Commit 5b91ab69a for imagemagick.org
commit 5b91ab69af614024255fd93dcc9a62b41fbc435c
Author: Cristy <urban-warrior@imagemagick.org>
Date: Sat Jan 24 09:26:05 2026 -0500
https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-273h-m46v-96q4
diff --git a/coders/psd.c b/coders/psd.c
index 8c1c64f83..fa24a3b9b 100644
--- a/coders/psd.c
+++ b/coders/psd.c
@@ -1334,7 +1334,6 @@ static MagickBooleanType ReadPSDChannelZip(Image *image,
ThrowBinaryException(ResourceLimitError,"MemoryAllocationFailed",
image->filename);
}
- memset(pixels,0,count*sizeof(*pixels));
if (ReadBlob(image,compact_size,compact_pixels) != (ssize_t) compact_size)
{
pixels=(unsigned char *) RelinquishMagickMemory(pixels);
@@ -2328,7 +2327,13 @@ static MagickBooleanType ReadPSDMergedImage(const ImageInfo *image_info,
sizes=(MagickOffsetType *) NULL;
if (compression == RLE)
{
- sizes=ReadPSDRLESizes(image,psd_info,image->rows*psd_info->channels);
+ size_t
+ extent;
+
+ if (HeapOverflowSanityCheckGetSize(image->rows,psd_info->channels,&extent) != MagickFalse)
+ ThrowBinaryException(ResourceLimitError,"MemoryAllocationFailed",
+ image->filename);
+ sizes=ReadPSDRLESizes(image,psd_info,extent);
if (sizes == (MagickOffsetType *) NULL)
ThrowBinaryException(ResourceLimitError,"MemoryAllocationFailed",
image->filename);
@@ -2639,23 +2644,19 @@ static Image *ReadPSDImage(const ImageInfo *image_info,ExceptionInfo *exception)
*/
(void) SeekBlob(image,offset+(MagickOffsetType) length,SEEK_SET);
}
+ /*
+ If we are only "pinging" the image, then we're done - so return.
+ */
if (EOFBlob(image) != MagickFalse)
{
if (profile != (StringInfo *) NULL)
profile=DestroyStringInfo(profile);
ThrowReaderException(CorruptImageError,"UnexpectedEndOfFile");
}
- /*
- If we are only "pinging" the image, then we're done - so return.
- */
if (image_info->ping != MagickFalse)
{
if (profile != (StringInfo *) NULL)
- {
- (void) SetImageProfile(image,GetStringInfoName(profile),profile,
- exception);
- profile=DestroyStringInfo(profile);
- }
+ profile=DestroyStringInfo(profile);
(void) CloseBlob(image);
return(GetFirstImageInList(image));
}