File ImageMagick-filename-placeholder-regression-3.patch of Package ImageMagick.40075

From 6c7c8d5866b9c0ce6cc76a741e05b9482716101e Mon Sep 17 00:00:00 2001
From: Cristy <urban-warrior@imagemagick.org>
Date: Sat, 19 Jul 2025 16:07:21 -0400
Subject: [PATCH] more boundary checks

---
 MagickCore/image.c | 35 ++++++++++++++++++++++-------------
 1 file changed, 22 insertions(+), 13 deletions(-)

Index: ImageMagick-7.1.0-9/MagickCore/image.c
===================================================================
--- ImageMagick-7.1.0-9.orig/MagickCore/image.c
+++ ImageMagick-7.1.0-9/MagickCore/image.c
@@ -1656,6 +1656,8 @@ MagickExport size_t InterpretImageFilena
   /*
     Start with a copy of the format string.
   */
+  assert(format != (const char *) NULL);
+  assert(filename != (char *) NULL);
   (void) CopyMagickString(filename,format,MagickPathExtent);
   if (IsStringTrue(GetImageOption(image_info,"filename:literal")) != MagickFalse)
     return(strlen(filename));
@@ -1679,7 +1681,7 @@ MagickExport size_t InterpretImageFilena
     /*
       Skip padding digits like %03d.
     */
-    if (*cursor == '0')
+    if (isdigit((int) ((unsigned char) *cursor)) != 0)
       (void) strtol(cursor,(char **) &cursor,10);
     switch (*cursor)
     {
@@ -1691,9 +1693,8 @@ MagickExport size_t InterpretImageFilena
           count;
 
         count=FormatLocaleString(pattern,sizeof(pattern),q,value);
-        if ((count <= 0) || (count >= MagickPathExtent))
-          return(0);
-        if ((offset+count) >= MagickPathExtent)
+        if ((count <= 0) || (count >= MagickPathExtent) ||
+            ((offset+count) >= MagickPathExtent))
           return(0);
         (void) CopyMagickString(p+offset,pattern,(size_t) (MagickPathExtent-
           offset));
@@ -1707,7 +1708,9 @@ MagickExport size_t InterpretImageFilena
           *option = (const char *) NULL;
 
         size_t
-          extent = (size_t) (end-cursor);
+          extent = (size_t) (end-cursor-1),
+          option_length,
+          tail_length;
 
         /*
           Handle %[key:value];
@@ -1716,21 +1719,27 @@ MagickExport size_t InterpretImageFilena
           break;
         if (extent >= sizeof(pattern))
           break;
-         (void) CopyMagickString(pattern,cursor,extent);
+        (void) CopyMagickString(pattern,cursor+1,extent+1);
          pattern[extent]='\0';
         if (image != (Image *) NULL)
-          option=GetImageProperty(image,pattern,exception);
-        if ((option == (const char *) NULL) && (image != (Image *)NULL))
-          option=GetImageArtifact(image,pattern);
-        if ((option == (const char *) NULL) &&
+          {
+            option=GetImageProperty(image,pattern,exception);
+            if (option == (const char *) NULL)
+              option=GetImageArtifact(image,pattern);
+          }
+        if ((option == (const char *) NULL) &&
             (image_info != (ImageInfo *) NULL))
           option=GetImageOption(image_info,pattern);
         if (option == (const char *) NULL)
           break;
+        option_length=strlen(option);
+        tail_length=strlen(end+1);
+        if ((offset+option_length+tail_length+1) > MagickPathExtent)
+          return(0);
         (void) CopyMagickString(p+offset,option,(size_t) (MagickPathExtent-
           offset));
-        (void) ConcatenateMagickString(p+offset+strlen(option),end+1,(size_t)
-          (MagickPathExtent-offset-strlen(option)-strlen(end)-1));
+        (void) ConcatenateMagickString(p+offset+option_length,end+1,(size_t) (
+          MagickPathExtent-offset-option_length-tail_length-1));
         cursor=end+1;
         break;
       }
@@ -1744,7 +1753,7 @@ MagickExport size_t InterpretImageFilena
       Replace "%%" with "%".
     */
     if ((*p == '%') && (*(p+1) == '%'))
-      (void) memmove(p,p+1,strlen(p));  /* shift left */
+      (void) memmove(p,p+1,strlen(p+1)+1);  /* shift left */
     else
       p++;
   }