Commit 33531ba6f for imagemagick.org

commit 33531ba6f6798563bd5718510a82768484c9126f
Author: Cristy <urban-warrior@imagemagick.org>
Date:   Fri Feb 13 22:07:11 2026 -0500

    https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-mh5h-j6mf-5vr6

diff --git a/MagickCore/constitute.c b/MagickCore/constitute.c
index f57f4656f..43453c64a 100644
--- a/MagickCore/constitute.c
+++ b/MagickCore/constitute.c
@@ -735,14 +735,14 @@ MagickExport Image *ReadImage(const ImageInfo *image_info,
         Call appropriate image reader based on image type.
       */
       if (GetMagickDecoderThreadSupport(magick_info) == MagickFalse)
-        LockSemaphoreInfo(magick_info->semaphore);
+        LockSemaphoreInfo(read_info->semaphore);
       status=IsCoderAuthorized(magick_info->magick_module,read_info->magick,
         ReadPolicyRights,exception);
       image=(Image *) NULL;
       if (status != MagickFalse)
         image=decoder(read_info,exception);
       if (GetMagickDecoderThreadSupport(magick_info) == MagickFalse)
-        UnlockSemaphoreInfo(magick_info->semaphore);
+        UnlockSemaphoreInfo(read_info->semaphore);
     }
   else
     {
@@ -770,11 +770,11 @@ MagickExport Image *ReadImage(const ImageInfo *image_info,
         MagickPathExtent);
       *read_info->filename='\0';
       if (GetDelegateThreadSupport(delegate_info) == MagickFalse)
-        LockSemaphoreInfo(delegate_info->semaphore);
+        LockSemaphoreInfo(read_info->semaphore);
       status=InvokeDelegate(read_info,image,read_info->magick,(char *) NULL,
         exception);
       if (GetDelegateThreadSupport(delegate_info) == MagickFalse)
-        UnlockSemaphoreInfo(delegate_info->semaphore);
+        UnlockSemaphoreInfo(read_info->semaphore);
       image=DestroyImageList(image);
       read_info->temporary=MagickTrue;
       if (status != MagickFalse)
@@ -797,14 +797,14 @@ MagickExport Image *ReadImage(const ImageInfo *image_info,
         Call appropriate image reader based on image type.
       */
       if (GetMagickDecoderThreadSupport(magick_info) == MagickFalse)
-        LockSemaphoreInfo(magick_info->semaphore);
+        LockSemaphoreInfo(read_info->semaphore);
       status=IsCoderAuthorized(magick_info->magick_module,read_info->magick,
         ReadPolicyRights,exception);
       image=(Image *) NULL;
       if (status != MagickFalse)
         image=(decoder)(read_info,exception);
       if (GetMagickDecoderThreadSupport(magick_info) == MagickFalse)
-        UnlockSemaphoreInfo(magick_info->semaphore);
+        UnlockSemaphoreInfo(read_info->semaphore);
     }
   if (read_info->temporary != MagickFalse)
     {
@@ -1339,13 +1339,13 @@ MagickExport MagickBooleanType WriteImage(const ImageInfo *image_info,
         Call appropriate image writer based on image type.
       */
       if (GetMagickEncoderThreadSupport(magick_info) == MagickFalse)
-        LockSemaphoreInfo(magick_info->semaphore);
+        LockSemaphoreInfo(write_info->semaphore);
       status=IsCoderAuthorized(magick_info->magick_module,write_info->magick,
         WritePolicyRights,exception);
       if (status != MagickFalse)
         status=encoder(write_info,image,exception);
       if (GetMagickEncoderThreadSupport(magick_info) == MagickFalse)
-        UnlockSemaphoreInfo(magick_info->semaphore);
+        UnlockSemaphoreInfo(write_info->semaphore);
     }
   else
     {
@@ -1357,11 +1357,11 @@ MagickExport MagickBooleanType WriteImage(const ImageInfo *image_info,
           */
           *write_info->filename='\0';
           if (GetDelegateThreadSupport(delegate_info) == MagickFalse)
-            LockSemaphoreInfo(delegate_info->semaphore);
+            LockSemaphoreInfo(write_info->semaphore);
           status=InvokeDelegate(write_info,image,(char *) NULL,
             write_info->magick,exception);
           if (GetDelegateThreadSupport(delegate_info) == MagickFalse)
-            UnlockSemaphoreInfo(delegate_info->semaphore);
+            UnlockSemaphoreInfo(write_info->semaphore);
           (void) CopyMagickString(image->filename,filename,MagickPathExtent);
         }
       else
@@ -1411,13 +1411,13 @@ MagickExport MagickBooleanType WriteImage(const ImageInfo *image_info,
                 Call appropriate image writer based on image type.
               */
               if (GetMagickEncoderThreadSupport(magick_info) == MagickFalse)
-                LockSemaphoreInfo(magick_info->semaphore);
-              status=IsCoderAuthorized(magick_info->magick_module,write_info->magick,
-                WritePolicyRights,exception);
+                LockSemaphoreInfo(write_info->semaphore);
+              status=IsCoderAuthorized(magick_info->magick_module,
+                write_info->magick,WritePolicyRights,exception);
               if (status != MagickFalse)
                 status=encoder(write_info,image,exception);
               if (GetMagickEncoderThreadSupport(magick_info) == MagickFalse)
-                UnlockSemaphoreInfo(magick_info->semaphore);
+                UnlockSemaphoreInfo(write_info->semaphore);
             }
         }
     }
diff --git a/MagickCore/image.c b/MagickCore/image.c
index 34d6104b3..c27320b65 100644
--- a/MagickCore/image.c
+++ b/MagickCore/image.c
@@ -1287,6 +1287,8 @@ MagickExport ImageInfo *DestroyImageInfo(ImageInfo *image_info)
     image_info->profile=(void *) DestroyStringInfo((StringInfo *)
       image_info->profile);
   DestroyImageOptions(image_info);
+  if (image_info->semaphore != (SemaphoreInfo *) NULL)
+    RelinquishSemaphoreInfo(&image_info->semaphore);
   image_info->signature=(~MagickCoreSignature);
   image_info=(ImageInfo *) RelinquishMagickMemory(image_info);
   return(image_info);
@@ -1378,6 +1380,7 @@ MagickExport void GetImageInfo(ImageInfo *image_info)
   GetPixelInfoRGBA(TransparentColorRGBA,&image_info->transparent_color);
   image_info->debug=(GetLogEventMask() & ImageEvent) != 0 ? MagickTrue :
     MagickFalse;
+  image_info->semaphore=AcquireSemaphoreInfo();
   image_info->signature=MagickCoreSignature;
 }

diff --git a/MagickCore/image.h b/MagickCore/image.h
index bbc3dfe33..e3ba12648 100644
--- a/MagickCore/image.h
+++ b/MagickCore/image.h
@@ -475,6 +475,9 @@ struct _ImageInfo

   PixelInfo
     matte_color;        /* matte (frame) color */
+
+  SemaphoreInfo
+    *semaphore;
 };

 extern MagickExport ChannelType