From cca607366fb38c2dde019a9088b8415ffba3a835 Mon Sep 17 00:00:00 2001
From: Cristy <urban-warrior@imagemagick.org>
Date: Tue, 24 Mar 2026 11:20:39 -0400
Subject: [PATCH] 
 https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-pcvx-ph33-r5vv

---
 MagickCore/resize.c | 48 ++++++++++++++++++---------------------------
 1 file changed, 19 insertions(+), 29 deletions(-)

Index: ImageMagick-7.1.0-9/MagickCore/resize.c
===================================================================
--- ImageMagick-7.1.0-9.orig/MagickCore/resize.c
+++ ImageMagick-7.1.0-9/MagickCore/resize.c
@@ -3879,10 +3879,6 @@ MagickExport Image *SampleImage(const Im
     progress;
 
   ssize_t
-    x1;
-
-  ssize_t
-    *x_offset,
     y;
 
   PointInfo
@@ -3929,19 +3925,6 @@ MagickExport Image *SampleImage(const Im
       }
   }
   /*
-    Allocate scan line buffer and column offset buffers.
-  */
-  x_offset=(ssize_t *) AcquireQuantumMemory((size_t) sample_image->columns,
-    sizeof(*x_offset));
-  if (x_offset == (ssize_t *) NULL)
-    {
-      sample_image=DestroyImage(sample_image);
-      ThrowImageException(ResourceLimitError,"MemoryAllocationFailed");
-    }
-  for (x1=0; x1 < (ssize_t) sample_image->columns; x1++)
-    x_offset[x1]=(ssize_t) ((((double) x1+sample_offset.x)*image->columns)/
-      sample_image->columns);
-  /*
     Sample each row.
   */
   status=MagickTrue;
@@ -3954,27 +3937,17 @@ MagickExport Image *SampleImage(const Im
 #endif
   for (y=0; y < (ssize_t) sample_image->rows; y++)
   {
-    const Quantum
-      *magick_restrict p;
-
     Quantum
       *magick_restrict q;
 
     ssize_t
       x;
 
-    ssize_t
-      y_offset;
-
     if (status == MagickFalse)
       continue;
-    y_offset=(ssize_t) ((((double) y+sample_offset.y)*image->rows)/
-      sample_image->rows);
-    p=GetCacheViewVirtualPixels(image_view,0,y_offset,image->columns,1,
-      exception);
     q=QueueCacheViewAuthenticPixels(sample_view,0,y,sample_image->columns,1,
       exception);
-    if ((p == (const Quantum *) NULL) || (q == (Quantum *) NULL))
+    if (q == (Quantum *) NULL)
       {
         status=MagickFalse;
         continue;
@@ -3984,14 +3957,29 @@ MagickExport Image *SampleImage(const Im
     */
     for (x=0; x < (ssize_t) sample_image->columns; x++)
     {
+      const Quantum
+        *magick_restrict p;
+
       ssize_t
-        i;
+        i,
+        x_offset,
+        y_offset;
 
       if (GetPixelWriteMask(sample_image,q) <= (QuantumRange/2))
         {
           q+=GetPixelChannels(sample_image);
           continue;
         }
+      x_offset=(ssize_t) ((((double) x+sample_offset.x)*image->columns)/
+        sample_image->columns);
+      y_offset=(ssize_t) ((((double) y+sample_offset.y)*image->rows)/
+        sample_image->rows);
+      p=GetCacheViewVirtualPixels(image_view,x_offset,y_offset,1,1,exception);
+      if (p == (const Quantum *) NULL)
+        {
+          status=MagickFalse;
+          break;
+        }
       for (i=0; i < (ssize_t) GetPixelChannels(sample_image); i++)
       {
         PixelChannel
@@ -4007,8 +3995,7 @@ MagickExport Image *SampleImage(const Im
         if ((traits == UndefinedPixelTrait) ||
             (image_traits == UndefinedPixelTrait))
           continue;
-        SetPixelChannel(sample_image,channel,p[x_offset[x]*GetPixelChannels(
-          image)+i],q);
+        SetPixelChannel(sample_image,channel,p[i],q);
       }
       q+=GetPixelChannels(sample_image);
     }
@@ -4026,7 +4013,6 @@ MagickExport Image *SampleImage(const Im
   }
   image_view=DestroyCacheView(image_view);
   sample_view=DestroyCacheView(sample_view);
-  x_offset=(ssize_t *) RelinquishMagickMemory(x_offset);
   sample_image->type=image->type;
   if (status == MagickFalse)
     sample_image=DestroyImage(sample_image);