From 3392b4bba6ce076f4d88f5653a42d97b7e4f6970 Mon Sep 17 00:00:00 2001 From: Cristy Date: Tue, 10 Feb 2026 19:37:58 -0500 Subject: [PATCH] https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-fpvf-frm6-625q --- coders/msl.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) Index: ImageMagick-7.1.2-0/coders/msl.c =================================================================== --- ImageMagick-7.1.2-0.orig/coders/msl.c +++ ImageMagick-7.1.2-0/coders/msl.c @@ -275,7 +275,7 @@ static ssize_t MSLPushImage(MSLInfo *msl (msl_info->attributes[n] == (Image *) NULL)) ThrowFatalException(ResourceLimitFatalError,"MemoryAllocationFailed") if (msl_info->number_groups != 0) - msl_info->group_info[msl_info->number_groups-1].numImages++; + msl_info->group_info[msl_info->number_groups].numImages++; return(n); } @@ -3064,6 +3064,13 @@ static void MSLStartElement(void *contex msl_info->group_info=(MSLGroupInfo *) ResizeQuantumMemory( msl_info->group_info,(size_t) (msl_info->number_groups+1), sizeof(*msl_info->group_info)); + if (msl_info->group_info == (MSLGroupInfo *) NULL) + { + ThrowMSLException(ResourceLimitFatalError,"UnableToInterpretMSLImage", + keyword); + break; + } + msl_info->group_info[msl_info->number_groups].numImages=0; break; } ThrowMSLException(OptionError,"UnrecognizedElement",(const char *) tag);