From 0d0ecfc0d620359c4c0335a6e6c23d84e89cd31f Mon Sep 17 00:00:00 2001
From: Cristy <urban-warrior@imagemagick.org>
Date: Mon, 9 Feb 2026 19:35:06 -0500
Subject: [PATCH] 
 https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-xxw5-m53x-j38c

---
 coders/msl.c | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

Index: ImageMagick-6.8.8-1/coders/msl.c
===================================================================
--- ImageMagick-6.8.8-1.orig/coders/msl.c
+++ ImageMagick-6.8.8-1/coders/msl.c
@@ -7834,7 +7834,8 @@ static MagickBooleanType ProcessMSLScrip
   /* the first slot is used to point to the MSL file image */
   *msl_info.image=msl_image;
   if (*image != (Image *) NULL)
-    MSLPushImage(&msl_info,*image);
+    MSLPushImage(&msl_info,CloneImage(*image,0,0,MagickTrue,exception));
+  image=(Image *) NULL;
   (void) xmlSubstituteEntitiesDefault(1);
   (void) ResetMagickMemory(&sax_modules,0,sizeof(sax_modules));
   sax_modules.internalSubset=MSLInternalSubset;
@@ -7916,6 +7917,9 @@ static Image *ReadMSLImage(const ImageIn
   Image
     *image;
 
+  MagickBooleanType
+    status;
+
   /*
     Open image file.
   */
@@ -7927,7 +7931,9 @@ static Image *ReadMSLImage(const ImageIn
   assert(exception != (ExceptionInfo *) NULL);
   assert(exception->signature == MagickSignature);
   image=(Image *) NULL;
-  (void) ProcessMSLScript(image_info,&image,exception);
+  status=ProcessMSLScript(image_info,&image,exception);
+  if ((status == MagickFalse) && (image != (Image *) NULL))
+    image=DestroyImage(image);
   return(GetFirstImageInList(image));
 }
 #endif
@@ -8334,7 +8340,7 @@ static MagickBooleanType WriteMSLImage(c
     (void) LogMagickEvent(TraceEvent,GetMagickModule(),"%s",image->filename);
   msl_image=CloneImage(image,0,0,MagickTrue,&image->exception);
   status=ProcessMSLScript(image_info,&msl_image,&image->exception);
-  msl_image=DestroyImageList(msl_image);
+  msl_image=DestroyImage(msl_image);
   return(status);
 }
 #endif