Commit 8ca7ac5c8 for imagemagick.org

commit 8ca7ac5c80f4447dacf4ab572a4a0315d8f422cf
Author: Dirk Lemstra <dirk@lemstra.org>
Date:   Sat Nov 14 14:24:13 2026 +0100

    Correct the patch for GHSA-cvrx-j29f-c5q9 that causes a crash when the value in a splay tree owns the key.

diff --git a/MagickCore/splay-tree.c b/MagickCore/splay-tree.c
index a1706ab14..081c265c7 100644
--- a/MagickCore/splay-tree.c
+++ b/MagickCore/splay-tree.c
@@ -210,14 +210,22 @@ MagickExport MagickBooleanType AddValueToSplayTree(SplayTreeInfo *splay_tree,
           ((splay_tree->root->key < key) ? -1 : 0);
       if (compare == 0)
         {
+          if (splay_tree->relinquish_key != (void *(*)(void *)) NULL)
+            {
+              if ((key != (const void *) NULL) &&
+                  (key != splay_tree->root->key))
+                (void) splay_tree->relinquish_key((void *) key);
+            }
+          else
+            {
+              if (splay_tree->next == splay_tree->root->key)
+                splay_tree->next=(void *) key;
+              splay_tree->root->key=(void *) key;
+            }
           if ((splay_tree->relinquish_value != (void *(*)(void *)) NULL) &&
               (splay_tree->root->value != (void *) NULL))
             splay_tree->root->value=splay_tree->relinquish_value(
               splay_tree->root->value);
-           if ((splay_tree->relinquish_key != (void *(*)(void *)) NULL) &&
-               (key != (const void *) NULL) &&
-               (key != splay_tree->root->key))
-             (void) splay_tree->relinquish_key((void *) key);
           splay_tree->root->value=(void *) value;
           UnlockSemaphoreInfo(splay_tree->semaphore);
           return(MagickTrue);