From e6e874875e48dd9838acca3bd22c14a4d2f1b3ca Mon Sep 17 00:00:00 2001 From: Cristy Date: Sun, 22 Feb 2026 19:00:46 -0500 Subject: [PATCH] https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-7h7q-j33q-hvpf --- coders/png.c | 20 +++++++++++++++++++- 1 file changed, 19 insertions(+), 1 deletion(-) Index: ImageMagick-7.1.1-21/coders/png.c =================================================================== --- ImageMagick-7.1.1-21.orig/coders/png.c +++ ImageMagick-7.1.1-21/coders/png.c @@ -12327,6 +12327,13 @@ static MagickBooleanType WriteOneJNGImag blob=(unsigned char *) ImageToBlob(jpeg_image_info,jpeg_image, &length,exception); + if (blob == (unsigned char *) NULL) + { + jpeg_image=DestroyImage(jpeg_image); + jpeg_image_info=DestroyImageInfo(jpeg_image_info); + return(MagickFalse); + } + /* Retrieve sample depth used */ value=GetImageProperty(jpeg_image,"png:bit-depth-written",exception); if (value != (char *) NULL) @@ -12696,6 +12703,15 @@ static MagickBooleanType WriteOneJNGImag blob=(unsigned char *) ImageToBlob(jpeg_image_info,jpeg_image,&length, exception); + if (blob == (unsigned char *) NULL) + { + if (jpeg_image != (Image *)NULL) + jpeg_image=DestroyImage(jpeg_image); + if (jpeg_image_info != (ImageInfo *)NULL) + jpeg_image_info=DestroyImageInfo(jpeg_image_info); + return(MagickFalse); + } + if (logging != MagickFalse) { (void) LogMagickEvent(CoderEvent,GetMagickModule(), @@ -12871,7 +12887,9 @@ static MagickBooleanType WriteMNGImage(c mng_info->image=image; write_mng=LocaleCompare(image_info->magick,"MNG") == 0 ? MagickTrue : MagickFalse; - + if ((write_mng != MagickFalse) && (image->storage_class == PseudoClass) && + (image->colors > 256)) + (void) SetImageStorageClass(image,DirectClass,exception); /* * See if user has requested a specific PNG subformat to be used * for all of the PNGs in the MNG being written, e.g.,