Commit 3392b4bba for imagemagick.org
commit 3392b4bba6ce076f4d88f5653a42d97b7e4f6970
Author: Cristy <urban-warrior@imagemagick.org>
Date: Tue Feb 10 19:37:58 2026 -0500
https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-fpvf-frm6-625q
diff --git a/coders/msl.c b/coders/msl.c
index c979b30db..99e31f158 100644
--- a/coders/msl.c
+++ b/coders/msl.c
@@ -273,7 +273,7 @@ static ssize_t MSLPushImage(MSLInfo *msl_info,Image *image)
(msl_info->attributes[n] == (Image *) NULL))
ThrowFatalException(ResourceLimitFatalError,"MemoryAllocationFailed")
if (msl_info->number_groups != 0)
- msl_info->group_info[msl_info->number_groups-1].numImages++;
+ msl_info->group_info[msl_info->number_groups].numImages++;
return(n);
}
@@ -3062,6 +3062,13 @@ static void MSLStartElement(void *context,const xmlChar *tag,
msl_info->group_info=(MSLGroupInfo *) ResizeQuantumMemory(
msl_info->group_info,(size_t) (msl_info->number_groups+1),
sizeof(*msl_info->group_info));
+ if (msl_info->group_info == (MSLGroupInfo *) NULL)
+ {
+ ThrowMSLException(ResourceLimitFatalError,"UnableToInterpretMSLImage",
+ keyword);
+ break;
+ }
+ msl_info->group_info[msl_info->number_groups].numImages=0;
break;
}
ThrowMSLException(OptionError,"UnrecognizedElement",(const char *) tag);