File ImageMagick-CVE-2026-25576.patch of Package ImageMagick.42999
From 44b3140f3414ebc02c5fa8b80551f7d33950a87a Mon Sep 17 00:00:00 2001
From: Dirk Lemstra <dirk@lemstra.org>
Date: Sun, 25 Jan 2026 19:32:52 +0100
Subject: [PATCH] Fixed out of bounds read in multiple coders that read raw
pixel data
(https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-jv4p-gjwq-9r2j)
---
coders/bgr.c | 22 ++++++++++++----------
coders/cmyk.c | 26 ++++++++++++++------------
coders/gray.c | 16 +++++++++-------
coders/raw.c | 4 +++-
coders/rgb.c | 22 ++++++++++++----------
coders/ycbcr.c | 22 ++++++++++++----------
6 files changed, 62 insertions(+), 50 deletions(-)
Index: ImageMagick-6.8.8-1/coders/bgr.c
===================================================================
--- ImageMagick-6.8.8-1.orig/coders/bgr.c
+++ ImageMagick-6.8.8-1/coders/bgr.c
@@ -98,6 +98,14 @@ static MagickBooleanType
% o exception: return any errors or warnings in this structure.
%
*/
+
+static inline ssize_t MagickMin(const ssize_t x,const ssize_t y)
+{
+ if (x < y)
+ return(x);
+ return(y);
+}
+
static Image *ReadBGRImage(const ImageInfo *image_info,
ExceptionInfo *exception)
{
@@ -124,6 +132,7 @@ static Image *ReadBGRImage(const ImageIn
length;
ssize_t
+ columns,
count,
y;
@@ -190,6 +199,7 @@ static Image *ReadBGRImage(const ImageIn
length=0;
scene=0;
status=MagickTrue;
+ columns=(ssize_t) MagickMin(image->columns,canvas_image->columns);
do
{
/*
@@ -247,7 +257,7 @@ static Image *ReadBGRImage(const ImageIn
if ((p == (const PixelPacket *) NULL) ||
(q == (PixelPacket *) NULL))
break;
- for (x=0; x < (ssize_t) image->columns; x++)
+ for (x=0; x < columns; x++)
{
SetPixelRed(q,GetPixelRed(p));
SetPixelGreen(q,GetPixelGreen(p));
@@ -330,7 +340,7 @@ static Image *ReadBGRImage(const ImageIn
if ((p == (const PixelPacket *) NULL) ||
(q == (PixelPacket *) NULL))
break;
- for (x=0; x < (ssize_t) image->columns; x++)
+ for (x=0; x < columns; x++)
{
switch (quantum_type)
{
@@ -426,7 +436,7 @@ static Image *ReadBGRImage(const ImageIn
if ((p == (const PixelPacket *) NULL) ||
(q == (PixelPacket *) NULL))
break;
- for (x=0; x < (ssize_t) image->columns; x++)
+ for (x=0; x < columns; x++)
{
SetPixelRed(q,GetPixelRed(p));
p++;
@@ -479,7 +489,7 @@ static Image *ReadBGRImage(const ImageIn
if ((p == (const PixelPacket *) NULL) ||
(q == (PixelPacket *) NULL))
break;
- for (x=0; x < (ssize_t) image->columns; x++)
+ for (x=0; x < columns; x++)
{
SetPixelGreen(q,GetPixelGreen(p));
p++;
@@ -532,7 +542,7 @@ static Image *ReadBGRImage(const ImageIn
if ((p == (const PixelPacket *) NULL) ||
(q == (PixelPacket *) NULL))
break;
- for (x=0; x < (ssize_t) image->columns; x++)
+ for (x=0; x < columns; x++)
{
SetPixelBlue(q,GetPixelBlue(p));
p++;
@@ -594,7 +604,7 @@ static Image *ReadBGRImage(const ImageIn
