From 40cfaa7b38729eb6a2808c9b94d6baa2fae6219b Mon Sep 17 00:00:00 2001
From: Cristy <urban-warrior@imagemagick.org>
Date: Mon, 9 Feb 2026 19:35:36 -0500
Subject: [PATCH] 
 https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-xxw5-m53x-j38c

---
 coders/msl.c | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

Index: ImageMagick-7.1.1-21/coders/msl.c
===================================================================
--- ImageMagick-7.1.1-21.orig/coders/msl.c
+++ ImageMagick-7.1.1-21/coders/msl.c
@@ -7881,7 +7881,7 @@ static MagickBooleanType ProcessMSLScrip
   /* the first slot is used to point to the MSL file image */
   *msl_info.image=msl_image;
   if (*image != (Image *) NULL)
-    MSLPushImage(&msl_info,*image);
+    MSLPushImage(&msl_info,CloneImage(*image,0,0,MagickTrue,exception));
   xmlInitParser();
   (void) memset(&sax_modules,0,sizeof(sax_modules));
   sax_modules.internalSubset=MSLInternalSubset;
@@ -7916,7 +7916,7 @@ static MagickBooleanType ProcessMSLScrip
     msl_image->filename);
   if (msl_info.parser != (xmlParserCtxtPtr) NULL)
     {
-      const char *option = GetImageOption(image_info,"msl:parse-huge");
+      const char *option=GetImageOption(image_info,"msl:parse-huge");
       if ((option != (char *) NULL) && (IsStringTrue(option) != MagickFalse))
         (void) xmlCtxtUseOptions(msl_info.parser,XML_PARSE_HUGE);
       option=GetImageOption(image_info,"msl:substitute-entities");
@@ -7980,6 +7980,9 @@ static Image *ReadMSLImage(const ImageIn
   Image
     *image;
 
+  MagickBooleanType
+    status;
+
   /*
     Open image file.
   */
@@ -7991,7 +7994,9 @@ static Image *ReadMSLImage(const ImageIn
     (void) LogMagickEvent(TraceEvent,GetMagickModule(),"%s",
       image_info->filename);
   image=(Image *) NULL;
-  (void) ProcessMSLScript(image_info,&image,exception);
+  status=ProcessMSLScript(image_info,&image,exception);
+  if ((status == MagickFalse) && (image != (Image *) NULL))
+    image=DestroyImage(image);
   return(GetFirstImageInList(image));
 }
 #endif
@@ -8396,7 +8401,7 @@ static MagickBooleanType WriteMSLImage(c
     (void) LogMagickEvent(TraceEvent,GetMagickModule(),"%s",image->filename);
   msl_image=CloneImage(image,0,0,MagickTrue,exception);
   status=ProcessMSLScript(image_info,&msl_image,exception);
-  msl_image=DestroyImageList(msl_image);
+  msl_image=DestroyImage(msl_image);
   return(status);
 }
 #endif