commit ec9c8944af2bfc65c697ca44f93a727a99b405f1
author Cristy <urban-warrior@imagemagick.org> Wed Oct 23 06:01:08 2019 -0400
committer Cristy <urban-warrior@imagemagick.org> Wed Oct 23 06:01:08 2019 -0400
tree a7dcb877b1a1e429c316f0765cb2ca72cfba8fda
parent 351fd50ab81ff32faeb20e11d97a0c824aa37ed9

[FG-VD-19-136] ImageMagick Convert SVG MacOS Denial Of Service

coders/svg.c

diff --git a/coders/svg.c b/coders/svg.c
index 2bc3c1f..1875ad0 100644
--- a/coders/svg.c
+++ b/coders/svg.c
@@ -65,9 +65,10 @@
 #include "MagickCore/module.h"
 #include "MagickCore/monitor.h"
 #include "MagickCore/monitor-private.h"
-#include "MagickCore/quantum-private.h"
+#include "MagickCore/option.h"
 #include "MagickCore/pixel-accessor.h"
 #include "MagickCore/property.h"
+#include "MagickCore/quantum-private.h"
 #include "MagickCore/resource_.h"
 #include "MagickCore/static.h"
 #include "MagickCore/string_.h"
@@ -3579,9 +3580,14 @@
   message[n]='\0';
   if (n > 0)
     {
+      const char
+        *value;
+
       svg_info->parser=xmlCreatePushParserCtxt(sax_handler,svg_info,(char *)
         message,n,image->filename);
-      (void) xmlCtxtUseOptions(svg_info->parser,XML_PARSE_HUGE);
+      value=GetImageOption(image_info,"svg:xml-parse-huge");
+      if ((value != (char *) NULL) && (IsStringTrue(value) != MagickFalse))
+        (void) xmlCtxtUseOptions(svg_info->parser,XML_PARSE_HUGE);
       while ((n=ReadBlob(image,MagickPathExtent-1,message)) != 0)
       {
         message[n]='\0';