From cca607366fb38c2dde019a9088b8415ffba3a835 Mon Sep 17 00:00:00 2001
From: Cristy <urban-warrior@imagemagick.org>
Date: Tue, 24 Mar 2026 11:20:39 -0400
Subject: [PATCH] 
 https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-pcvx-ph33-r5vv

---
 MagickCore/resize.c | 48 ++++++++++++++++++---------------------------
 1 file changed, 19 insertions(+), 29 deletions(-)

Index: ImageMagick-7.1.2-0/MagickCore/resize.c
===================================================================
--- ImageMagick-7.1.2-0.orig/MagickCore/resize.c
+++ ImageMagick-7.1.2-0/MagickCore/resize.c
@@ -3927,8 +3927,6 @@ MagickExport Image *SampleImage(const Im
     sample_offset;
 
   ssize_t
-    j,
-    *x_offset,
     y;
 
   /*
@@ -3973,19 +3971,6 @@ MagickExport Image *SampleImage(const Im
       }
   }
   /*
-    Allocate scan line buffer and column offset buffers.
-  */
-  x_offset=(ssize_t *) AcquireQuantumMemory((size_t) sample_image->columns,
-    sizeof(*x_offset));
-  if (x_offset == (ssize_t *) NULL)
-    {
-      sample_image=DestroyImage(sample_image);
-      ThrowImageException(ResourceLimitError,"MemoryAllocationFailed");
-    }
-  for (j=0; j < (ssize_t) sample_image->columns; j++)
-    x_offset[j]=(ssize_t) ((((double) j+sample_offset.x)*image->columns)/
-      sample_image->columns);
-  /*
     Sample each row.
   */
   status=MagickTrue;
@@ -3998,25 +3983,17 @@ MagickExport Image *SampleImage(const Im
 #endif
   for (y=0; y < (ssize_t) sample_image->rows; y++)
   {
-    const Quantum
-      *magick_restrict p;
-
     Quantum
       *magick_restrict q;
 
     ssize_t
-      x,
-      y_offset;
+      x;
 
     if (status == MagickFalse)
       continue;
-    y_offset=(ssize_t) ((((double) y+sample_offset.y)*image->rows)/
-      sample_image->rows);
-    p=GetCacheViewVirtualPixels(image_view,0,y_offset,image->columns,1,
-      exception);
     q=QueueCacheViewAuthenticPixels(sample_view,0,y,sample_image->columns,1,
       exception);
-    if ((p == (const Quantum *) NULL) || (q == (Quantum *) NULL))
+    if (q == (Quantum *) NULL)
       {
         status=MagickFalse;
         continue;
@@ -4026,14 +4003,29 @@ MagickExport Image *SampleImage(const Im
     */
     for (x=0; x < (ssize_t) sample_image->columns; x++)
     {
+      const Quantum
+        *magick_restrict p;
+
       ssize_t
-        i;
+        i,
+        x_offset,
+        y_offset;
 
       if (GetPixelWriteMask(sample_image,q) <= (QuantumRange/2))
         {
           q+=(ptrdiff_t) GetPixelChannels(sample_image);
           continue;
         }
+      x_offset=(ssize_t) ((((double) x+sample_offset.x)*image->columns)/
+        sample_image->columns);
+      y_offset=(ssize_t) ((((double) y+sample_offset.y)*image->rows)/
+        sample_image->rows);
+      p=GetCacheViewVirtualPixels(image_view,x_offset,y_offset,1,1,exception);
+      if (p == (const Quantum *) NULL)
+        {
+          status=MagickFalse;
+          break;
+        }
       for (i=0; i < (ssize_t) GetPixelChannels(sample_image); i++)
       {
         PixelChannel
@@ -4049,8 +4041,7 @@ MagickExport Image *SampleImage(const Im
         if ((traits == UndefinedPixelTrait) ||
             (image_traits == UndefinedPixelTrait))
           continue;
-        SetPixelChannel(sample_image,channel,p[x_offset[x]*(ssize_t)
-          GetPixelChannels(image)+i],q);
+        SetPixelChannel(sample_image,channel,p[i],q);
       }
       q+=(ptrdiff_t) GetPixelChannels(sample_image);
     }
@@ -4068,7 +4059,6 @@ MagickExport Image *SampleImage(const Im
   }
   image_view=DestroyCacheView(image_view);
   sample_view=DestroyCacheView(sample_view);
-  x_offset=(ssize_t *) RelinquishMagickMemory(x_offset);
   sample_image->type=image->type;
   if (status == MagickFalse)
     sample_image=DestroyImage(sample_image);