Commit d53e028a3 for imagemagick.org

commit d53e028a3d4e01705c36d2ebaf14e095488ebaa6
Author: Dirk Lemstra <dirk@lemstra.org>
Date:   Thu Jul 16 14:48:21 2026 +0200

    No longer inline the method to reduce the local stack size.

diff --git a/MagickCore/policy-private.h b/MagickCore/policy-private.h
index ba551d558..bf115fbea 100644
--- a/MagickCore/policy-private.h
+++ b/MagickCore/policy-private.h
@@ -36,116 +36,15 @@ static const char
 </policymap>";
 #endif

+extern MagickExport MagickBooleanType
+  IsPathAuthorized(const PolicyRights,const char *);
+
 extern MagickPrivate MagickBooleanType
   PolicyComponentGenesis(void);

 extern MagickPrivate void
   PolicyComponentTerminus(void);

-static inline MagickBooleanType IsPathContainsSymlink(const char *path)
-{
-  char
-    partial[MagickPathExtent];
-
-  const char
-    *p;
-
-  ssize_t
-    offset = 0;
-
-  if (path == (const char *) NULL)
-    return(MagickFalse);
-  *partial='\0';
-  p=path;
-  if (*p == *DirectorySeparator)
-    {
-      /*
-        Path starts with a directory separator, include it.
-      */
-      if ((offset+1) >= (ssize_t) sizeof(partial))
-        return(MagickFalse);
-      partial[offset++]=(*p++);
-      partial[offset]='\0';
-    }
-  while (*p != '\0')
-  {
-    char
-      component[MagickPathExtent];
-
-    ssize_t
-      i = 0;
-
-    /*
-      Copy next component into a temporary buffer.
-    */
-    while ((*p != '\0') && (*p != *DirectorySeparator) &&
-           ((i+1) < (ssize_t) sizeof(component)))
-      component[i++]=(*p++);
-    component[i]='\0';
-    if (i == 0)
-      {
-        /*
-          skip repeated separators.
-        */
-        if (*p == *DirectorySeparator)
-          p++;
-        continue;
-      }
-    if ((offset > 0) && (partial[offset-1] != *DirectorySeparator))
-      {
-        /*
-          Append separator if needed.
-        */
-        if ((offset+1) >= (ssize_t) sizeof(partial))
-          return MagickFalse;
-        partial[offset++]=(*DirectorySeparator);
-        partial[offset]='\0';
-      }
-    /*
-      Append component.
-    */
-    if ((offset+i) >= (ssize_t) sizeof(partial))
-      return(MagickFalse);
-    (void) memcpy(partial+offset,component,i);
-    offset+=i;
-    partial[offset]='\0';
-    if (*p != '\0')
-      {
-        /*
-          Check whether this prefix is a symlink.
-        */
-        if (is_symlink_utf8(partial) != MagickFalse)
-          return(MagickTrue);
-      }
-    /*
-      Skip separator.
-    */
-    if (*p == *DirectorySeparator)
-      p++;
-  }
-  return(MagickFalse);
-}
-
-static inline MagickBooleanType IsPathAuthorized(const PolicyRights rights,
-  const char *path)
-{
-  MagickBooleanType symlink_follow_allowed = IsRightsAuthorizedByName(
-    SystemPolicyDomain,"symlink",rights,"follow");
-  MagickBooleanType status =
-   ((IsRightsAuthorized(PathPolicyDomain,rights,path) != MagickFalse) &&
-   ((symlink_follow_allowed != MagickFalse) ||
-    (is_symlink_utf8(path) == MagickFalse))) ? MagickTrue : MagickFalse;
-  if ((status != MagickFalse) && (symlink_follow_allowed == MagickFalse))
-    {
-      if ((is_symlink_utf8(path) != MagickFalse) ||
-          (IsPathContainsSymlink(path) != MagickFalse))
-        status=MagickFalse;
-    }
-  if (status != MagickFalse)
-    status=IsFileResourceIdentityValid(path);
-  return(status);
-}
-
 #if defined(__cplusplus) || defined(c_plusplus)
 }
 #endif
diff --git a/MagickCore/policy.c b/MagickCore/policy.c
index 9d24ea21b..3331ddb12 100644
--- a/MagickCore/policy.c
+++ b/MagickCore/policy.c
@@ -576,6 +576,136 @@ MagickExport char *GetPolicyValue(const char *name)
 %                                                                             %
 %                                                                             %
 %                                                                             %
++   I s P a t h A u t h o r i z e d                                           %
