Commit 06fb1aa75 for imagemagick.org
commit 06fb1aa7589f4eec363b33c2bbda5986a92bb259
Author: Cristy <urban-warrior@imagemagick.org>
Date: Thu May 14 19:41:53 2026 -0400
https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-rcr6-g7jc-f57g
diff --git a/MagickCore/fx.c b/MagickCore/fx.c
index 849285607..dc96e9bdd 100644
--- a/MagickCore/fx.c
+++ b/MagickCore/fx.c
@@ -2249,12 +2249,22 @@ static MagickBooleanType GetOperand (
}
return MagickTrue;
} else if (OprIsUnaryPrefix (op)) {
+ MagickBooleanType operand_ok;
if (!PushOperatorStack (pfx, (int) op)) return MagickFalse;
pfx->pex++;
SkipSpaces (pfx);
if (!*pfx->pex) return MagickFalse;
-
- if (!GetOperand (pfx, UserSymbol, NewUserSymbol, UserSymNdx, needPopAll)) {
+ if (pfx->teDepth >= MagickMaxRecursionDepth) {
+ (void) ThrowMagickException (
+ pfx->exception, GetMagickModule(), OptionError,
+ "Expression too deeply nested", "(depth %i exceeds limit %i)",
+ pfx->teDepth, MagickMaxRecursionDepth);
+ return MagickFalse;
+ }
+ pfx->teDepth++;
+ operand_ok=GetOperand (pfx, UserSymbol, NewUserSymbol, UserSymNdx, needPopAll);
+ pfx->teDepth--;
+ if (!operand_ok) {
(void) ThrowMagickException (
pfx->exception, GetMagickModule(), OptionError,
"After unary, bad operand at", "'%s'",