if ((p == (const PixelPacket *) NULL) ||
(q == (PixelPacket *) NULL))
break;
- for (x=0; x < (ssize_t) image->columns; x++)
+ for (x=0; x < columns; x++)
{
SetPixelOpacity(q,GetPixelOpacity(p));
p++;
@@ -682,7 +692,7 @@ static Image *ReadBGRImage(const ImageIn
if ((p == (const PixelPacket *) NULL) ||
(q == (PixelPacket *) NULL))
break;
- for (x=0; x < (ssize_t) image->columns; x++)
+ for (x=0; x < columns; x++)
{
SetPixelRed(q,GetPixelRed(p));
p++;
@@ -750,7 +760,7 @@ static Image *ReadBGRImage(const ImageIn
if ((p == (const PixelPacket *) NULL) ||
(q == (PixelPacket *) NULL))
break;
- for (x=0; x < (ssize_t) image->columns; x++)
+ for (x=0; x < columns; x++)
{
SetPixelGreen(q,GetPixelGreen(p));
p++;
@@ -818,7 +828,7 @@ static Image *ReadBGRImage(const ImageIn
if ((p == (const PixelPacket *) NULL) ||
(q == (PixelPacket *) NULL))
break;
- for (x=0; x < (ssize_t) image->columns; x++)
+ for (x=0; x < columns; x++)
{
SetPixelBlue(q,GetPixelBlue(p));
p++;
@@ -887,7 +897,7 @@ static Image *ReadBGRImage(const ImageIn
if ((p == (const PixelPacket *) NULL) ||
(q == (PixelPacket *) NULL))
break;
- for (x=0; x < (ssize_t) image->columns; x++)
+ for (x=0; x < columns; x++)
{
SetPixelOpacity(q,GetPixelOpacity(p));
p++;
Index: ImageMagick-6.8.8-1/coders/cmyk.c
===================================================================
--- ImageMagick-6.8.8-1.orig/coders/cmyk.c
+++ ImageMagick-6.8.8-1/coders/cmyk.c
@@ -70,6 +70,14 @@
static MagickBooleanType
WriteCMYKImage(const ImageInfo *,Image *);
+
+static inline ssize_t MagickMin(const ssize_t x,const ssize_t y)
+{
+ if (x < y)
+ return(x);
+ return(y);
+}
+
/*
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
% %
@@ -123,6 +131,7 @@ static Image *ReadCMYKImage(const ImageI
length;
ssize_t
+ columns,
count,
y;
@@ -195,6 +204,7 @@ static Image *ReadCMYKImage(const ImageI
length=0;
scene=0;
status=MagickTrue;
+ columns=(ssize_t) MagickMin(image->columns,canvas_image->columns);
do
{
/*
@@ -261,7 +271,7 @@ static Image *ReadCMYKImage(const ImageI
break;
canvas_indexes=GetVirtualIndexQueue(canvas_image);
indexes=GetAuthenticIndexQueue(image);
- for (x=0; x < (ssize_t) image->columns; x++)
+ for (x=0; x < columns; x++)
{
SetPixelRed(q,GetPixelRed(p));
SetPixelGreen(q,GetPixelGreen(p));
@@ -355,7 +365,7 @@ static Image *ReadCMYKImage(const ImageI
break;
canvas_indexes=GetVirtualIndexQueue(canvas_image);
indexes=GetAuthenticIndexQueue(image);
- for (x=0; x < (ssize_t) image->columns; x++)
+ for (x=0; x < columns; x++)
{
switch (quantum_type)
{
@@ -452,7 +462,7 @@ static Image *ReadCMYKImage(const ImageI
if ((p == (const PixelPacket *) NULL) ||
(q == (PixelPacket *) NULL))
break;
- for (x=0; x < (ssize_t) image->columns; x++)
+ for (x=0; x < columns; x++)
{
SetPixelRed(q,GetPixelRed(p));
