Commit 9f91a2b2f for imagemagick.org

commit 9f91a2b2ff42bf5672ee6e27b7bdfece94520be4
Author: Dirk Lemstra <dirk@lemstra.org>
Date:   Sat Nov 14 11:56:21 2026 +0100

    Perform the null checks inside a lock instead (https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-cvrx-j29f-c5q9)

diff --git a/MagickCore/splay-tree.c b/MagickCore/splay-tree.c
index efbe10782..a1706ab14 100644
--- a/MagickCore/splay-tree.c
+++ b/MagickCore/splay-tree.c
@@ -775,10 +775,13 @@ MagickExport const void *GetNextKeyInSplayTree(SplayTreeInfo *splay_tree)
   assert(splay_tree->signature == MagickCoreSignature);
   if (IsEventLogging() != MagickFalse)
     (void) LogMagickEvent(TraceEvent,GetMagickModule(),"...");
+  LockSemaphoreInfo(splay_tree->semaphore);
   if ((splay_tree->root == (NodeInfo *) NULL) ||
       (splay_tree->next == (void *) NULL))
-    return((void *) NULL);
-  LockSemaphoreInfo(splay_tree->semaphore);
+    {
+      UnlockSemaphoreInfo(splay_tree->semaphore);
+      return((void *) NULL);
+    }
   SplaySplayTree(splay_tree,splay_tree->next);
   splay_tree->next=(void *) NULL;
   node=splay_tree->root->right;
@@ -829,10 +832,13 @@ MagickExport const void *GetNextValueInSplayTree(SplayTreeInfo *splay_tree)
   assert(splay_tree->signature == MagickCoreSignature);
   if (IsEventLogging() != MagickFalse)
     (void) LogMagickEvent(TraceEvent,GetMagickModule(),"...");
+  LockSemaphoreInfo(splay_tree->semaphore);
   if ((splay_tree->root == (NodeInfo *) NULL) ||
       (splay_tree->next == (void *) NULL))
-    return((void *) NULL);
-  LockSemaphoreInfo(splay_tree->semaphore);
+    {
+      UnlockSemaphoreInfo(splay_tree->semaphore);
+      return((void *) NULL);
+    }
   SplaySplayTree(splay_tree,splay_tree->next);
   splay_tree->next=(void *) NULL;
   node=splay_tree->root->right;