Commit 0bcf10763 for imagemagick.org
commit 0bcf10763277cdf0f61cf85e786575ae8665f13b
Author: Cristy <urban-warrior@imagemagick.org>
Date: Mon Jun 15 10:43:50 2026 -0400
https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-rvhp-75f6-9jqh
diff --git a/MagickCore/matrix.c b/MagickCore/matrix.c
index a82c2e044..0f54780bf 100644
--- a/MagickCore/matrix.c
+++ b/MagickCore/matrix.c
@@ -49,6 +49,7 @@
#include "MagickCore/matrix.h"
#include "MagickCore/matrix-private.h"
#include "MagickCore/memory_.h"
+#include "MagickCore/memory-private.h"
#include "MagickCore/nt-base-private.h"
#include "MagickCore/pixel-accessor.h"
#include "MagickCore/resource_.h"
@@ -236,14 +237,15 @@ MagickExport MatrixInfo *AcquireMatrixInfo(const size_t columns,
matrix_info->type=MemoryCache;
status=AcquireMagickResource(AreaResource,matrix_info->length);
if ((status != MagickFalse) &&
- (matrix_info->length == (MagickSizeType) ((size_t) matrix_info->length)))
+ (matrix_info->length == (MagickSizeType) ((size_t) matrix_info->length)) &&
+ ((size_t) matrix_info->length <= GetMaxMemoryRequest()))
{
status=AcquireMagickResource(MemoryResource,matrix_info->length);
if (status != MagickFalse)
{
matrix_info->mapped=MagickFalse;
- matrix_info->elements=AcquireAlignedMemory((size_t)
- matrix_info->length,1);
+ matrix_info->elements=MagickAssumeAligned(AcquireAlignedMemory(1,
+ (size_t) matrix_info->length));
if (matrix_info->elements == NULL)
{
matrix_info->mapped=MagickTrue;