGMacros(const char *primitive)
n--;
}
if (LocaleCompare(token,"push") == 0)
- n++;
+ {
+ if (n++ > MagickMaxRecursionDepth)
+ {
+ (void) ThrowMagickException(exception,GetMagickModule(),
+ DrawError,"VectorGraphicsNestedTooDeeply","`%s'",token);
+ break;
+ }
+ }
if ((n == 0) && (end >= start))
{
size_t
@@ -2657,7 +2665,7 @@ static MagickBooleanType RenderMVGContent(Image *image,
defsDepth=0;
symbolDepth=0;
cursor=0.0;
- macros=GetMVGMacros(primitive);
+ macros=GetMVGMacros(primitive,exception);
status=MagickTrue;
for (q=primitive; *q != '\0'; )
{