Commit 998b3f91a for imagemagick.org

commit 998b3f91a5ee1e36e3db0e08d2db9661c79845ad
Author: Dirk Lemstra <dirk@lemstra.org>
Date:   Wed May 6 22:07:57 2026 +0200

    Added early exits when reading all the images would hit the list length limit.

diff --git a/coders/fits.c b/coders/fits.c
index 375e635b5..ebcefe790 100644
--- a/coders/fits.c
+++ b/coders/fits.c
@@ -444,6 +444,9 @@ static Image *ReadFITSImage(const ImageInfo *image_info,
           FITSBlocksize;
         (void) SeekBlob(image,(MagickOffsetType) number_pixels,SEEK_CUR);
       }
+    if (AcquireMagickResource(ListLengthResource,fits_info.number_planes) == MagickFalse)
+      ThrowFileException(exception,ResourceLimitError,"ListLengthExceedsLimit",
+        image->filename);
     for (scene=0; scene < (ssize_t) fits_info.number_planes; scene++)
     {
       image->columns=(size_t) fits_info.columns;
diff --git a/coders/flif.c b/coders/flif.c
index ca11d2014..a0631ace9 100644
--- a/coders/flif.c
+++ b/coders/flif.c
@@ -58,6 +58,7 @@
 #include "MagickCore/option.h"
 #include "MagickCore/pixel-accessor.h"
 #include "MagickCore/quantum-private.h"
+#include "MagickCore/resource_.h"
 #include "MagickCore/static.h"
 #include "MagickCore/string_.h"
 #include "MagickCore/string-private.h"
@@ -177,6 +178,9 @@ static Image *ReadFLIFImage(const ImageInfo *image_info,
       ThrowReaderException(CorruptImageError,"CorruptImage");
     }
   image_count=flif_decoder_num_images(flifdec);
+  if (AcquireMagickResource(ListLengthResource,image_count) == MagickFalse)
+    ThrowFileException(exception,ResourceLimitError,"ListLengthExceedsLimit",
+      image->filename);
   flifimage=flif_decoder_get_image(flifdec,0);
   length=sizeof(unsigned short)*4*flif_image_get_width(flifimage);
   pixels=(unsigned short *) AcquireQuantumMemory(1,length);