The 2.3.1 fix for GHSA-555j-qj3j-c8jv stops "renderUse()" after
"MAX_USE_EXPANSIONS" (10,000) expansions. But each expansion deep-copies and
renders the whole referenced subtree, so the total work is 10,000 × (subtree
size), and the subtree size is unbounded. Nested <use> groups whose leaf
group holds N rects make about 9,000 of the allowed expansions clone that leaf.
In svglib 2.3.2, a 2,254-byte SVG takes 68 s, and a 6,454-byte one (200 rects)
takes 247 s and 2.6 GB RSS. The cost grows linearly with N. Only the SVG needs
to be attacker-controlled, as in GHSA-555j. main (6e79811) behaves the same (50
rects: 62 s / 727 MB).