Commit 6b833ce61 for imagemagick.org
commit 6b833ce613bc435fd335daf9bc0e6a8cb78f4c41
Author: Cristy <urban-warrior@imagemagick.org>
Date: Mon Oct 19 18:24:18 2026 -0400
https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-3pf7-cjfr-3fpq
diff --git a/MagickCore/stream.c b/MagickCore/stream.c
index 447a027b8..8e37d8b5a 100644
--- a/MagickCore/stream.c
+++ b/MagickCore/stream.c
@@ -87,6 +87,9 @@ struct _StreamInfo
StorageType
storage_type;
+ size_t
+ length;
+
unsigned char
*pixels;
@@ -1248,7 +1251,7 @@ static size_t WriteStreamImage(const Image *image,const void *pixels,
assert(cache_info->signature == MagickCoreSignature);
packet_size*=strlen(stream_info->map);
length=packet_size*cache_info->columns*cache_info->rows;
- if (image != stream_info->image)
+ if ((image != stream_info->image) || (length > stream_info->length))
{
ImageInfo
*write_info;
@@ -1261,6 +1264,7 @@ static size_t WriteStreamImage(const Image *image,const void *pixels,
if (stream_info->pixels == (unsigned char *) NULL)
return(0);
(void) memset(stream_info->pixels,0,length);
+ stream_info->length=length;
stream_info->image=image;
write_info=CloneImageInfo(stream_info->image_info);
(void) SetImageInfo(write_info,1,stream_info->exception);