Commit 1d3e98913 for imagemagick.org

commit 1d3e98913f6a8fa34b5a4180eadb9ed195b918a8
Author: Cristy <urban-warrior@imagemagick.org>
Date:   Sat Aug 15 15:10:11 2026 -0400

    https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-5m9j-96ff-j6qc

diff --git a/PerlMagick/Magick.xs b/PerlMagick/Magick.xs
index 0cd89e492..44764e593 100644
--- a/PerlMagick/Magick.xs
+++ b/PerlMagick/Magick.xs
@@ -906,9 +906,11 @@ static Image *GetList(pTHX_ SV *reference,SV ***reference_vector,

       Image
         *head,
-        *previous;
+        *previous,
+        **seen = (Image **) NULL;

       ssize_t
+        count = 0,
         i,
         n;

@@ -931,17 +933,43 @@ static Image *GetList(pTHX_ SV *reference,SV ***reference_vector,
               exception);
             if (image == (Image *) NULL)
               continue;
-            if (image == previous)
+            {
+              MagickBooleanType duplicate = MagickFalse;
+              ssize_t j = 0;
+              for (j=0; j < count; j++)
               {
-                image=CloneImage(image,0,0,MagickTrue,exception);
-                if (image == (Image *) NULL)
-                  return(NULL);
+                if (seen[j] == image)
+                  {
+                    duplicate=MagickTrue;
+                    break;
+                  }
               }
+              if (duplicate != MagickFalse)
+                {
+                  /*
+                    Clone if already seen (adjacent or non-adjacent).
+                  */
+                  Image *clone = CloneImage(image,0,0,MagickTrue,exception);
+                  if (clone == (Image *) NULL)
+                    {
+                      if (seen != (Image **) NULL)
+                        free(seen);
+                      return(NULL);
+                    }
+                  image=clone;
+                }
+              seen=(Image **) realloc(seen,(count+1)*sizeof(Image *));
+              if (seen == (Image **) NULL)
+                return((Image *) NULL);
+              seen[count++]=image;
+            }
             image->previous=previous;
             *(previous ? &previous->next : &head)=image;
             for (previous=image; previous->next; previous=previous->next) ;
           }
       }
+      if (seen != (Image **) NULL)
+        free(seen);
       return(head);
     }
     case SVt_PVMG:
diff --git a/PerlMagick/quantum/quantum.xs.in b/PerlMagick/quantum/quantum.xs.in
index d874b9be2..f55d889ae 100644
--- a/PerlMagick/quantum/quantum.xs.in
+++ b/PerlMagick/quantum/quantum.xs.in
@@ -906,9 +906,11 @@ static Image *GetList(pTHX_ SV *reference,SV ***reference_vector,

       Image
         *head,
-        *previous;
+        *previous,
+        **seen = (Image **) NULL;

       ssize_t
+        count = 0,
         i,
         n;

@@ -931,17 +933,43 @@ static Image *GetList(pTHX_ SV *reference,SV ***reference_vector,
               exception);
             if (image == (Image *) NULL)
               continue;
-            if (image == previous)
+            {
+              MagickBooleanType duplicate = MagickFalse;
+              ssize_t j = 0;
+              for (j=0; j < count; j++)
               {
-                image=CloneImage(image,0,0,MagickTrue,exception);
-                if (image == (Image *) NULL)
-                  return(NULL);
+                if (seen[j] == image)
+                  {
+                    duplicate=MagickTrue;
+                    break;
+                  }
               }
+              if (duplicate != MagickFalse)
+                {
+                  /*
+                    Clone if already seen (adjacent or non-adjacent).
+                  */
+                  Image *clone = CloneImage(image,0,0,MagickTrue,exception);
+                  if (clone == (Image *) NULL)
+                    {
+                      if (seen != (Image **) NULL)
+                        free(seen);
+                      return(NULL);
+                    }
+                  image=clone;
+                }
+              seen=(Image **) realloc(seen,(count+1)*sizeof(Image *));
+              if (seen == (Image **) NULL)
+                return((Image *) NULL);
+              seen[count++]=image;
+            }
             image->previous=previous;
             *(previous ? &previous->next : &head)=image;
             for (previous=image; previous->next; previous=previous->next) ;
           }
       }
+      if (seen != (Image **) NULL)
+        free(seen);
       return(head);
     }
     case SVt_PVMG: