Commit 0bbf7e48f for imagemagick.org

commit 0bbf7e48f5dd0ef540d3ae1ae8dfc6cd036fb640
Author: Cristy <urban-warrior@imagemagick.org>
Date:   Mon Jun 22 18:26:31 2026 -0400

    https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-422r-8c97-xcg4

diff --git a/MagickCore/fx.c b/MagickCore/fx.c
index 0fbf1d82b..9352862ea 100644
--- a/MagickCore/fx.c
+++ b/MagickCore/fx.c
@@ -875,64 +875,30 @@ static ElementTypeE TypeOfOpr (int op)
   return (ElementTypeE) 0;
 }

-static char *SetPtrShortExp(FxInfo *pfx, const char *pExp, size_t len)
+static char * SetPtrShortExp (FxInfo *pfx, char *pExp, size_t len)
 {
-#define MaxLen 20
+  #define MaxLen 20

-    char *dst = pfx->ShortExp;
-    size_t dst_size = MagickPathExtent;   // actual buffer size
-    size_t copy_len;
+  size_t slen;
+  char *p;

-    if (dst_size == 0)
-        return dst;
+  *pfx->ShortExp = '\0';

-    dst[0] = '\0';
+  if (pExp && len) {
+    slen = CopyMagickString(pfx->ShortExp, pExp, MagickPathExtent);

-    if (pExp && len)
-    {
-        char *p;
-
-        /* Clamp to buffer size - 1 */
-        copy_len = len;
-        if (copy_len > dst_size - 1)
-            copy_len = dst_size - 1;
-
-        memcpy(dst, pExp, copy_len);
-        dst[copy_len] = '\0';
-
-        /* Logical truncation to MaxLen */
-        if (copy_len > MaxLen)
-        {
-            if (MaxLen + 3 < dst_size)
-            {
-                memcpy(dst + MaxLen, "...", 3);
-                dst[MaxLen + 3] = '\0';
-            }
-            else
-            {
-                dst[dst_size - 1] = '\0';
-            }
-        }
+    if (slen > MaxLen) {
+      (void) CopyMagickString(pfx->ShortExp + MaxLen, "...", 4);
+    }

-        /* Replace newline / carriage return safely */
+    p = strchr(pfx->ShortExp, '\n');
+    if (p) (void) CopyMagickString(p, "...", 4);

-        if ((p = strchr(dst, '\n')) != NULL ||
-            (p = strchr(dst, '\r')) != NULL)
-        {
-            size_t offset = (size_t)(p - dst);
-            if (offset + 3 < dst_size)
-            {
-                memcpy(p, "...", 3);
-                dst[offset + 3] = '\0';
-            }
-            else
-            {
-                dst[dst_size - 1] = '\0';
-            }
-        }
-    }
+    p = strchr(pfx->ShortExp, '\r');
+    if (p) (void) CopyMagickString(p, "...", 4);
+  }

-    return dst;
+  return pfx->ShortExp;
 }

 static char * SetShortExp (FxInfo * pfx)