Commit 45607f8b5 for imagemagick.org
commit 45607f8b5aea3f8766dd52e4c9d7ff1c8ca71601
Author: Cristy <urban-warrior@imagemagick.org>
Date: Tue Nov 10 10:56:51 2026 -0500
https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-g3c3-wcx5-7qrw
diff --git a/coders/heic.c b/coders/heic.c
index 3b9a5bab2..4a1b2c964 100644
--- a/coders/heic.c
+++ b/coders/heic.c
@@ -931,12 +931,18 @@ static MagickBooleanType ReadHEICSequenceFrames(const ImageInfo *image_info,
has_alpha=heif_image_has_channel(heif_image,heif_channel_Alpha);
number_channels=has_alpha != 0 ? 4 : 3;
for (c=0; c < number_channels; c++)
- {
- bits_per_pixel[c]=heif_image_get_bits_per_pixel_range(heif_image,
- channels[c]);
- if ((bits_per_pixel[c] <= 0) || (bits_per_pixel[c] > 16))
- break;
- }
+ {
+ int plane_width = heif_image_get_width(heif_image,channels[c]);
+ int plane_height = heif_image_get_height(heif_image,channels[c]);
+ if ((plane_width <= 0) || (plane_height <= 0) ||
+ ((size_t) plane_width < image->columns) ||
+ ((size_t) plane_height < image->rows))
+ break;
+ bits_per_pixel[c]=heif_image_get_bits_per_pixel_range(heif_image,
+ channels[c]);
+ if ((bits_per_pixel[c] <= 0) || (bits_per_pixel[c] > 16))
+ break;
+ }
if (c != number_channels)
{
(void) ThrowMagickException(exception,GetMagickModule(),