Commit 93117bc69 for imagemagick.org

commit 93117bc69ba2e22974b0b98e27ab10b0cb7f0403
Author: Cristy <urban-warrior@imagemagick.org>
Date:   Fri Oct 9 11:49:05 2026 -0400

    https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-j2rp-5r6m-f7x8

diff --git a/coders/png.c b/coders/png.c
index 94ad30397..a8d7d4dd7 100644
--- a/coders/png.c
+++ b/coders/png.c
@@ -6444,8 +6444,14 @@ static Image *ReadOneMNGImage(MngReadInfo* mng_info,
                    magnified_width += mng_info->magn_mr;

                 if (image->columns > 2)
-                   magnified_width += (size_t)
-                      ((image->columns-2)*(mng_info->magn_mx));
+                  {
+                    size_t extra_width;
+                    if (HeapOverflowSanityCheckGetSize(image->columns-2,mng_info->magn_mx,&extra_width) != MagickFalse)
+                      ThrowReaderException(CorruptImageError,"ImproperImageHeader");
+                    if (((size_t) MAGICK_SSIZE_MAX-magnified_width) < extra_width)
+                      ThrowReaderException(CorruptImageError,"ImproperImageHeader");
+                    magnified_width+=extra_width;
+                  }
               }

             else
@@ -6459,8 +6465,14 @@ static Image *ReadOneMNGImage(MngReadInfo* mng_info,
                    magnified_width += mng_info->magn_mr-1;

                 if (image->columns > 3)
-                   magnified_width += (size_t)
-                      ((image->columns-3)*(mng_info->magn_mx-1));
+                  {
+                    size_t extra_width;
+                    if (HeapOverflowSanityCheckGetSize(image->columns-3,mng_info->magn_mx-1,&extra_width) != MagickFalse)
+                      ThrowReaderException(CorruptImageError,"ImproperImageHeader");
+                    if (((size_t) MAGICK_SSIZE_MAX-magnified_width) < extra_width)
+                      ThrowReaderException(CorruptImageError,"ImproperImageHeader");
+                    magnified_width+=extra_width;
+                  }
               }

             if (mng_info->magn_methy == 1)
@@ -6471,8 +6483,14 @@ static Image *ReadOneMNGImage(MngReadInfo* mng_info,
                    magnified_height += mng_info->magn_mb;

                 if (image->rows > 2)
-                   magnified_height += (size_t)
-                      ((image->rows-2)*(mng_info->magn_my));
+                  {
+                    size_t extra_height;
+                    if (HeapOverflowSanityCheckGetSize(image->rows-2,mng_info->magn_my,&extra_height) != MagickFalse)
+                      ThrowReaderException(CorruptImageError,"ImproperImageHeader");
+                    if (((size_t) MAGICK_SSIZE_MAX-magnified_height) < extra_height)
+                      ThrowReaderException(CorruptImageError,"ImproperImageHeader");
+                    magnified_height+=extra_height;
+                  }
               }

             else
@@ -6486,8 +6504,14 @@ static Image *ReadOneMNGImage(MngReadInfo* mng_info,
                    magnified_height += mng_info->magn_mb-1;

                 if (image->rows > 3)
-                   magnified_height += (size_t)
-                      ((image->rows-3)*(mng_info->magn_my-1));
+                  {
+                    size_t extra_height;
+                    if (HeapOverflowSanityCheckGetSize(image->rows-3,mng_info->magn_my-1,&extra_height) != MagickFalse)
+                      ThrowReaderException(CorruptImageError,"ImproperImageHeader");
+                    if (((size_t) MAGICK_SSIZE_MAX-magnified_height) < extra_height)
+                      ThrowReaderException(CorruptImageError,"ImproperImageHeader");
+                    magnified_height+=extra_height;
+                  }
               }

             if (magnified_height > image->rows ||