File ImageMagick-CVE-2025-46393.patch of Package ImageMagick.39703

Index: ImageMagick-7.1.0-9/coders/miff.c
===================================================================
--- ImageMagick-7.1.0-9.orig/coders/miff.c
+++ ImageMagick-7.1.0-9/coders/miff.c
@@ -1311,17 +1311,22 @@ static Image *ReadMIFFImage(const ImageI
         if (status == MagickFalse)
           ThrowMIFFException(ResourceLimitError,"MemoryAllocationFailed");
       }
-    packet_size=(size_t) (quantum_info->depth/8);
-    if (image->storage_class == DirectClass)
-      packet_size=(size_t) (3*quantum_info->depth/8);
-    if (IsGrayColorspace(image->colorspace) != MagickFalse)
-      packet_size=quantum_info->depth/8;
-    if (image->alpha_trait != UndefinedPixelTrait)
-      packet_size+=quantum_info->depth/8;
-    if (image->colorspace == CMYKColorspace)
-      packet_size+=quantum_info->depth/8;
-    if (image->compression == RLECompression)
-      packet_size++;
+    if (image->number_meta_channels != 0)
+      packet_size=GetImageChannels(image)*image->depth/8;
+    else
+      {
+        packet_size=(size_t) (quantum_info->depth/8);
+        if (image->storage_class == DirectClass)
+          packet_size=(size_t) (3*quantum_info->depth/8);
+        if (IsGrayColorspace(image->colorspace) != MagickFalse)
+          packet_size=quantum_info->depth/8;
+        if (image->alpha_trait != UndefinedPixelTrait)
+          packet_size+=quantum_info->depth/8;
+        if (image->colorspace == CMYKColorspace)
+          packet_size+=quantum_info->depth/8;
+        if (image->compression == RLECompression)
+          packet_size++;
+      }
     compress_extent=MagickMax(MagickMax(BZipMaxExtent(packet_size*
       image->columns),LZMAMaxExtent(packet_size*image->columns)),
       ZipMaxExtent(packet_size*image->columns));
@@ -2121,17 +2126,22 @@ static MagickBooleanType WriteMIFFImage(
       default:
         break;
     }
-    packet_size=(size_t) (quantum_info->depth/8);
-    if (image->storage_class == DirectClass)
-      packet_size=(size_t) (3*quantum_info->depth/8);
-    if (IsGrayColorspace(image->colorspace) != MagickFalse)
-      packet_size=(size_t) (quantum_info->depth/8);
-    if (image->alpha_trait != UndefinedPixelTrait)
-      packet_size+=quantum_info->depth/8;
-    if (image->colorspace == CMYKColorspace)
-      packet_size+=quantum_info->depth/8;
-    if (compression == RLECompression)
-      packet_size++;
+    if (image->number_meta_channels != 0)
+      packet_size=GetImageChannels(image)*image->depth/8;
+    else
+      {
+        packet_size=(size_t) (quantum_info->depth/8);
+        if (image->storage_class == DirectClass)
+          packet_size=(size_t) (3*quantum_info->depth/8);
+        if (IsGrayColorspace(image->colorspace) != MagickFalse)
+          packet_size=(size_t) (quantum_info->depth/8);
+        if (image->alpha_trait != UndefinedPixelTrait)
+          packet_size+=quantum_info->depth/8;
+        if (image->colorspace == CMYKColorspace)
+          packet_size+=quantum_info->depth/8;
+        if (compression == RLECompression)
+          packet_size++;
+      }
     length=MagickMax(BZipMaxExtent(packet_size*image->columns),ZipMaxExtent(
       packet_size*image->columns));
     if ((compression == BZipCompression) || (compression == ZipCompression))