Commit d4e6fcdc6 for imagemagick.org

commit d4e6fcdc6f1a6d0973c5ae0d36955eea237f571f
Author: Cristy <urban-warrior@imagemagick.org>
Date:   Wed Nov 11 16:26:16 2026 -0500

    https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-6r6f-x5h8-fw8h

diff --git a/MagickCore/image.c b/MagickCore/image.c
index 812351d58..d481987c5 100644
--- a/MagickCore/image.c
+++ b/MagickCore/image.c
@@ -1697,6 +1697,45 @@ static inline MagickBooleanType IsValidFormatSpecifier(const char *start,
   return(MagickFalse);
 }

+static void SanitizeFilenameProperty(const char *source,char *destination,
+  const size_t destination_size)
+{
+  char
+    *p;
+
+  const char
+    *q;
+
+  if (source == (const char *) NULL)
+    {
+      if (destination_size > 0)
+        destination[0]='\0';
+      return;
+    }
+  p=destination;
+  for (q=source; *q != '\0' && (size_t) (p-destination) < (destination_size-1); q++)
+  {
+    if ((*q == '/') || (*q == '\\'))
+      *p++='_';
+    else
+      if ((*q == '.') && (*(q+1) == '.') && ((*(q+2) == '/') ||
+          (*(q+2) == '\\') || (*(q+2) == '\0')))
+        {
+          if ((size_t) (p-destination) < (destination_size-2))
+            {
+              *p++='_';
+              *p++='_';
+            }
+          else
+            *p++='_';
+          q++;
+        }
+      else
+        *p++=(*q);
+  }
+  *p='\0';
+}
+
 MagickExport size_t InterpretImageFilename(const ImageInfo *image_info,
   Image *image,const char *format,int value,char *filename,
   ExceptionInfo *exception)
@@ -1790,11 +1829,14 @@ MagickExport size_t InterpretImageFilename(const ImageInfo *image_info,
         const char
           *end = strchr(cursor,']'),
           *option = (const char *) NULL;
-
+
         size_t
           extent,
           option_length;

+        char
+          sanitized_option[MagickPathExtent];
+
         if (end == (const char *) NULL)
           continue;
         extent=(size_t) (end-cursor-1);
@@ -1813,11 +1855,14 @@ MagickExport size_t InterpretImageFilename(const ImageInfo *image_info,
           option=GetImageOption(image_info,pattern);
         if (option == (const char *) NULL)
           continue;
+        SanitizeFilenameProperty(option,sanitized_option,
+          sizeof(sanitized_option));
+        option=sanitized_option;
         option_length=strlen(option);
         if ((p-filename+(ssize_t) option_length) >= MagickPathExtent)
           return(0);
-        (void) CopyMagickString(p,option,(size_t) (MagickPathExtent-
-          (p-filename)));
+        (void) CopyMagickString(p,option,(size_t) (MagickPathExtent-(p-
+          filename)));
         p+=option_length;
         cursor=end+1;
         continue;