p++;
@@ -505,7 +515,7 @@ static Image *ReadCMYKImage(const ImageI
if ((p == (const PixelPacket *) NULL) ||
(q == (PixelPacket *) NULL))
break;
- for (x=0; x < (ssize_t) image->columns; x++)
+ for (x=0; x < columns; x++)
{
SetPixelGreen(q,GetPixelGreen(p));
p++;
@@ -558,7 +568,7 @@ static Image *ReadCMYKImage(const ImageI
if ((p == (const PixelPacket *) NULL) ||
(q == (PixelPacket *) NULL))
break;
- for (x=0; x < (ssize_t) image->columns; x++)
+ for (x=0; x < columns; x++)
{
SetPixelBlue(q,GetPixelBlue(p));
p++;
@@ -619,7 +629,7 @@ static Image *ReadCMYKImage(const ImageI
break;
canvas_indexes=GetVirtualIndexQueue(canvas_image);
indexes=GetAuthenticIndexQueue(image);
- for (x=0; x < (ssize_t) image->columns; x++)
+ for (x=0; x < columns; x++)
{
SetPixelIndex(indexes+x,GetPixelIndex(
canvas_indexes+image->extract_info.x+x));
@@ -676,7 +686,7 @@ static Image *ReadCMYKImage(const ImageI
if ((p == (const PixelPacket *) NULL) ||
(q == (PixelPacket *) NULL))
break;
- for (x=0; x < (ssize_t) image->columns; x++)
+ for (x=0; x < columns; x++)
{
SetPixelOpacity(q,GetPixelOpacity(p));
p++;
@@ -768,7 +778,7 @@ static Image *ReadCMYKImage(const ImageI
if ((p == (const PixelPacket *) NULL) ||
(q == (PixelPacket *) NULL))
break;
- for (x=0; x < (ssize_t) image->columns; x++)
+ for (x=0; x < columns; x++)
{
SetPixelRed(q,GetPixelRed(p));
p++;
@@ -840,7 +850,7 @@ static Image *ReadCMYKImage(const ImageI
if ((p == (const PixelPacket *) NULL) ||
(q == (PixelPacket *) NULL))
break;
- for (x=0; x < (ssize_t) image->columns; x++)
+ for (x=0; x < columns; x++)
{
SetPixelGreen(q,GetPixelGreen(p));
p++;
@@ -912,7 +922,7 @@ static Image *ReadCMYKImage(const ImageI
if ((p == (const PixelPacket *) NULL) ||
(q == (PixelPacket *) NULL))
break;
- for (x=0; x < (ssize_t) image->columns; x++)
+ for (x=0; x < columns; x++)
{
SetPixelBlue(q,GetPixelBlue(p));
p++;
@@ -992,7 +1002,7 @@ static Image *ReadCMYKImage(const ImageI
break;
canvas_indexes=GetVirtualIndexQueue(canvas_image);
indexes=GetAuthenticIndexQueue(image);
- for (x=0; x < (ssize_t) image->columns; x++)
+ for (x=0; x < columns; x++)
{
SetPixelIndex(indexes+x,GetPixelIndex(
canvas_indexes+image->extract_info.x+x));
@@ -1067,7 +1077,7 @@ static Image *ReadCMYKImage(const ImageI
if ((p == (const PixelPacket *) NULL) ||
(q == (PixelPacket *) NULL))
break;
- for (x=0; x < (ssize_t) image->columns; x++)
+ for (x=0; x < columns; x++)
{
SetPixelOpacity(q,GetPixelOpacity(p));
p++;
Index: ImageMagick-6.8.8-1/coders/gray.c
===================================================================
--- ImageMagick-6.8.8-1.orig/coders/gray.c
+++ ImageMagick-6.8.8-1/coders/gray.c
@@ -71,6 +71,13 @@
static MagickBooleanType
WriteGRAYImage(const ImageInfo *,Image *);
+static inline ssize_t MagickMin(const ssize_t x,const ssize_t y)
