diff --git a/meta-oe/recipes-support/imagemagick/files/CVE-2025-68618.patch b/meta-oe/recipes-support/imagemagick/files/CVE-2025-68618.patch new file mode 100644 index 0000000000..c846b0cc31 --- /dev/null +++ b/meta-oe/recipes-support/imagemagick/files/CVE-2025-68618.patch @@ -0,0 +1,95 @@ +From 6f431d445f3ddd609c004a1dde617b0a73e60beb Mon Sep 17 00:00:00 2001 +From: Cristy +Date: Sun, 21 Dec 2025 12:43:08 -0500 + +Subject: [PATCH] imagemagick: Fix CVE-2025-68618 +CVE: CVE-2025-68618 +Upstream-Status: Backport [https://github.com/ImageMagick/ImageMagick/commit/6f431d445f3ddd609c004a1dde617b0a73e60beb] +Signed-off-by: Nitin Wankhade +=== +diff --git a/coders/msl.c b/coders/msl.c +index 68abd7d..0e8f632 100644 +--- a/coders/msl.c ++++ b/coders/msl.c +@@ -126,6 +126,7 @@ typedef struct _MSLInfo + + ssize_t + n, ++ depth, + number_groups; + + ImageInfo +@@ -660,13 +661,13 @@ static void MSLStartElement(void *context,const xmlChar *tag, + RectangleInfo + geometry; + +- ssize_t +- i; +- + size_t + height, + width; + ++ ssize_t ++ i; ++ + /* + Called when an opening tag has been processed. + */ +@@ -674,6 +675,13 @@ static void MSLStartElement(void *context,const xmlChar *tag, + " SAX.startElement(%s",tag); + exception=AcquireExceptionInfo(); + msl_info=(MSLInfo *) context; ++ if (msl_info->depth++ >= MagickMaxRecursionDepth) ++ { ++ (void) ThrowMagickException(msl_info->exception,GetMagickModule(), ++ DrawError,"VectorGraphicsNestedTooDeeply","`%s'",tag); ++ xmlStopParser((xmlParserCtxtPtr) context); ++ return; ++ } + n=msl_info->n; + keyword=(const char *) NULL; + value=(char *) NULL; +@@ -7430,12 +7438,12 @@ static void MSLStartElement(void *context,const xmlChar *tag, + + static void MSLEndElement(void *context,const xmlChar *tag) + { +- ssize_t +- n; +- + MSLInfo + *msl_info; + ++ ssize_t ++ n; ++ + /* + Called when the end of an element has been detected. + */ +@@ -7525,6 +7533,7 @@ static void MSLEndElement(void *context,const xmlChar *tag) + } + if (msl_info->content != (char *) NULL) + msl_info->content=DestroyString(msl_info->content); ++ msl_info->depth--; + } + + static void MSLCharacters(void *context,const xmlChar *c,int length) +diff --git a/coders/svg.c b/coders/svg.c +index 5caf8af..ab139e2 100644 +--- a/coders/svg.c ++++ b/coders/svg.c +@@ -1270,7 +1270,13 @@ static void SVGStartElement(void *context,const xmlChar *name, + (void) LogMagickEvent(CoderEvent,GetMagickModule()," SAX.startElement(%s", + name); + svg_info=(SVGInfo *) context; +- svg_info->n++; ++ if (svg_info->n++ > MagickMaxRecursionDepth) ++ { ++ (void) ThrowMagickException(svg_info->exception,GetMagickModule(), ++ DrawError,"VectorGraphicsNestedTooDeeply","`%s'",name); ++ xmlStopParser((xmlParserCtxtPtr) context); ++ return; ++ } + svg_info->scale=(double *) ResizeQuantumMemory(svg_info->scale, + svg_info->n+1UL,sizeof(*svg_info->scale)); + if (svg_info->scale == (double *) NULL) diff --git a/meta-oe/recipes-support/imagemagick/imagemagick_7.0.10.bb b/meta-oe/recipes-support/imagemagick/imagemagick_7.0.10.bb index 7b2d33ccb8..1afc8bbe2c 100644 --- a/meta-oe/recipes-support/imagemagick/imagemagick_7.0.10.bb +++ b/meta-oe/recipes-support/imagemagick/imagemagick_7.0.10.bb @@ -50,6 +50,7 @@ SRC_URI = "git://github.com/ImageMagick/ImageMagick.git;branch=main;protocol=htt file://CVE-2025-62171.patch \ file://CVE-2025-43965.patch \ file://CVE-2025-66628.patch \ + file://CVE-2025-68618.patch \ " SRCREV = "35b4991eb0939a327f3489988c366e21068b0178"