Commit c2e84d828 for imagemagick.org

commit c2e84d828768e2997f6d6db1431bfba611c5b633
Author: Cristy <urban-warrior@imagemagick.org>
Date:   Tue Jun 30 19:59:41 2026 -0400

    check for possible add overflow

diff --git a/coders/jnx.c b/coders/jnx.c
index a2c173bd3..e2d4ff0e9 100644
--- a/coders/jnx.c
+++ b/coders/jnx.c
@@ -52,6 +52,7 @@
 #include "MagickCore/list.h"
 #include "MagickCore/magick.h"
 #include "MagickCore/memory_.h"
+#include "MagickCore/memory-private.h"
 #include "MagickCore/module.h"
 #include "MagickCore/monitor.h"
 #include "MagickCore/monitor-private.h"
@@ -246,15 +247,15 @@ static Image *ReadJNXImage(const ImageInfo *image_info,ExceptionInfo *exception)
         northeast,
         southwest;

+      size_t
+        tile_length;
+
       ssize_t
         count;

       unsigned char
         *blob;

-      unsigned int
-        tile_length;
-
       northeast.x=180.0*ReadBlobLSBSignedLong(image)/0x7fffffff;
       northeast.y=180.0*ReadBlobLSBSignedLong(image)/0x7fffffff;
       southwest.x=180.0*ReadBlobLSBSignedLong(image)/0x7fffffff;
@@ -279,15 +280,15 @@ static Image *ReadJNXImage(const ImageInfo *image_info,ExceptionInfo *exception)
       /*
         Read a tile.
       */
-      if (((MagickSizeType) tile_length) > GetBlobSize(image))
+      if (HeapOverflowCheckAdd(tile_length,2) != MagickFalse)
         {
           images=DestroyImageList(images);
-          ThrowReaderException(CorruptImageError,"InsufficientImageDataInFile");
+          ThrowReaderException(ResourceLimitError,"MemoryAllocationFailed");
         }
-      if (tile_length > (UINT_MAX-2))
+      if (((MagickSizeType) tile_length) > GetBlobSize(image))
         {
           images=DestroyImageList(images);
-          ThrowReaderException(ResourceLimitError,"MemoryAllocationFailed");
+          ThrowReaderException(CorruptImageError,"InsufficientImageDataInFile");
         }
       blob=(unsigned char *) AcquireQuantumMemory((size_t) tile_length+2,
         sizeof(*blob));