Commit 8c56a52d3 for imagemagick.org

commit 8c56a52d31b65afed3cd58237ebe7128e037f029
Author: Cristy <urban-warrior@imagemagick.org>
Date:   Thu Oct 29 10:52:24 2026 -0400

    https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-hg5r-hf2p-g9xq

diff --git a/coders/uil.c b/coders/uil.c
index 7f4db72c3..c35f9ad44 100644
--- a/coders/uil.c
+++ b/coders/uil.c
@@ -294,8 +294,12 @@ static MagickBooleanType WriteUILImage(const ImageInfo *image_info,Image *image,
   symbol=AcquireString("");
   (void) WriteBlobString(image,"/* UIL */\n");
   GetPathComponent(image->filename,BasePath,basename);
-  (void) FormatLocaleString(buffer,MagickPathExtent,
-    "value\n  %s_ct : color_table(\n",basename);
+  {
+    char *sanitized_basename = SanitizeStringForIdentifier(basename);
+    (void) FormatLocaleString(buffer,MagickPathExtent,
+      "value\n  %s_ct : color_table(\n",sanitized_basename);
+    sanitized_basename=DestroyString(sanitized_basename);
+  }
   (void) WriteBlobString(image,buffer);
   GetPixelInfo(image,&pixel);
   for (i=0; i < (ssize_t) colors; i++)
@@ -340,8 +344,13 @@ static MagickBooleanType WriteUILImage(const ImageInfo *image_info,Image *image,
     Define UIL pixels.
   */
   GetPathComponent(image->filename,BasePath,basename);
-  (void) FormatLocaleString(buffer,MagickPathExtent,
-    "  %s_icon : icon(color_table = %s_ct,\n",basename,basename);
+  {
+    char *sanitized_basename = SanitizeStringForIdentifier(basename);
+    (void) FormatLocaleString(buffer,MagickPathExtent,
+      "  %s_icon : icon(color_table = %s_ct,\n",sanitized_basename,
+      sanitized_basename);
+    sanitized_basename=DestroyString(sanitized_basename);
+  }
   (void) WriteBlobString(image,buffer);
   for (y=0; y < (ssize_t) image->rows; y++)
   {
diff --git a/coders/xpm.c b/coders/xpm.c
index b6002a998..d83545119 100644
--- a/coders/xpm.c
+++ b/coders/xpm.c
@@ -1113,8 +1113,12 @@ static MagickBooleanType WriteXPMImage(const ImageInfo *image_info,Image *image,
       (void) FormatLocaleString(buffer,MagickPathExtent,
         "\"%.1024s c %.1024s\",\n",symbol,name);
     else
-      (void) FormatLocaleString(buffer,MagickPathExtent,
-        "\"%.1024s c %.1024s s %.1024s\",\n",symbol,name,symbolic);
+      {
+        char *sanitized_symbolic = SanitizeStringForIdentifier(symbolic);
+        (void) FormatLocaleString(buffer,MagickPathExtent,
+          "\"%.1024s c %.1024s s %.1024s\",\n",symbol,name,sanitized_symbolic);
+        sanitized_symbolic=DestroyString(sanitized_symbolic);
+      }
     (void) WriteBlobString(image,buffer);
   }
   /*