+{
+ if (x < y)
+ return(x);
+ return(y);
+}
+
/*
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
% %
@@ -121,6 +128,7 @@ static Image *ReadGRAYImage(const ImageI
length;
ssize_t
+ columns,
count,
y;
@@ -182,6 +190,7 @@ static Image *ReadGRAYImage(const ImageI
scene=0;
count=0;
length=0;
+ columns=(ssize_t) MagickMin(image->columns,canvas_image->columns);
do
{
/*
@@ -229,7 +238,7 @@ static Image *ReadGRAYImage(const ImageI
1,exception);
if ((p == (const PixelPacket *) NULL) || (q == (PixelPacket *) NULL))
break;
- for (x=0; x < (ssize_t) image->columns; x++)
+ for (x=0; x < columns; x++)
{
SetPixelRed(q,GetPixelRed(p));
SetPixelGreen(q,GetPixelGreen(p));
Index: ImageMagick-6.8.8-1/coders/raw.c
===================================================================
--- ImageMagick-6.8.8-1.orig/coders/raw.c
+++ ImageMagick-6.8.8-1/coders/raw.c
@@ -67,6 +67,14 @@
static MagickBooleanType
WriteRAWImage(const ImageInfo *,Image *);
+
+static inline ssize_t MagickMin(const ssize_t x,const ssize_t y)
+{
+ if (x < y)
+ return(x);
+ return(y);
+}
+
/*
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
% %
@@ -115,6 +123,7 @@ static Image *ReadRAWImage(const ImageIn
length;
ssize_t
+ columns,
count,
y;
@@ -172,6 +181,7 @@ static Image *ReadRAWImage(const ImageIn
scene=0;
count=0;
length=0;
+ columns=(ssize_t) MagickMin(image->columns,canvas_image->columns);
do
{
/*
@@ -218,7 +228,7 @@ static Image *ReadRAWImage(const ImageIn
1,exception);
if ((p == (const PixelPacket *) NULL) || (q == (PixelPacket *) NULL))
break;
- for (x=0; x < (ssize_t) image->columns; x++)
+ for (x=0; x < columns; x++)
{
SetPixelRed(q,GetPixelRed(p));
SetPixelGreen(q,GetPixelGreen(p));
Index: ImageMagick-6.8.8-1/coders/rgb.c
===================================================================
--- ImageMagick-6.8.8-1.orig/coders/rgb.c
+++ ImageMagick-6.8.8-1/coders/rgb.c
@@ -71,6 +71,14 @@
static MagickBooleanType
WriteRGBImage(const ImageInfo *,Image *);
+
+static inline ssize_t MagickMin(const ssize_t x,const ssize_t y)
+{
+ if (x < y)
+ return(x);
+ return(y);
+}
+
/*
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
% %
@@ -123,6 +131,7 @@ static Image *ReadRGBImage(const ImageIn
length;
ssize_t
+ columns,
count,
y;
@@ -197,6 +206,7 @@ static Image *ReadRGBImage(const ImageIn
length=0;
scene=0;
status=MagickTrue;
+ columns=(ssize_t) MagickMin(image->columns,canvas_image->columns);
do
{
/*
@@ -254,7 +264,7 @@ static Image *ReadRGBImage(const ImageIn
if ((p == (const PixelPacket *) NULL) ||
(q == (PixelPacket *) NULL))
break;
- for (x=0; x < (ssize_t) image->columns; x++)
+ for (x=0; x < columns; x++)
{
SetPixelRed(q,GetPixelRed(p));
SetPixelGreen(q,GetPixelGreen(p));
@@ -339,7 +349,7 @@ static Image *ReadRGBImage(const ImageIn
