From 140fc7b01fa7d870b3bc8453fb7adccfb7c1e202 Mon Sep 17 00:00:00 2001
From: Cristy <urban-warrior@imagemagick.org>
Date: Tue, 24 Mar 2026 11:27:54 -0400
Subject: [PATCH] 
 https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-pcvx-ph33-r5vv

---
 magick/resize.c | 69 +++++++++++++++++++++----------------------------
 1 file changed, 29 insertions(+), 40 deletions(-)

Index: ImageMagick-6.8.8-1/magick/resize.c
===================================================================
--- ImageMagick-6.8.8-1.orig/magick/resize.c
+++ ImageMagick-6.8.8-1/magick/resize.c
@@ -3100,11 +3100,7 @@ MagickExport Image *SampleImage(const Im
   MagickOffsetType
     progress;
 
-  register ssize_t
-    x;
-
   ssize_t
-    *x_offset,
     y;
 
   PointInfo
@@ -3151,19 +3147,6 @@ MagickExport Image *SampleImage(const Im
       }
   }
   /*
-    Allocate scan line buffer and column offset buffers.
-  */
-  x_offset=(ssize_t *) AcquireQuantumMemory((size_t) sample_image->columns,
-    sizeof(*x_offset));
-  if (x_offset == (ssize_t *) NULL)
-    {
-      sample_image=DestroyImage(sample_image);
-      ThrowImageException(ResourceLimitError,"MemoryAllocationFailed");
-    }
-  for (x=0; x < (ssize_t) sample_image->columns; x++)
-    x_offset[x]=(ssize_t) ((((double) x+sample_offset.x)*image->columns)/
-                                                  sample_image->columns);
-  /*
     Sample each row.
   */
   status=MagickTrue;
@@ -3176,12 +3159,6 @@ MagickExport Image *SampleImage(const Im
 #endif
   for (y=0; y < (ssize_t) sample_image->rows; y++)
   {
-    register const IndexPacket
-      *restrict indexes;
-
-    register const PixelPacket
-      *restrict p;
-
     register IndexPacket
       *restrict sample_indexes;
 
@@ -3191,33 +3168,50 @@ MagickExport Image *SampleImage(const Im
     register ssize_t
       x;
 
-    ssize_t
-      y_offset;
-
     if (status == MagickFalse)
       continue;
-    y_offset=(ssize_t) ((((double) y+sample_offset.y)*image->rows)/
-                                               sample_image->rows);
-    p=GetCacheViewVirtualPixels(image_view,0,y_offset,image->columns,1,
-      exception);
     q=QueueCacheViewAuthenticPixels(sample_view,0,y,sample_image->columns,1,
       exception);
-    if ((p == (const PixelPacket *) NULL) || (q == (PixelPacket *) NULL))
+    if (q == (PixelPacket *) NULL)
       {
         status=MagickFalse;
         continue;
       }
-    indexes=GetCacheViewAuthenticIndexQueue(image_view);
     sample_indexes=GetCacheViewAuthenticIndexQueue(sample_view);
     /*
       Sample each column.
     */
     for (x=0; x < (ssize_t) sample_image->columns; x++)
-      *q++=p[x_offset[x]];
-    if ((image->storage_class == PseudoClass) ||
-        (image->colorspace == CMYKColorspace))
-      for (x=0; x < (ssize_t) sample_image->columns; x++)
-        SetPixelIndex(sample_indexes+x,GetPixelIndex(indexes+x_offset[x]));
+    {
+      const IndexPacket
+        *restrict indexes;
+
+      const PixelPacket
+        *restrict p;
+
+      ssize_t
+        x_offset,
+        y_offset;
+
+      x_offset=(ssize_t) ((((double) x+sample_offset.x)*image->columns)/
+        sample_image->columns);
+      y_offset=(ssize_t) ((((double) y+sample_offset.y)*image->rows)/
+        sample_image->rows);
+      p=GetCacheViewVirtualPixels(image_view,x_offset,y_offset,1,1,
+        exception);
+      if (p == (const PixelPacket *) NULL)
+        {
+          status=MagickFalse;
+          continue;
+        }
+      *q++=(*p);
+      if ((image->storage_class == PseudoClass) ||
+          (image->colorspace == CMYKColorspace))
+        {
+          indexes=GetCacheViewVirtualIndexQueue(image_view);
+          SetPixelIndex(sample_indexes+x,GetPixelIndex(indexes));
+        }
+    }
     if (SyncCacheViewAuthenticPixels(sample_view,exception) == MagickFalse)
       status=MagickFalse;
     if (image->progress_monitor != (MagickProgressMonitor) NULL)
@@ -3235,7 +3229,6 @@ MagickExport Image *SampleImage(const Im
   }
   image_view=DestroyCacheView(image_view);
   sample_view=DestroyCacheView(sample_view);
-  x_offset=(ssize_t *) RelinquishMagickMemory(x_offset);
   sample_image->type=image->type;
   if (status == MagickFalse)
     sample_image=DestroyImage(sample_image);