Commit 813d6c020 for imagemagick.org

commit 813d6c020c6e5a3a6f244943ee38617353488c47
Author: Cristy <urban-warrior@imagemagick.org>
Date:   Mon Oct 26 17:01:26 2026 -0400

    https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-m2p5-qpx9-5mx6

diff --git a/coders/png.c b/coders/png.c
index a8d7d4dd7..28583e027 100644
--- a/coders/png.c
+++ b/coders/png.c
@@ -2783,19 +2783,24 @@ static Image *ReadOnePNGImage(MngReadInfo *mng_info,
                       if (png_get_valid(ping, ping_info, PNG_INFO_bKGD))
                         background.index=ping_background->index;

-                      background.red=(png_uint_16)
-                        mng_info->global_plte[background.index].red;
+                      if (background.index >= mng_info->global_plte_length)
+                        png_error(ping,"bKGD index exceeds global PLTE");
+                      else
+                        {
+                          background.red=(png_uint_16)
+                            mng_info->global_plte[background.index].red;

-                      background.green=(png_uint_16)
-                        mng_info->global_plte[background.index].green;
+                          background.green=(png_uint_16)
+                            mng_info->global_plte[background.index].green;

-                      background.blue=(png_uint_16)
-                        mng_info->global_plte[background.index].blue;
+                          background.blue=(png_uint_16)
+                            mng_info->global_plte[background.index].blue;

-                      background.gray=(png_uint_16)
-                        mng_info->global_plte[background.index].green;
+                          background.gray=(png_uint_16)
+                            mng_info->global_plte[background.index].green;

-                      png_set_bKGD(ping,ping_info,&background);
+                          png_set_bKGD(ping,ping_info,&background);
+                       }
                     }
 #endif
                 }