[Pkg-gmagick-im-team] Bug#1150224: imagemagick: regression in bookworm security updates: SVG <image> with data: URI fails ("unable to open image")

[Guillaume Bihet]

Package: imagemagick
Version: 8:6.9.11.60+dfsg-1.6+deb12u13
Severity: important
Tags: regression

Dear Maintainer,

Converting an SVG that includes a PNG image through a data: URI fails on
deb12u13

Steps to reproduce:

The attached image min.svg is a minimal SVG containing a single <image>
element whose href is a data: URI (a small PNG).

Command line :
$   convert min.svg out.png

Observed with 8:6.9.11.60+dfsg-1.6+deb12u13:

>  convert-im6.q16: unable to open image
`image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAoAAAAKAQMAAAC3/F3+AAAABGdBTUEAALGPC/xhBQAAACBjSFJNAAB6JgAAgIQAAPoAAACA6AAAdTAAAOpgAAA6mAAAF3CculE8AAAABlBMVEX/AAD///9BHTQRAAAAAWJLR0QB/wIt3gAAAAd0SU1FB+oKBwkDHJyRhl8AAAALSURBVAjXY2DABwAAHgABboVHMgAAACV0RVh0ZGF0ZTpjcmVhdGUAMjAyNi0xMC0wN1QwOTowMzoyOCswMDowMPubB7AAAAAldEVYdGRhdGU6bW9kaWZ5ADIwMjYtMTAtMDdUMDk6MDM6MjgrMDA6MDCKxr8MAAAAAElFTkSuQmCC':
No such file or directory @ error/blob.c/OpenBlob/2990.
> convert-im6.q16: no images defined `out.png' @
error/convert.c/ConvertImageCommand/3234.

Expected: out.png is written. The same command works with deb12u4 and
deb12u6 but fails with deb12u11 and deb12u13, so the regression was likely
introduced between deb12u6 and deb12u11

System information:
  Debian 12 (bookworm), amd64
  Kernel: Linux 6.1.0-34-amd64 Debian 6.1.135-1
  libc6: 2.36-9+deb12u14
  rsvg-convert is not installed


*Guillaume Bihet*
immateriel technical team
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/pkg-gmagick-im-team/attachments/20261007/05070bb9/attachment.htm>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: min.svg
Type: image/svg+xml
Size: 547 bytes
Desc: not available
URL: <http://alioth-lists.debian.net/pipermail/pkg-gmagick-im-team/attachments/20261007/05070bb9/attachment.svg>