+%                                                                             %
+%                                                                             %
+%                                                                             %
+%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
+%
+%  IsPathAuthorized() determines if the specified path is authorized based on
+%  the current policy settings.
+%
+%  The format of the IsPathAuthorized method is:
+%
+%      MagickBooleanType IsPathAuthorized(const PolicyRights rights,
+%        const char *path)
+%
+%  A description of each parameter follows.
+%
+%    o rights: The policy rights to check.
+%
+%    o path: The path to check.
+%
+*/
+static inline MagickBooleanType IsPathContainsSymlink(const char *path)
+{
+  char
+    partial[MagickPathExtent];
+
+  const char
+    *p;
+
+  ssize_t
+    offset = 0;
+
+  if (path == (const char *) NULL)
+    return(MagickFalse);
+  *partial='\0';
+  p=path;
+  if (*p == *DirectorySeparator)
+    {
+      /*
+        Path starts with a directory separator, include it.
+      */
+      if ((offset+1) >= (ssize_t) sizeof(partial))
+        return(MagickFalse);
+      partial[offset++]=(*p++);
+      partial[offset]='\0';
+    }
+  while (*p != '\0')
+  {
+    char
+      component[MagickPathExtent];
+
+    ssize_t
+      i = 0;
+
+    /*
+      Copy next component into a temporary buffer.
+    */
+    while ((*p != '\0') && (*p != *DirectorySeparator) &&
+           ((i+1) < (ssize_t) sizeof(component)))
+      component[i++]=(*p++);
+    component[i]='\0';
+    if (i == 0)
+      {
+        /*
+          skip repeated separators.
+        */
+        if (*p == *DirectorySeparator)
+          p++;
+        continue;
+      }
+    if ((offset > 0) && (partial[offset-1] != *DirectorySeparator))
+      {
+        /*
+          Append separator if needed.
+        */
+        if ((offset+1) >= (ssize_t) sizeof(partial))
+          return MagickFalse;
+        partial[offset++]=(*DirectorySeparator);
+        partial[offset]='\0';
+      }
+    /*
+      Append component.
+    */
+    if ((offset+i) >= (ssize_t) sizeof(partial))
+      return(MagickFalse);
+    (void) memcpy(partial+offset,component,i);
+    offset+=i;
+    partial[offset]='\0';
+    if (*p != '\0')
+      {
+        /*
+          Check whether this prefix is a symlink.
+        */
+        if (is_symlink_utf8(partial) != MagickFalse)
+          return(MagickTrue);
+      }
+    /*
+      Skip separator.
+    */
+    if (*p == *DirectorySeparator)
+      p++;
+  }
+  return(MagickFalse);
+}
+
+MagickExport MagickBooleanType IsPathAuthorized(const PolicyRights rights,
+  const char *path)
+{
+  MagickBooleanType symlink_follow_allowed = IsRightsAuthorizedByName(
+    SystemPolicyDomain,"symlink",rights,"follow");
+  MagickBooleanType status =
+   ((IsRightsAuthorized(PathPolicyDomain,rights,path) != MagickFalse) &&
+   ((symlink_follow_allowed != MagickFalse) ||
+    (is_symlink_utf8(path) == MagickFalse))) ? MagickTrue : MagickFalse;
+  if ((status != MagickFalse) && (symlink_follow_allowed == MagickFalse))
+    {
+      if ((is_symlink_utf8(path) != MagickFalse) ||
+          (IsPathContainsSymlink(path) != MagickFalse))
+        status=MagickFalse;
+    }
+  if (status != MagickFalse)
+    status=IsFileResourceIdentityValid(path);
+  return(status);
+}
+
+/*
+%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
+%                                                                             %
+%                                                                             %
+%                                                                             %
 +   I s P o l i c y C a c h e I n s t a n t i a t e d                         %
 %                                                                             %
 %                                                                             %