From 266e59ed8d886a76355c863bd38ff5ac34537673 Mon Sep 17 00:00:00 2001
From: Cristy <urban-warrior@imagemagick.org>
Date: Wed, 28 Jan 2026 19:50:14 -0500
Subject: [PATCH] 
 https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-xg29-8ghv-v4x

---
 coders/sixel.c | 12 +++++++-----
 1 file changed, 7 insertions(+), 5 deletions(-)

diff --git a/coders/sixel.c b/coders/sixel.c
index a0ae4b8b743..3562fdb2aaf 100644
--- a/coders/sixel.c
+++ b/coders/sixel.c
@@ -250,12 +250,8 @@ static MagickBooleanType sixel_decode(Image *image,unsigned char *p,
     background_color_index,
     c,
     color_index,
-    dmsx,
-    dmsy,
     g,
     i,
-    imsx,
-    imsy,
     n,
     max_color_index,
     max_x,
@@ -278,6 +274,12 @@ static MagickBooleanType sixel_decode(Image *image,unsigned char *p,
     extent,
     offset;
 
+  ssize_t
+    dmsx,
+    dmsy,
+    imsx,
+    imsy;
+
   extent=strlen((char *) p);
   position_x=position_y=0;
   max_x=max_y=0;
@@ -487,7 +489,7 @@ static MagickBooleanType sixel_decode(Image *image,unsigned char *p,
       {
         if ((imsx < (position_x + repeat_count)) || (imsy < (position_y + 6)))
           {
-            int
+            ssize_t
               nx,
               ny;
 
From 729253dc16e1a1ec4cac891a12d597e3fa9336b3 Mon Sep 17 00:00:00 2001
From: Cristy <urban-warrior@imagemagick.org>
Date: Sun, 1 Feb 2026 13:55:34 -0500
Subject: [PATCH] 
 https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-xg29-8ghv-v4xr

---
 coders/sixel.c | 37 ++++++++++++++++++++-----------------
 1 file changed, 20 insertions(+), 17 deletions(-)

diff --git a/coders/sixel.c b/coders/sixel.c
index 3562fdb2aaf..6d8bae3998b 100644
--- a/coders/sixel.c
+++ b/coders/sixel.c
@@ -251,7 +251,6 @@ static MagickBooleanType sixel_decode(Image *image,unsigned char *p,
     c,
     color_index,
     g,
-    i,
     n,
     max_color_index,
     max_x,
@@ -262,23 +261,24 @@ static MagickBooleanType sixel_decode(Image *image,unsigned char *p,
     r,
     repeat_count,
     sixel_palet[SIXEL_PALETTE_MAX],
-    sixel_vertical_mask,
-    x,
-    y;
+    sixel_vertical_mask;
 
   sixel_pixel_t
     *dmbuf,
     *imbuf;
 
   size_t
-    extent,
-    offset;
+    extent;
 
   ssize_t
     dmsx,
     dmsy,
+    i,
     imsx,
-    imsy;
+    imsy,
+    offset,
+    x,
+    y;
 
   extent=strlen((char *) p);
   position_x=position_y=0;
@@ -295,7 +295,8 @@ static MagickBooleanType sixel_decode(Image *image,unsigned char *p,
   imsy=2048;
   if (SetImageExtent(image,(size_t) imsx,(size_t) imsy,exception) == MagickFalse)
     return(MagickFalse);
-  imbuf=(sixel_pixel_t *) AcquireQuantumMemory((size_t) imsx,(size_t) imsy*sizeof(sixel_pixel_t));
+  imbuf=(sixel_pixel_t *) AcquireQuantumMemory((size_t) imsx,
+    (size_t) imsy*sizeof(sixel_pixel_t));
   if (imbuf == (sixel_pixel_t *) NULL)
     return(MagickFalse);
   for (n = 0; n < 16; n++)
@@ -316,7 +317,7 @@ static MagickBooleanType sixel_decode(Image *image,unsigned char *p,
     sixel_palet[n++]=SIXEL_RGB(i*11,i*11,i*11);
   for (; n < SIXEL_PALETTE_MAX; n++)
     sixel_palet[n]=SIXEL_RGB(255,255,255);
-  for (i = 0; i < imsx * imsy; i++)
+  for (i = 0; i < (imsx*imsy); i++)
     imbuf[i]=(sixel_pixel_t) background_color_index;
   while (*p != '\0')
   {
@@ -410,7 +411,7 @@ static MagickBooleanType sixel_decode(Image *image,unsigned char *p,
               }
             (void) memset(dmbuf,background_color_index,(size_t) dmsx*(size_t)
               dmsy*sizeof(sixel_pixel_t));
-            for (y = 0; y < imsy; ++y)
+            for (y=0; y < imsy; ++y)
               (void) memcpy(dmbuf+dmsx*y,imbuf+imsx*y,(size_t) imsx*
                 sizeof(sixel_pixel_t));
             imbuf=(sixel_pixel_t *) RelinquishMagickMemory(imbuf);
@@ -487,7 +488,8 @@ static MagickBooleanType sixel_decode(Image *image,unsigned char *p,
       }
     else if ((*p >= '?') && (*p <= '\177'))
       {
-        if ((imsx < (position_x + repeat_count)) || (imsy < (position_y + 6)))
+        if ((imsx < ((ssize_t) position_x+repeat_count)) ||
+            (imsy < ((ssize_t) position_y+6)))
           {
             ssize_t
               nx,
@@ -496,7 +498,7 @@ static MagickBooleanType sixel_decode(Image *image,unsigned char *p,
             nx=imsx*2;
             ny=imsy*2;
 
-            while ((nx < (position_x + repeat_count)) || (ny < (position_y + 6)))
+            while ((nx < ((ssize_t) position_x+repeat_count)) || (ny < ((ssize_t) position_y+6)))
             {
               nx *= 2;
               ny *= 2;
@@ -536,9 +538,9 @@ static MagickBooleanType sixel_decode(Image *image,unsigned char *p,
                 {
                   if ((b & sixel_vertical_mask) != 0)
                     {
-                      offset=(size_t) (imsx*((ssize_t) position_y+i)+
+                      offset=(ssize_t) (imsx*((ssize_t) position_y+i)+
                         (ssize_t) position_x);
-                      if (offset >= (size_t) (imsx*imsy))
+                      if (offset >= (imsx*imsy))
                         {
                           imbuf=(sixel_pixel_t *) RelinquishMagickMemory(imbuf);
                           return(MagickFalse);
@@ -568,10 +570,11 @@ static MagickBooleanType sixel_decode(Image *image,unsigned char *p,
                       }
                       for (y = position_y + i; y < position_y + i + n; ++y)
                       {
-                        offset=(size_t) ((ssize_t) imsx*y+(ssize_t) position_x);
-                        if ((offset+(size_t) repeat_count) >= (size_t) (imsx*imsy))
+                        offset=(imsx*y+position_x);
+                        if ((offset+repeat_count) >= (imsx*imsy))
                           {
-                            imbuf=(sixel_pixel_t *) RelinquishMagickMemory(imbuf);
+                            imbuf=(sixel_pixel_t *)
+                              RelinquishMagickMemory(imbuf);
                             return(MagickFalse);
                           }
                         for (x = 0; x < repeat_count; x++)