From ec9c8944af2bfc65c697ca44f93a727a99b405f1 Mon Sep 17 00:00:00 2001 From: Cristy Date: Wed, 23 Oct 2019 06:01:08 -0400 Subject: [PATCH] [FG-VD-19-136] ImageMagick Convert SVG MacOS Denial Of Service --- coders/svg.c | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) diff --git a/coders/svg.c b/coders/svg.c index 2bc3c1f6b..1875ad04d 100644 --- a/coders/svg.c +++ b/coders/svg.c @@ -65,9 +65,10 @@ #include "MagickCore/module.h" #include "MagickCore/monitor.h" #include "MagickCore/monitor-private.h" -#include "MagickCore/quantum-private.h" +#include "MagickCore/option.h" #include "MagickCore/pixel-accessor.h" #include "MagickCore/property.h" +#include "MagickCore/quantum-private.h" #include "MagickCore/resource_.h" #include "MagickCore/static.h" #include "MagickCore/string_.h" @@ -3579,9 +3580,14 @@ static Image *ReadSVGImage(const ImageInfo *image_info,ExceptionInfo *exception) message[n]='\0'; if (n > 0) { + const char + *value; + svg_info->parser=xmlCreatePushParserCtxt(sax_handler,svg_info,(char *) message,n,image->filename); - (void) xmlCtxtUseOptions(svg_info->parser,XML_PARSE_HUGE); + value=GetImageOption(image_info,"svg:xml-parse-huge"); + if ((value != (char *) NULL) && (IsStringTrue(value) != MagickFalse)) + (void) xmlCtxtUseOptions(svg_info->parser,XML_PARSE_HUGE); while ((n=ReadBlob(image,MagickPathExtent-1,message)) != 0) { message[n]='\0'; -- 2.40.0