File ImageMagick-CVE-2025-46393.patch of Package ImageMagick.38423

Index: ImageMagick-7.1.1-21/coders/miff.c
===================================================================
--- ImageMagick-7.1.1-21.orig/coders/miff.c
+++ ImageMagick-7.1.1-21/coders/miff.c
@@ -1344,19 +1344,22 @@ static Image *ReadMIFFImage(const ImageI
         if (status == MagickFalse)
           ThrowMIFFException(ResourceLimitError,"MemoryAllocationFailed");
       }
-    packet_size=(size_t) (image->depth/8);
-    if (image->storage_class == DirectClass)
-      packet_size=(size_t) (3*image->depth/8);
-    if (IsGrayColorspace(image->colorspace) != MagickFalse)
-      packet_size=image->depth/8;
-    if (image->alpha_trait != UndefinedPixelTrait)
-      packet_size+=image->depth/8;
-    if (image->colorspace == CMYKColorspace)
-      packet_size+=image->depth/8;
-    if (image->compression == RLECompression)
-      packet_size++;
     if (image->number_meta_channels != 0)
-      packet_size+=image->number_meta_channels*image->depth/8;
+      packet_size=GetImageChannels(image)*image->depth/8;
+    else
+      {
+        packet_size=(size_t) (image->depth/8);
+        if (image->storage_class == DirectClass)
+          packet_size=(size_t) (3*image->depth/8);
+        if (IsGrayColorspace(image->colorspace) != MagickFalse)
+          packet_size=image->depth/8;
+        if (image->alpha_trait != UndefinedPixelTrait)
+          packet_size+=image->depth/8;
+        if (image->colorspace == CMYKColorspace)
+          packet_size+=image->depth/8;
+        if (image->compression == RLECompression)
+          packet_size++;
+      }
     compress_extent=MagickMax(MagickMax(BZipMaxExtent(packet_size*
       image->columns),LZMAMaxExtent(packet_size*image->columns)),
       ZipMaxExtent(packet_size*image->columns));
@@ -2160,19 +2163,22 @@ static MagickBooleanType WriteMIFFImage(
       default:
         break;
     }
-    packet_size=(size_t) (image->depth/8);
-    if (image->storage_class == DirectClass)
-      packet_size=(size_t) (3*image->depth/8);
-    if (IsGrayColorspace(image->colorspace) != MagickFalse)
-      packet_size=(size_t) (image->depth/8);
-    if (image->alpha_trait != UndefinedPixelTrait)
-      packet_size+=image->depth/8;
-    if (image->colorspace == CMYKColorspace)
-      packet_size+=image->depth/8;
-    if (compression == RLECompression)
-      packet_size++;
     if (image->number_meta_channels != 0)
-      packet_size+=image->number_meta_channels*image->depth/8;
+      packet_size=GetImageChannels(image)*image->depth/8;
+    else
+      {
+        packet_size=(size_t) (image->depth/8);
+        if (image->storage_class == DirectClass)
+          packet_size=(size_t) (3*image->depth/8);
+        if (IsGrayColorspace(image->colorspace) != MagickFalse)
+          packet_size=(size_t) (image->depth/8);
+        if (image->alpha_trait != UndefinedPixelTrait)
+          packet_size+=image->depth/8;
+        if (image->colorspace == CMYKColorspace)
+          packet_size+=image->depth/8;
+        if (compression == RLECompression)
+          packet_size++;
+      }
     length=MagickMax(BZipMaxExtent(packet_size*image->columns),ZipMaxExtent(
       packet_size*image->columns));
     if ((compression == BZipCompression) || (compression == ZipCompression))