From 361b42c91d173cfb4bd8f39898c599feef6a1e55 Mon Sep 17 00:00:00 2001
From: Dirk Lemstra <dirk@lemstra.org>
Date: Fri, 13 Mar 2026 09:57:46 +0100
Subject: [PATCH] Corrected out of bounds write of a single zero byte
 (GHSA-gc62-2v5p-qpmp)

---
 MagickCore/xml-tree.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

Index: ImageMagick-7.1.0-9/MagickCore/xml-tree.c
===================================================================
--- ImageMagick-7.1.0-9.orig/MagickCore/xml-tree.c
+++ ImageMagick-7.1.0-9/MagickCore/xml-tree.c
@@ -1287,7 +1287,7 @@ static char *ConvertUTF16ToUTF8(const ch
     }
   }
   *length=(size_t) j;
-  utf8=(char *) ResizeQuantumMemory(utf8,*length,sizeof(*utf8));
+  utf8=(char *) ResizeQuantumMemory(utf8,(*length+1),sizeof(*utf8));
   if (utf8 != (char *) NULL)
     utf8[*length]='\0';
   return(utf8);