if ((p == (const PixelPacket *) NULL) ||
(q == (PixelPacket *) NULL))
break;
- for (x=0; x < (ssize_t) image->columns; x++)
+ for (x=0; x < columns; x++)
{
switch (quantum_type)
{
@@ -435,7 +445,7 @@ static Image *ReadRGBImage(const ImageIn
if ((p == (const PixelPacket *) NULL) ||
(q == (PixelPacket *) NULL))
break;
- for (x=0; x < (ssize_t) image->columns; x++)
+ for (x=0; x < columns; x++)
{
SetPixelRed(q,GetPixelRed(p));
p++;
@@ -488,7 +498,7 @@ static Image *ReadRGBImage(const ImageIn
if ((p == (const PixelPacket *) NULL) ||
(q == (PixelPacket *) NULL))
break;
- for (x=0; x < (ssize_t) image->columns; x++)
+ for (x=0; x < columns; x++)
{
SetPixelGreen(q,GetPixelGreen(p));
p++;
@@ -541,7 +551,7 @@ static Image *ReadRGBImage(const ImageIn
if ((p == (const PixelPacket *) NULL) ||
(q == (PixelPacket *) NULL))
break;
- for (x=0; x < (ssize_t) image->columns; x++)
+ for (x=0; x < columns; x++)
{
SetPixelBlue(q,GetPixelBlue(p));
p++;
@@ -603,7 +613,7 @@ static Image *ReadRGBImage(const ImageIn
if ((p == (const PixelPacket *) NULL) ||
(q == (PixelPacket *) NULL))
break;
- for (x=0; x < (ssize_t) image->columns; x++)
+ for (x=0; x < columns; x++)
{
SetPixelOpacity(q,GetPixelOpacity(p));
p++;
@@ -690,7 +700,7 @@ static Image *ReadRGBImage(const ImageIn
if ((p == (const PixelPacket *) NULL) ||
(q == (PixelPacket *) NULL))
break;
- for (x=0; x < (ssize_t) image->columns; x++)
+ for (x=0; x < columns; x++)
{
SetPixelRed(q,GetPixelRed(p));
p++;
@@ -758,7 +768,7 @@ static Image *ReadRGBImage(const ImageIn
if ((p == (const PixelPacket *) NULL) ||
(q == (PixelPacket *) NULL))
break;
- for (x=0; x < (ssize_t) image->columns; x++)
+ for (x=0; x < columns; x++)
{
SetPixelGreen(q,GetPixelGreen(p));
p++;
@@ -827,7 +837,7 @@ static Image *ReadRGBImage(const ImageIn
if ((p == (const PixelPacket *) NULL) ||
(q == (PixelPacket *) NULL))
break;
- for (x=0; x < (ssize_t) image->columns; x++)
+ for (x=0; x < columns; x++)
{
SetPixelBlue(q,GetPixelBlue(p));
p++;
@@ -897,7 +907,7 @@ static Image *ReadRGBImage(const ImageIn
if ((p == (const PixelPacket *) NULL) ||
(q == (PixelPacket *) NULL))
break;
- for (x=0; x < (ssize_t) image->columns; x++)
+ for (x=0; x < columns; x++)
{
SetPixelOpacity(q,GetPixelOpacity(p));
p++;
Index: ImageMagick-6.8.8-1/coders/ycbcr.c
===================================================================
--- ImageMagick-6.8.8-1.orig/coders/ycbcr.c
+++ ImageMagick-6.8.8-1/coders/ycbcr.c
@@ -69,6 +69,14 @@
*/
static MagickBooleanType
WriteYCBCRImage(const ImageInfo *,Image *);
+
+static inline ssize_t MagickMin(const ssize_t x,const ssize_t y)
+{
+ if (x < y)
+ return(x);
+ return(y);
+}
+
/*
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
@@ -130,6 +138,7 @@ static Image *ReadYCBCRImage(const Image
length;
ssize_t
