mirror of
https://github.com/ImageMagick/ImageMagick.git
synced 2026-10-01 13:56:46 +02:00
Ryan WilliamsandClaude Opus 4.6
bd4a469adb
In `SVGStartElement`, the `gradientTransform` and `transform` attribute handlers reassign `value` to `tokens[j+1]` inside the inner token-parsing loop. After the loop, all tokens are freed via `DestroyString()`. The outer attribute loop then calls `DestroyString(value)`, which double-frees the already-destroyed token string, causing SIGABRT. Use a separate `token_value` local variable inside each inner loop instead of reassigning `value`, so the outer loop's `DestroyString(value)` frees the original `SVGEscapeString()`-allocated string exactly once. Add regression test for SVG `gradientTransform` (#8582). Fixes ImageMagick/ImageMagick#8582 Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
10 lines
357 B
XML
10 lines
357 B
XML
<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 100 100">
|
|
<defs>
|
|
<linearGradient id="g" gradientTransform="matrix(1 0 0 1 0 0)" gradientUnits="userSpaceOnUse">
|
|
<stop offset="0" style="stop-color:red"/>
|
|
<stop offset="1" style="stop-color:blue"/>
|
|
</linearGradient>
|
|
</defs>
|
|
<rect fill="url(#g)" width="100" height="100"/>
|
|
</svg>
|
