Commit 1d9a9469e for imagemagick.org

commit 1d9a9469ef8acb0b5c0dfb90a834005cd5a75283
Author: Javid Khan <dxbjavid@gmail.com>
Date:   Sun Jun 21 18:41:08 2026 +0530

    check rows*columns overflow in sct ReadSCTImage (#8812)

diff --git a/coders/sct.c b/coders/sct.c
index a3f9380ea..95dab93af 100644
--- a/coders/sct.c
+++ b/coders/sct.c
@@ -145,6 +145,7 @@ static Image *ReadSCTImage(const ImageInfo *image_info,ExceptionInfo *exception)
     *q;

   size_t
+    number_pixels,
     separations,
     separations_mask,
     units;
@@ -230,16 +231,19 @@ static Image *ReadSCTImage(const ImageInfo *image_info,ExceptionInfo *exception)
       (void) CloseBlob(image);
       return(GetFirstImageInList(image));
     }
-  status=SetImageExtent(image,image->columns,image->rows,exception);
-  if (status == MagickFalse)
-    return(DestroyImageList(image));
-  extent=(MagickSizeType) image->rows*image->columns*separations;
+  if (HeapOverflowSanityCheckGetSize(image->columns,image->rows,
+      &number_pixels) != MagickFalse)
+    ThrowReaderException(ResourceLimitError,"MemoryAllocationFailed");
+  extent=(MagickSizeType) number_pixels*separations;
   if (extent > GetBlobSize(image))
     {
       ThrowFileException(exception,CorruptImageError,"UnexpectedEndOfFile",
         image->filename);
       return(DestroyImageList(image));
     }
+  status=SetImageExtent(image,image->columns,image->rows,exception);
+  if (status == MagickFalse)
+    return(DestroyImageList(image));
   /*
     Convert SCT raster image to pixel packets.
   */