Commit 93b67e25e for imagemagick.org

commit 93b67e25e3db42aae3c9bacad80af29a61c7bee5
Author: Cristy <urban-warrior@imagemagick.org>
Date:   Wed Sep 23 20:26:47 2026 -0400

    always check >= max recursion depth

diff --git a/MagickCore/color.c b/MagickCore/color.c
index ff8177093..affac046a 100644
--- a/MagickCore/color.c
+++ b/MagickCore/color.c
@@ -2088,7 +2088,7 @@ static MagickBooleanType LoadColorCache(LinkedListInfo *cache,const char *xml,
           (void) GetNextToken(q,&q,extent,token);
           if (LocaleCompare(keyword,"file") == 0)
             {
-              if (depth > MagickMaxRecursionDepth)
+              if (depth >= MagickMaxRecursionDepth)
                 (void) ThrowMagickException(exception,GetMagickModule(),
                   ConfigureError,"IncludeElementNestedTooDeeply","`%s'",token);
               else
diff --git a/MagickCore/configure.c b/MagickCore/configure.c
index 6a910ffd2..5d7660e70 100644
--- a/MagickCore/configure.c
+++ b/MagickCore/configure.c
@@ -1255,7 +1255,7 @@ static MagickBooleanType LoadConfigureCache(LinkedListInfo *cache,
           (void) GetNextToken(q,&q,extent,token);
           if (LocaleCompare(keyword,"file") == 0)
             {
-              if (depth > MagickMaxRecursionDepth)
+              if (depth >= MagickMaxRecursionDepth)
                 (void) ThrowMagickException(exception,GetMagickModule(),
                   ConfigureError,"IncludeElementNestedTooDeeply","`%s'",token);
               else
diff --git a/MagickCore/constitute-private.h b/MagickCore/constitute-private.h
index f81b9d604..f4d4d036b 100644
--- a/MagickCore/constitute-private.h
+++ b/MagickCore/constitute-private.h
@@ -29,31 +29,40 @@ extern "C" {
 #include "MagickCore/magick-private.h"
 #include "MagickCore/utility.h"

-static inline Image *StrictReadImage(const ImageInfo *image_info,
+static inline Image *StrictReadImage(ImageInfo *image_info,
   ExceptionInfo *exception)
 {
   char
     magic[MagickPathExtent];

