In `SVGStartElement`, the `gradientTransform` and `transform` attribute
handlers reassign `value` to `tokens[j+1]` inside the inner token-parsing
loop. After the loop, all tokens are freed via `DestroyString()`. The
outer attribute loop then calls `DestroyString(value)`, which double-frees
the already-destroyed token string, causing SIGABRT.
Use a separate `token_value` local variable inside each inner loop instead
of reassigning `value`, so the outer loop's `DestroyString(value)` frees
the original `SVGEscapeString()`-allocated string exactly once.
Add regression test for SVG `gradientTransform` (#8582).
FixesImageMagick/ImageMagick#8582
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
* Minor change to fix complaint arising from -Werror=implicit-fallthrough
* Don't error when the data on read is short of expectation, exit instead.
* Convert other quantum formats to most suitable equivalents in SF3.
* Re-enable the SF3 validation tests now that they pass.
* Force the cast to make the windows build happy.
* Initialise quantum_info to make the windows build happy.
* Start working on SF3 support.
* Finish reading support including multiple layers
* Make the encoder work, too.
* Fill in the CRC32 checksum in the coder.
* Added ScaleColor4to8 and converse functions
* Implementation mostly done
* Build setup
* reordered processing of clut and pixels
* Added support for Shuffled CLUTs
* Revert "Added ScaleColor4to8 and converse functions"
This reverts commit b0bd8a59cc.
* Added more exceptions thrown when header is incorrect
* created enums and compacted rgb read functions
* Added alpha channel and changed alpha scaling
* Added support for format_type==1
* New define for assigning clut colors
* Changed names to avoid namespace conflicts
* Fixed alpha channel of RGB24 encoding
* Incorporated sanity check into the switch
Cristy
Dirk Lemstra
Ryan Williams
Yukari Hafner
Josh Soref
Cristy
Ramiro Balado