Commit 45bb7328b for imagemagick.org

commit 45bb7328b36c163234f5ccb7f1d494b7c4c8c775
Author: Dirk Lemstra <dirk@lemstra.org>
Date:   Fri Sep 18 22:25:04 2026 +0200

    Escape the title in the CIP encoder (GHSA-3429-f84m-8qhw)

diff --git a/coders/cip.c b/coders/cip.c
index 5516cdbbb..1a29193a3 100644
--- a/coders/cip.c
+++ b/coders/cip.c
@@ -63,6 +63,7 @@
 #include "MagickCore/string_.h"
 #include "MagickCore/module.h"
 #include "MagickCore/utility.h"
+#include "MagickCore/xml-tree-private.h"

 /*
   Forward declarations.
@@ -161,7 +162,8 @@ static MagickBooleanType WriteCIPImage(const ImageInfo *image_info,Image *image,
   ExceptionInfo *exception)
 {
   char
-    buffer[MagickPathExtent];
+    buffer[MagickPathExtent],
+    *escaped;

   const char
     *value;
@@ -198,19 +200,17 @@ static MagickBooleanType WriteCIPImage(const ImageInfo *image_info,Image *image,
     return(status);
   (void) WriteBlobString(image,"<CiscoIPPhoneImage>\n");
   value=GetImageProperty(image,"label",exception);
-  if (value != (const char *) NULL)
-    (void) FormatLocaleString(buffer,MagickPathExtent,"<Title>%s</Title>\n",
-      value);
-  else
+  if (value == (const char *) NULL)
     {
-      char
-        basename[MagickPathExtent];
-
-      GetPathComponent(image->filename,BasePath,basename);
-      (void) FormatLocaleString(buffer,MagickPathExtent,"<Title>%s</Title>\n",
-        basename);
+      GetPathComponent(image->filename,BasePath,buffer);
+      value=buffer;
     }
-  (void) WriteBlobString(image,buffer);
+  escaped=SubstituteXMLEntities(value,MagickFalse);
+  (void) WriteBlobString(image,"<Title>");
+  if (escaped != (char*)NULL)
+    (void) WriteBlobString(image,escaped);
+  (void) WriteBlobString(image,"</Title>\n");
+  escaped=DestroyString(escaped);
   (void) FormatLocaleString(buffer,MagickPathExtent,
     "<LocationX>%.17g</LocationX>\n",(double) image->page.x);
   (void) WriteBlobString(image,buffer);