-  if (((ImageInfo *) image_info)->coder_depth++ > MagickMaxRecursionDepth)
+  if (image_info->coder_depth >= MagickMaxRecursionDepth)
     {
-      (void) ThrowMagickException(exception,GetMagickModule(),
-        OptionError,"ImageNestedTooDeeply","`%s'",image_info->filename);
+      errno=EPERM;
+      (void) ThrowMagickException(exception,GetMagickModule(),OptionError,
+        "ImageNestedTooDeeply","`%s'",image_info->filename);
       return((Image *) NULL);
     }
   (void) GetPathComponent(image_info->filename,MagickPath,magic);
   if (*magic != '\0')
     {
       const MagickInfo *magick_info = GetMagickInfo(magic,exception);
-      if ((magick_info != (const MagickInfo *) NULL) &&
-          (GetMagickExplicitAllowed(magick_info) != MagickFalse))
-        return(ReadImage(image_info,exception));
-      else
+      if ((magick_info == (const MagickInfo *) NULL) ||
+          (GetMagickExplicitAllowed(magick_info) == MagickFalse))
         {
           (void) ThrowMagickException(exception,GetMagickModule(),ImageError,
             "ExplicitCoderNotAllowed","`%s'",image_info->filename);
           return((Image *) NULL);
         }
+      else
+        {
+          Image
+            *image;
+
+          image_info->coder_depth++;
+          image=ReadImage(image_info,exception);
+          image_info->coder_depth--;
+          return(image);
+        }
     }
   if (IsPathAccessible(image_info->filename) == MagickFalse)
     {
diff --git a/MagickCore/delegate.c b/MagickCore/delegate.c
index 6ca481cec..d8b59cc46 100644
--- a/MagickCore/delegate.c
+++ b/MagickCore/delegate.c
@@ -2205,7 +2205,7 @@ static MagickBooleanType LoadDelegateCache(LinkedListInfo *cache,
           (void) GetNextToken(q,&q,extent,token);
           if (LocaleCompare(keyword,"file") == 0)
             {
-              if (depth > MagickMaxRecursionDepth)
+              if (depth >= MagickMaxRecursionDepth)
                 (void) ThrowMagickException(exception,GetMagickModule(),
                   ConfigureError,"IncludeElementNestedTooDeeply","`%s'",token);
               else
diff --git a/MagickCore/draw.c b/MagickCore/draw.c
index 1829eeb63..f5fc88c17 100644
--- a/MagickCore/draw.c
+++ b/MagickCore/draw.c
@@ -2440,7 +2440,7 @@ static SplayTreeInfo *GetMVGMacros(const char *primitive,
                 }
               if (LocaleCompare(token,"push") == 0)
                 {
-                  if (n++ > MagickMaxRecursionDepth)
+                  if (n++ >= MagickMaxRecursionDepth)
                     {
                       (void) ThrowMagickException(exception,GetMagickModule(),
                         DrawError,"VectorGraphicsNestedTooDeeply","`%s'",token);
@@ -2600,7 +2600,7 @@ static MagickBooleanType RenderMVGContent(Image *image,
   assert(draw_info->signature == MagickCoreSignature);
   if (IsEventLogging() != MagickFalse)
     (void) LogMagickEvent(TraceEvent,GetMagickModule(),"%s",image->filename);
-  if (depth > MagickMaxRecursionDepth)
+  if (depth >= MagickMaxRecursionDepth)
     ThrowBinaryException(DrawError,"VectorGraphicsNestedTooDeeply",
       image->filename);
   if ((draw_info->primitive == (char *) NULL) ||
@@ -2801,7 +2801,7 @@ static MagickBooleanType RenderMVGContent(Image *image,
                 break;
             if (i <= n)
               break;
-            if (classDepth++ > MagickMaxRecursionDepth)
+            if (classDepth++ >= MagickMaxRecursionDepth)
               {
                 (void) ThrowMagickException(exception,GetMagickModule(),
                   DrawError,"VectorGraphicsNestedTooDeeply","`%s'",token);
@@ -3569,7 +3569,7 @@ static MagickBooleanType RenderMVGContent(Image *image,
                     (void) GetNextToken(q,&q,extent,token);
                     (void) CloneString(&graphic_context[n]->id,token);
                   }
-                if (n > MagickMaxRecursionDepth)
+                if (n >= MagickMaxRecursionDepth)
                   {
                     (void) ThrowMagickException(exception,GetMagickModule(),
                       DrawError,"VectorGraphicsNestedTooDeeply","`%s'",
diff --git a/MagickCore/locale.c b/MagickCore/locale.c
index 1406f8215..e94340e67 100644
--- a/MagickCore/locale.c
+++ b/MagickCore/locale.c
