Commit 729253dc1 for imagemagick.org

commit 729253dc16e1a1ec4cac891a12d597e3fa9336b3
Author: Cristy <urban-warrior@imagemagick.org>
Date:   Sun Feb 1 13:55:34 2026 -0500

    https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-xg29-8ghv-v4xr

diff --git a/coders/sixel.c b/coders/sixel.c
index 3562fdb2a..6d8bae399 100644
--- a/coders/sixel.c
+++ b/coders/sixel.c
@@ -251,7 +251,6 @@ static MagickBooleanType sixel_decode(Image *image,unsigned char *p,
     c,
     color_index,
     g,
-    i,
     n,
     max_color_index,
     max_x,
@@ -262,23 +261,24 @@ static MagickBooleanType sixel_decode(Image *image,unsigned char *p,
     r,
     repeat_count,
     sixel_palet[SIXEL_PALETTE_MAX],
-    sixel_vertical_mask,
-    x,
-    y;
+    sixel_vertical_mask;

   sixel_pixel_t
     *dmbuf,
     *imbuf;

   size_t
-    extent,
-    offset;
+    extent;

   ssize_t
     dmsx,
     dmsy,
+    i,
     imsx,
-    imsy;
+    imsy,
+    offset,
+    x,
+    y;

   extent=strlen((char *) p);
   position_x=position_y=0;
@@ -295,7 +295,8 @@ static MagickBooleanType sixel_decode(Image *image,unsigned char *p,
   imsy=2048;
   if (SetImageExtent(image,(size_t) imsx,(size_t) imsy,exception) == MagickFalse)
     return(MagickFalse);
-  imbuf=(sixel_pixel_t *) AcquireQuantumMemory((size_t) imsx,(size_t) imsy*sizeof(sixel_pixel_t));
+  imbuf=(sixel_pixel_t *) AcquireQuantumMemory((size_t) imsx,
+    (size_t) imsy*sizeof(sixel_pixel_t));
   if (imbuf == (sixel_pixel_t *) NULL)
     return(MagickFalse);
   for (n = 0; n < 16; n++)
@@ -316,7 +317,7 @@ static MagickBooleanType sixel_decode(Image *image,unsigned char *p,
     sixel_palet[n++]=SIXEL_RGB(i*11,i*11,i*11);
   for (; n < SIXEL_PALETTE_MAX; n++)
     sixel_palet[n]=SIXEL_RGB(255,255,255);
-  for (i = 0; i < imsx * imsy; i++)
+  for (i = 0; i < (imsx*imsy); i++)
     imbuf[i]=(sixel_pixel_t) background_color_index;
   while (*p != '\0')
   {
@@ -410,7 +411,7 @@ static MagickBooleanType sixel_decode(Image *image,unsigned char *p,
               }
             (void) memset(dmbuf,background_color_index,(size_t) dmsx*(size_t)
               dmsy*sizeof(sixel_pixel_t));
-            for (y = 0; y < imsy; ++y)
+            for (y=0; y < imsy; ++y)
               (void) memcpy(dmbuf+dmsx*y,imbuf+imsx*y,(size_t) imsx*
                 sizeof(sixel_pixel_t));
             imbuf=(sixel_pixel_t *) RelinquishMagickMemory(imbuf);
@@ -487,7 +488,8 @@ static MagickBooleanType sixel_decode(Image *image,unsigned char *p,
       }
     else if ((*p >= '?') && (*p <= '\177'))
       {
-        if ((imsx < (position_x + repeat_count)) || (imsy < (position_y + 6)))
+        if ((imsx < ((ssize_t) position_x+repeat_count)) ||
+            (imsy < ((ssize_t) position_y+6)))
           {
             ssize_t
               nx,
@@ -496,7 +498,7 @@ static MagickBooleanType sixel_decode(Image *image,unsigned char *p,
             nx=imsx*2;
             ny=imsy*2;

-            while ((nx < (position_x + repeat_count)) || (ny < (position_y + 6)))
+            while ((nx < ((ssize_t) position_x+repeat_count)) || (ny < ((ssize_t) position_y+6)))
             {
               nx *= 2;
               ny *= 2;
@@ -536,9 +538,9 @@ static MagickBooleanType sixel_decode(Image *image,unsigned char *p,
                 {
                   if ((b & sixel_vertical_mask) != 0)
                     {
-                      offset=(size_t) (imsx*((ssize_t) position_y+i)+
+                      offset=(ssize_t) (imsx*((ssize_t) position_y+i)+
                         (ssize_t) position_x);
-                      if (offset >= (size_t) (imsx*imsy))
+                      if (offset >= (imsx*imsy))
                         {
                           imbuf=(sixel_pixel_t *) RelinquishMagickMemory(imbuf);
                           return(MagickFalse);
@@ -568,10 +570,11 @@ static MagickBooleanType sixel_decode(Image *image,unsigned char *p,
                       }
                       for (y = position_y + i; y < position_y + i + n; ++y)
                       {
-                        offset=(size_t) ((ssize_t) imsx*y+(ssize_t) position_x);
-                        if ((offset+(size_t) repeat_count) >= (size_t) (imsx*imsy))
+                        offset=(imsx*y+position_x);
+                        if ((offset+repeat_count) >= (imsx*imsy))
                           {
-                            imbuf=(sixel_pixel_t *) RelinquishMagickMemory(imbuf);
+                            imbuf=(sixel_pixel_t *)
+                              RelinquishMagickMemory(imbuf);
                             return(MagickFalse);
                           }
                         for (x = 0; x < repeat_count; x++)