ImageMagick/ImageMagick#8583 - 2-way sync via ghpr (https://github.com/runsascoded/ghpr)

ImageMagick#8583.md

ImageMagick/ImageMagick#8583 Fix double-free in SVG gradientTransform / transform parsing

Summary

Fixes #8582.

In SVGStartElement, the gradientTransform and transform attribute handlers reassign value to tokens[j+1] inside the inner token-parsing loop. After the loop, all tokens (including tokens[j+1]) are freed via DestroyString(). The outer attribute loop then calls DestroyString(value) at line 2524, which double-frees the already-destroyed token string, causing SIGABRT.

• Use a separate token_value local variable inside each inner loop instead of reassigning value
• The outer loop's DestroyString(value) now correctly frees the original SVGEscapeString()-allocated string exactly once
• Add tests/cli-svg.tap regression test

Regression

Introduced in 9db96365e (2026-02-15, tag 7.1.2-14) — the GHSA-xpg8-7m6m-jf56 security fix. That commit changed value from a non-owned const char * alias to a heap-allocated char * (via SVGEscapeString()) with DestroyString(value) cleanup, but didn't update the gradientTransform/transform inner loops that have reassigned value to tokens[j+1] since 2009 (3ed852eea).

Reproducer

Any SVG with gradientTransform on a <linearGradient> element triggers the crash:

<linearGradient id="g" gradientTransform="rotate(45)">
  <stop offset="0" stop-color="red"/>
  <stop offset="1" stop-color="blue"/>
</linearGradient>

magick crash.svg crash.png
# SIGABRT (double-free)

Test plan

• magick crash.svg crash.png no longer crashes (exit 0)
• magick ok.svg ok.png still works (SVG without gradientTransform)
• make TESTS="tests/cli-svg.tap" check passes