Commit c9c87dbab for imagemagick.org
commit c9c87dbaba56bf82aebd3392e11f0ffd93709b12
Author: Dirk Lemstra <dirk@lemstra.org>
Date: Fri Feb 6 20:55:43 2026 +0100
Fixed out of bound read with negative pixel index (GHSA-vpxv-r9pg-7gpr)
diff --git a/coders/uil.c b/coders/uil.c
index e98cbd750..7f4db72c3 100644
--- a/coders/uil.c
+++ b/coders/uil.c
@@ -352,11 +352,14 @@ static MagickBooleanType WriteUILImage(const ImageInfo *image_info,Image *image,
for (x=0; x < (ssize_t) image->columns; x++)
{
k=((ssize_t) GetPixelIndex(image,p) % MaxCixels);
+ if (k < 0)
+ k=0;
symbol[0]=Cixel[k];
for (j=1; j < (int) characters_per_pixel; j++)
{
- k=(((int) GetPixelIndex(image,p)-k)/MaxCixels) %
- MaxCixels;
+ k=(((int) GetPixelIndex(image,p)-k)/MaxCixels) % MaxCixels;
+ if (k < 0)
+ k=0;
symbol[j]=Cixel[k];
}
symbol[j]='\0';