+ columns,
count,
y;
@@ -200,6 +209,7 @@ static Image *ReadYCBCRImage(const Image
length=0;
scene=0;
status=MagickTrue;
+ columns=(ssize_t) MagickMin(image->columns,canvas_image->columns);
do
{
/*
@@ -249,7 +259,7 @@ static Image *ReadYCBCRImage(const Image
if ((p == (const PixelPacket *) NULL) ||
(q == (PixelPacket *) NULL))
break;
- for (x=0; x < (ssize_t) image->columns; x++)
+ for (x=0; x < columns; x++)
{
SetPixelRed(q,GetPixelRed(p));
SetPixelGreen(q,GetPixelGreen(p));
@@ -322,7 +332,7 @@ static Image *ReadYCBCRImage(const Image
if ((p == (const PixelPacket *) NULL) ||
(q == (PixelPacket *) NULL))
break;
- for (x=0; x < (ssize_t) image->columns; x++)
+ for (x=0; x < columns; x++)
{
switch (quantum_type)
{
@@ -404,7 +414,7 @@ static Image *ReadYCBCRImage(const Image
if ((p == (const PixelPacket *) NULL) ||
(q == (PixelPacket *) NULL))
break;
- for (x=0; x < (ssize_t) image->columns; x++)
+ for (x=0; x < columns; x++)
{
SetPixelRed(q,GetPixelRed(p));
p++;
@@ -448,7 +458,7 @@ static Image *ReadYCBCRImage(const Image
if ((p == (const PixelPacket *) NULL) ||
(q == (PixelPacket *) NULL))
break;
- for (x=0; x < (ssize_t) image->columns; x++)
+ for (x=0; x < columns; x++)
{
SetPixelGreen(q,GetPixelGreen(p));
p++;
@@ -492,7 +502,7 @@ static Image *ReadYCBCRImage(const Image
if ((p == (const PixelPacket *) NULL) ||
(q == (PixelPacket *) NULL))
break;
- for (x=0; x < (ssize_t) image->columns; x++)
+ for (x=0; x < columns; x++)
{
SetPixelBlue(q,GetPixelBlue(p));
p++;
@@ -539,7 +549,7 @@ static Image *ReadYCBCRImage(const Image
if ((p == (const PixelPacket *) NULL) ||
(q == (PixelPacket *) NULL))
break;
- for (x=0; x < (ssize_t) image->columns; x++)
+ for (x=0; x < columns; x++)
{
SetPixelOpacity(q,GetPixelOpacity(p));
p++;
@@ -617,7 +627,7 @@ static Image *ReadYCBCRImage(const Image
if ((p == (const PixelPacket *) NULL) ||
(q == (PixelPacket *) NULL))
break;
- for (x=0; x < (ssize_t) image->columns; x++)
+ for (x=0; x < columns; x++)
{
SetPixelRed(q,GetPixelRed(p));
p++;
@@ -675,7 +685,7 @@ static Image *ReadYCBCRImage(const Image
if ((p == (const PixelPacket *) NULL) ||
(q == (PixelPacket *) NULL))
break;
- for (x=0; x < (ssize_t) image->columns; x++)
+ for (x=0; x < columns; x++)
{
SetPixelGreen(q,GetPixelGreen(p));
p++;
@@ -733,7 +743,7 @@ static Image *ReadYCBCRImage(const Image
if ((p == (const PixelPacket *) NULL) ||
(q == (PixelPacket *) NULL))
break;
- for (x=0; x < (ssize_t) image->columns; x++)
+ for (x=0; x < columns; x++)
{
SetPixelBlue(q,GetPixelBlue(p));
p++;
@@ -793,7 +803,7 @@ static Image *ReadYCBCRImage(const Image
if ((p == (const PixelPacket *) NULL) ||
(q == (PixelPacket *) NULL))
break;
- for (x=0; x < (ssize_t) image->columns; x++)
+ for (x=0; x < columns; x++)
{
SetPixelOpacity(q,GetPixelOpacity(p));
p++;
