Commit a28f038cd for imagemagick.org

commit a28f038cd7d8490f1f25cf84dac1389a92e89c76
Author: Cristy <urban-warrior@imagemagick.org>
Date:   Sat Oct 17 09:10:45 2026 -0400

    https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-pp97-v3gv-9vh4

diff --git a/MagickCore/xml-tree.c b/MagickCore/xml-tree.c
index a330d829e..979f13143 100644
--- a/MagickCore/xml-tree.c
+++ b/MagickCore/xml-tree.c
@@ -56,7 +56,6 @@
 #include "MagickCore/log.h"
 #include "MagickCore/memory_.h"
 #include "MagickCore/memory-private.h"
-#include "MagickCore/resource_.h"
 #include "MagickCore/semaphore.h"
 #include "MagickCore/string_.h"
 #include "MagickCore/string-private.h"
@@ -1025,9 +1024,6 @@ static char *ParseEntities(char *xml,char **entities,int state)
     byte,
     c;

-  MagickSizeType
-    entity_memory = 0;
-
   size_t
     extent,
     length;
@@ -1126,24 +1122,8 @@ static char *ParseEntities(char *xml,char **entities,int state)
                 if ((entity != (char *) NULL) &&
                     ((length-1L) >= (size_t) (entity-xml)))
                   {
-                    MagickSizeType
-                      allocation;
-
                     offset=(ssize_t) (xml-p);
                     extent=((size_t) offset+length+strlen(entity));
-                    /*
-                      Account for additional memory required by entity expansion.
-                    */
-                    allocation=(MagickSizeType) ((extent > strlen(p)) ?
-                      (extent-strlen(p)) : 0);
-                    if ((allocation != 0) &&
-                        (AcquireMagickResource(MemoryResource,allocation) == MagickFalse))
-                      {
-                        RelinquishMagickResource(MemoryResource,entity_memory);
-                        ThrowFatalException(ResourceLimitFatalError,
-                          "MemoryAllocationFailed");
-                      }
-                    entity_memory+=allocation;
                     if (p != q)
                       {
                         p=(char *) ResizeQuantumMemory(p,extent+1,sizeof(*p));
@@ -1165,13 +1145,9 @@ static char *ParseEntities(char *xml,char **entities,int state)
                           }
                         p=extent_xml;
                       }
-                    if (p == (char *) NULL)
-                      {
-                        RelinquishMagickResource(MemoryResource,
-                          entity_memory);
-                        ThrowFatalException(ResourceLimitFatalError,
-                          "MemoryAllocationFailed");
-                      }
+                    if ((p == (char *) NULL) || (strlen(p) > GetMaxProfileSize()))
+                      ThrowFatalException(ResourceLimitFatalError,
+                        "MemoryAllocationFailed");
                     xml=p+offset;
                     entity=strchr(xml,';');
                   }
@@ -1209,8 +1185,6 @@ static char *ParseEntities(char *xml,char **entities,int state)
       if ((xml >= p) && (*xml == ' '))
         *xml='\0';
     }
-  if (entity_memory != 0)
-    RelinquishMagickResource(MemoryResource,entity_memory);
   return(p == q ? ConstantString(p) : p);
 }

diff --git a/config/policy-limited.xml b/config/policy-limited.xml
index ab49c6d82..5d914e9f8 100644
--- a/config/policy-limited.xml
+++ b/config/policy-limited.xml
@@ -134,4 +134,7 @@
   <!-- Maximum size of a single allocation request. -->
   <policy domain="system" name="max-memory-request" value="512MiB"/>

+  <!-- Maximum size of an image profile. -->
+  <policy domain="system" name="max-profile-size" value="256MiB"/>
+
 </policymap>
diff --git a/config/policy-open.xml b/config/policy-open.xml
index 44edfc97a..d3f2af3da 100644
--- a/config/policy-open.xml
+++ b/config/policy-open.xml
@@ -204,6 +204,10 @@
   <!-- <policy domain="system" name="max-memory-request"
              value="256MiB"/> -->

+  <!-- Maximum size of an image profile. -->
+  <!-- <policy domain="system" name="max-profile-size"
+             value="256MiB"/> -->
+
   <!-- Refuse paths whose basename is a symbolic link. -->
   <!-- <policy domain="system"
              name="symlink"
diff --git a/config/policy-secure.xml b/config/policy-secure.xml
index d90b3b765..e55147992 100644
--- a/config/policy-secure.xml
+++ b/config/policy-secure.xml
@@ -131,6 +131,9 @@
   <!-- Maximum single memory allocation request. -->
   <policy domain="system" name="max-memory-request" value="256MiB"/>

+  <!-- Maximum size of a single image profile. -->
+  <policy domain="system" name="max-profile-size" value="256MiB"/>
+
   <!-- Fail if the target path is a symbolic link. -->
   <policy domain="system" name="symlink"
           rights="none" pattern="follow"/>
diff --git a/config/policy-websafe.xml b/config/policy-websafe.xml
index 82acb8ab8..84c19056d 100644
--- a/config/policy-websafe.xml
+++ b/config/policy-websafe.xml
@@ -84,6 +84,9 @@
   <!-- Prevent excessively large single memory allocation requests. -->
   <policy domain="system" name="max-memory-request" value="512MiB"/>

+  <!-- Maximum size of a single image profile. -->
+  <policy domain="system" name="max-profile-size" value="256MiB"/>
+
   <!-- ============================================================= -->
   <!-- Path Restrictions                                              -->
   <!-- ============================================================= -->