diff mbox series

[meta-oe,whinlatter,02/11] imagemagick: patch CVE-2026-24484

Message ID 20260306150602.616834-2-skandigraun@gmail.com
State New
Headers show
Series [meta-oe,whinlatter,01/11] imagemagick: patch CVE-2026-24481 | expand

Commit Message

Gyorgy Sarvari March 6, 2026, 3:05 p.m. UTC 
Details: https://nvd.nist.gov/vuln/detail/CVE-2026-24484

Backport the commit referenced by the NVD advisory.

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
---
 .../imagemagick/CVE-2026-24484.patch          | 27 +++++++++++++++++++
 .../imagemagick/imagemagick_7.1.2-13.bb       |  1 +
 2 files changed, 28 insertions(+)
 create mode 100644 meta-oe/recipes-support/imagemagick/imagemagick/CVE-2026-24484.patch
diff mbox series

Patch

diff --git a/meta-oe/recipes-support/imagemagick/imagemagick/CVE-2026-24484.patch b/meta-oe/recipes-support/imagemagick/imagemagick/CVE-2026-24484.patch
new file mode 100644
index 0000000000..b3e094f7c2
--- /dev/null
+++ b/meta-oe/recipes-support/imagemagick/imagemagick/CVE-2026-24484.patch
@@ -0,0 +1,27 @@ 
+From fd210bafa27b174f3054e7ec6da4c8cadbd75565 Mon Sep 17 00:00:00 2001
+From: Cristy <urban-warrior@imagemagick.org>
+Date: Fri, 23 Jan 2026 20:27:02 -0500
+Subject: [PATCH] 
+ https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-wg3g-gvx5-2pmv
+
+CVE: CVE-2026-24484
+Upstream-Status: Backport [https://github.com/ImageMagick/ImageMagick/commit/0349df6d43d633bd61bb582d1e1e87d6332de32a]
+Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
+---
+ coders/svg.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/coders/svg.c b/coders/svg.c
+index f18f86460..2f8a27ebc 100644
+--- a/coders/svg.c
++++ b/coders/svg.c
+@@ -4235,6 +4235,9 @@ static MagickBooleanType WriteSVGImage(const ImageInfo *image_info,Image *image,
+             if (LocaleCompare("graphic-context",token) == 0)
+               {
+                 n++;
++                if (n == MagickMaxRecursionDepth)
++                  ThrowWriterException(DrawError,
++                    "VectorGraphicsNestedTooDeeply");
+                 if (active)
+                   {
+                     AffineToTransform(image,&affine);
diff --git a/meta-oe/recipes-support/imagemagick/imagemagick_7.1.2-13.bb b/meta-oe/recipes-support/imagemagick/imagemagick_7.1.2-13.bb
index adf65880b6..991b2e363d 100644
--- a/meta-oe/recipes-support/imagemagick/imagemagick_7.1.2-13.bb
+++ b/meta-oe/recipes-support/imagemagick/imagemagick_7.1.2-13.bb
@@ -16,6 +16,7 @@  SRC_URI = "git://github.com/ImageMagick/ImageMagick.git;branch=main;protocol=htt
            file://run-ptest \
            file://imagemagick-ptest.sh \
            file://CVE-2026-24481.patch \
+           file://CVE-2026-24484.patch \
            "
 
 SRCREV = "dd991e286b96918917a3392d6dc3ffc0e6907a4e"