Commit 61bcc7f81 for imagemagick.org

commit 61bcc7f815eb2372a262cffa983460068862abc0
Author: Dirk Lemstra <dirk@lemstra.org>
Date:   Sat Nov 14 11:14:42 2026 +0100

    Fix dangling splay-tree iterator after node removal (GHSA-cvrx-j29f-c5q9)

diff --git a/MagickCore/splay-tree.c b/MagickCore/splay-tree.c
index 61f98ada5..efbe10782 100644
--- a/MagickCore/splay-tree.c
+++ b/MagickCore/splay-tree.c
@@ -133,6 +133,18 @@ static NodeInfo *DetachRootFromSplayTree(SplayTreeInfo *splay_tree)
   node=splay_tree->root;
   left=node->left;
   right=node->right;
+  if (splay_tree->next == node->key)
+    {
+      NodeInfo
+        *successor;
+
+      successor=right;
+      if (successor != (NodeInfo *) NULL)
+        while (successor->left != (NodeInfo *) NULL)
+          successor=successor->left;
+      splay_tree->next=successor != (NodeInfo *) NULL ?
+        successor->key : (void *) NULL;
+    }
   splay_tree->root=right;
   if (left != (NodeInfo *) NULL)
     {