Commit 1b0cd979f for imagemagick.org

commit 1b0cd979f2177be0ef2d56b07fbcaf4a46667c24
Author: Cristy <urban-warrior@imagemagick.org>
Date:   Sat Oct 17 08:40:39 2026 -0400

    https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-pp97-v3gv-9vh4

diff --git a/MagickCore/xml-tree.c b/MagickCore/xml-tree.c
index c1b5cfa66..a330d829e 100644
--- a/MagickCore/xml-tree.c
+++ b/MagickCore/xml-tree.c
@@ -56,6 +56,7 @@
 #include "MagickCore/log.h"
 #include "MagickCore/memory_.h"
 #include "MagickCore/memory-private.h"
+#include "MagickCore/resource_.h"
 #include "MagickCore/semaphore.h"
 #include "MagickCore/string_.h"
 #include "MagickCore/string-private.h"
@@ -1024,6 +1025,9 @@ static char *ParseEntities(char *xml,char **entities,int state)
     byte,
     c;

+  MagickSizeType
+    entity_memory = 0;
+
   size_t
     extent,
     length;
@@ -1122,8 +1126,24 @@ static char *ParseEntities(char *xml,char **entities,int state)
                 if ((entity != (char *) NULL) &&
                     ((length-1L) >= (size_t) (entity-xml)))
                   {
+                    MagickSizeType
+                      allocation;
+
                     offset=(ssize_t) (xml-p);
                     extent=((size_t) offset+length+strlen(entity));
+                    /*
+                      Account for additional memory required by entity expansion.
+                    */
+                    allocation=(MagickSizeType) ((extent > strlen(p)) ?
+                      (extent-strlen(p)) : 0);
+                    if ((allocation != 0) &&
+                        (AcquireMagickResource(MemoryResource,allocation) == MagickFalse))
+                      {
+                        RelinquishMagickResource(MemoryResource,entity_memory);
+                        ThrowFatalException(ResourceLimitFatalError,
+                          "MemoryAllocationFailed");
+                      }
+                    entity_memory+=allocation;
                     if (p != q)
                       {
                         p=(char *) ResizeQuantumMemory(p,extent+1,sizeof(*p));
@@ -1146,8 +1166,12 @@ static char *ParseEntities(char *xml,char **entities,int state)
                         p=extent_xml;
                       }
                     if (p == (char *) NULL)
-                      ThrowFatalException(ResourceLimitFatalError,
-                        "MemoryAllocationFailed");
+                      {
+                        RelinquishMagickResource(MemoryResource,
+                          entity_memory);
+                        ThrowFatalException(ResourceLimitFatalError,
+                          "MemoryAllocationFailed");
+                      }
                     xml=p+offset;
                     entity=strchr(xml,';');
                   }
@@ -1185,6 +1209,8 @@ static char *ParseEntities(char *xml,char **entities,int state)
       if ((xml >= p) && (*xml == ' '))
         *xml='\0';
     }
+  if (entity_memory != 0)
+    RelinquishMagickResource(MemoryResource,entity_memory);
   return(p == q ? ConstantString(p) : p);
 }