Commit 5b91ab69a for imagemagick.org

commit 5b91ab69af614024255fd93dcc9a62b41fbc435c
Author: Cristy <urban-warrior@imagemagick.org>
Date:   Sat Jan 24 09:26:05 2026 -0500

    https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-273h-m46v-96q4

diff --git a/coders/psd.c b/coders/psd.c
index 8c1c64f83..fa24a3b9b 100644
--- a/coders/psd.c
+++ b/coders/psd.c
@@ -1334,7 +1334,6 @@ static MagickBooleanType ReadPSDChannelZip(Image *image,
       ThrowBinaryException(ResourceLimitError,"MemoryAllocationFailed",
         image->filename);
     }
-  memset(pixels,0,count*sizeof(*pixels));
   if (ReadBlob(image,compact_size,compact_pixels) != (ssize_t) compact_size)
     {
       pixels=(unsigned char *) RelinquishMagickMemory(pixels);
@@ -2328,7 +2327,13 @@ static MagickBooleanType ReadPSDMergedImage(const ImageInfo *image_info,
   sizes=(MagickOffsetType *) NULL;
   if (compression == RLE)
     {
-      sizes=ReadPSDRLESizes(image,psd_info,image->rows*psd_info->channels);
+      size_t
+        extent;
+
+      if (HeapOverflowSanityCheckGetSize(image->rows,psd_info->channels,&extent) != MagickFalse)
+        ThrowBinaryException(ResourceLimitError,"MemoryAllocationFailed",
+          image->filename);
+      sizes=ReadPSDRLESizes(image,psd_info,extent);
       if (sizes == (MagickOffsetType *) NULL)
         ThrowBinaryException(ResourceLimitError,"MemoryAllocationFailed",
           image->filename);
@@ -2639,23 +2644,19 @@ static Image *ReadPSDImage(const ImageInfo *image_info,ExceptionInfo *exception)
       */
       (void) SeekBlob(image,offset+(MagickOffsetType) length,SEEK_SET);
     }
+  /*
+    If we are only "pinging" the image, then we're done - so return.
+  */
   if (EOFBlob(image) != MagickFalse)
     {
       if (profile != (StringInfo *) NULL)
         profile=DestroyStringInfo(profile);
       ThrowReaderException(CorruptImageError,"UnexpectedEndOfFile");
     }
-  /*
-    If we are only "pinging" the image, then we're done - so return.
-  */
   if (image_info->ping != MagickFalse)
     {
       if (profile != (StringInfo *) NULL)
-        {
-          (void) SetImageProfile(image,GetStringInfoName(profile),profile,
-            exception);
-          profile=DestroyStringInfo(profile);
-        }
+        profile=DestroyStringInfo(profile);
       (void) CloseBlob(image);
       return(GetFirstImageInList(image));
     }