Commit 0ca86fca3 for imagemagick.org
commit 0ca86fca35915e22e66b4b1f95995d9f5f690f9a
Author: Cristy <urban-warrior@imagemagick.org>
Date: Tue Jun 30 22:25:57 2026 -0400
check for overflow
diff --git a/MagickCore/cache.c b/MagickCore/cache.c
index e28372ee9..27e549b06 100644
--- a/MagickCore/cache.c
+++ b/MagickCore/cache.c
@@ -4354,12 +4354,17 @@ MagickPrivate Quantum *QueueAuthenticPixelCacheNexus(Image *image,
}
if (IsValidPixelOffset(y,cache_info->columns) == MagickFalse)
return((Quantum *) NULL);
- offset=y*(MagickOffsetType) cache_info->columns+x;
+ offset=y*(MagickOffsetType) cache_info->columns;
+ if (IsOffsetOverflow(offset,(MagickOffsetType) x) == MagickFalse)
+ return((Quantum *) NULL);
+ offset+=x;
if (offset < 0)
return((Quantum *) NULL);
number_pixels=(MagickSizeType) cache_info->columns*cache_info->rows;
- offset+=((MagickOffsetType) rows-1)*(MagickOffsetType) cache_info->columns+
- (MagickOffsetType) columns-1;
+ offset+=((MagickOffsetType) rows-1)*(MagickOffsetType) cache_info->columns;
+ if (IsOffsetOverflow(offset,(MagickOffsetType) columns-1) == MagickFalse)
+ return((Quantum *) NULL);
+ offset+=(MagickOffsetType) columns-1;
if ((MagickSizeType) offset >= number_pixels)
return((Quantum *) NULL);
/*