From 0e28baf9bcb3e2e759f51cd0d74750e5e195b1aa Mon Sep 17 00:00:00 2001 From: Cristy Date: Wed, 23 Oct 2019 06:01:08 -0400 Subject: [PATCH] [FG-VD-19-136] ImageMagick Convert SVG MacOS Denial Of Service --- coders/svg.c | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) diff --git a/coders/svg.c b/coders/svg.c index 1fee4b8..26ac308 100644 --- a/coders/svg.c +++ b/coders/svg.c @@ -66,9 +66,10 @@ #include "magick/monitor.h" #include "magick/monitor-private.h" #include "magick/pixel-accessor.h" -#include "magick/quantum-private.h" +#include "magick/option.h" #include "magick/pixel-private.h" #include "magick/property.h" +#include "magick/quantum-private.h" #include "magick/resource_.h" #include "magick/static.h" #include "magick/string_.h" @@ -3579,9 +3580,14 @@ static Image *ReadSVGImage(const ImageInfo *image_info,ExceptionInfo *exception) message[n]='\0'; if (n > 0) { + const char + *value; + svg_info->parser=xmlCreatePushParserCtxt(sax_handler,svg_info,(char *) message,n,image->filename); - (void) xmlCtxtUseOptions(svg_info->parser,XML_PARSE_HUGE); + value=GetImageOption(image_info,"svg:xml-parse-huge"); + if ((value != (char *) NULL) && (IsStringTrue(value) != MagickFalse)) + (void) xmlCtxtUseOptions(svg_info->parser,XML_PARSE_HUGE); while ((n=ReadBlob(image,MaxTextExtent-1,message)) != 0) { message[n]='\0'; -- 2.30.0