@@ -1289,7 +1289,7 @@ static MagickBooleanType LoadLocaleCache(SplayTreeInfo *cache,const char *xml,
             }
           if (LocaleCompare(keyword,"file") == 0)
             {
-              if (depth > MagickMaxRecursionDepth)
+              if (depth >= MagickMaxRecursionDepth)
                 (void) ThrowMagickException(exception,GetMagickModule(),
                   ConfigureError,"IncludeElementNestedTooDeeply","`%s'",token);
               else
diff --git a/MagickCore/log.c b/MagickCore/log.c
index 4c7f1df01..f9377e1f8 100644
--- a/MagickCore/log.c
+++ b/MagickCore/log.c
@@ -1006,7 +1006,7 @@ static MagickBooleanType LoadLogCache(LinkedListInfo *cache,const char *xml,
           (void) GetNextToken(q,&q,extent,token);
           if (LocaleCompare(keyword,"file") == 0)
             {
-              if (depth > MagickMaxRecursionDepth)
+              if (depth >= MagickMaxRecursionDepth)
                 (void) ThrowMagickException(exception,GetMagickModule(),
                   ConfigureError,"IncludeElementNestedTooDeeply","`%s'",token);
               else
diff --git a/MagickCore/mime.c b/MagickCore/mime.c
index 707220ef4..8aae27bd8 100644
--- a/MagickCore/mime.c
+++ b/MagickCore/mime.c
@@ -837,7 +837,7 @@ static MagickBooleanType LoadMimeCache(LinkedListInfo *cache,const char *xml,
     attribute=GetXMLTreeAttribute(include,"file");
     if (attribute != (const char *) NULL)
       {
-        if (depth > MagickMaxRecursionDepth)
+        if (depth >= MagickMaxRecursionDepth)
           (void) ThrowMagickException(exception,GetMagickModule(),
             ConfigureError,"IncludeElementNestedTooDeeply","`%s'",filename);
         else
diff --git a/MagickCore/policy.c b/MagickCore/policy.c
index fe5dd1302..b15dc0e36 100644
--- a/MagickCore/policy.c
+++ b/MagickCore/policy.c
@@ -1204,7 +1204,7 @@ static MagickBooleanType LoadPolicyCache(LinkedListInfo *cache,
           (void) GetNextToken(q,&q,extent,token);
           if (LocaleCompare(keyword,"file") == 0)
             {
-              if (depth > MagickMaxRecursionDepth)
+              if (depth >= MagickMaxRecursionDepth)
                 (void) ThrowMagickException(exception,GetMagickModule(),
                   ConfigureError,"IncludeElementNestedTooDeeply","`%s'",token);
               else
diff --git a/MagickCore/token.c b/MagickCore/token.c
index 4f884b129..db7d105e4 100644
--- a/MagickCore/token.c
+++ b/MagickCore/token.c
@@ -356,7 +356,7 @@ static MagickBooleanType GlobExpression_(const char *magick_restrict expression,
   const char *magick_restrict pattern,const MagickBooleanType case_insensitive,
   const size_t depth)
 {
-  if (depth > MagickMaxRecursionDepth)
+  if (depth >= MagickMaxRecursionDepth)
     {
       errno=EOVERFLOW;
       return(MagickFalse);
diff --git a/MagickCore/type.c b/MagickCore/type.c
index c5c1bfc68..5830ff19b 100644
--- a/MagickCore/type.c
+++ b/MagickCore/type.c
@@ -1180,7 +1180,7 @@ static MagickBooleanType LoadTypeCache(SplayTreeInfo *cache,const char *xml,
           (void) GetNextToken(q,&q,extent,token);
           if (LocaleCompare(keyword,"file") == 0)
             {
-              if (depth > MagickMaxRecursionDepth)
+              if (depth >= MagickMaxRecursionDepth)
                 (void) ThrowMagickException(exception,GetMagickModule(),
                   ConfigureError,"IncludeNodeNestedTooDeeply","`%s'",token);
               else
diff --git a/MagickCore/xml-tree.c b/MagickCore/xml-tree.c
index 073cb5a1a..71ceb3374 100644
--- a/MagickCore/xml-tree.c
+++ b/MagickCore/xml-tree.c
@@ -530,7 +530,7 @@ static XMLTreeInfo *DestroyXMLTree_(XMLTreeInfo *xml_info,
          (((XMLTreeRoot *) xml_info)->signature == MagickCoreSignature));
   if (IsEventLogging() != MagickFalse)
     (void) LogMagickEvent(TraceEvent,GetMagickModule(),"...");
-  if (depth > MagickMaxRecursionDepth)
+  if (depth >= MagickMaxRecursionDepth)
     return((XMLTreeInfo *) NULL);
   DestroyXMLTreeChild(xml_info,depth+1);
   DestroyXMLTreeOrdered(xml_info,depth+1);
@@ -1248,7 +1248,7 @@ static MagickBooleanType ValidateEntities(char *tag,char *xml,
   /*
     Check for circular entity references.
   */
-  if (depth > MagickMaxRecursionDepth)
+  if (depth >= MagickMaxRecursionDepth)
     return(MagickFalse);
   for ( ; ; xml++)
   {