Commit 225ea9500 for imagemagick.org

commit 225ea9500ad2a84a9aa8f82f3ff3f642eb10ea6f
Author: Cristy <urban-warrior@imagemagick.org>
Date:   Sun Jul 5 09:20:24 2026 -0400

    check for insufficient image data

diff --git a/coders/sixel.c b/coders/sixel.c
index 1fba4d1bb..05efb7456 100644
--- a/coders/sixel.c
+++ b/coders/sixel.c
@@ -303,6 +303,12 @@ static MagickBooleanType sixel_decode(Image *image,unsigned char *p,
   memset(param,0,sizeof(param));
   imsx=2048;
   imsy=2048;
+  if ((imsx > GetBlobSize(image)) || (imsy > GetBlobSize(image)))
+    {
+      (void) ThrowMagickException(exception,GetMagickModule(),CorruptImageError,
+        "InsufficientImageDataInFile","`%s'",image->filename);
+      return(MagickFalse);
+    }
   if (SetImageExtent(image,(size_t) imsx,(size_t) imsy,exception) == MagickFalse)
     return(MagickFalse);
   imbuf=(sixel_pixel_t *) AcquireQuantumMemory((size_t) imsx,
@@ -410,6 +416,14 @@ static MagickBooleanType sixel_decode(Image *image,unsigned char *p,
           {
             dmsx=imsx > attributed_ph ? imsx : attributed_ph;
             dmsy=imsy > attributed_pv ? imsy : attributed_pv;
+            if ((dmsx > GetBlobSize(image)) || (dmsy > GetBlobSize(image)))
+              {
+                imbuf=(sixel_pixel_t *) RelinquishMagickMemory(imbuf);
+                (void) ThrowMagickException(exception,GetMagickModule(),
+                  CorruptImageError,"InsufficientImageDataInFile","`%s'",
+                  image->filename);
+                return(MagickFalse);
+              }
             if (SetImageExtent(image,(size_t) dmsx,(size_t) dmsy,exception) == MagickFalse)
               {
                 imbuf=(sixel_pixel_t *) RelinquishMagickMemory(imbuf);
@@ -534,6 +548,14 @@ static MagickBooleanType sixel_decode(Image *image,unsigned char *p,

             dmsx=nx;
             dmsy=ny;
+            if ((dmsx > GetBlobSize(image)) || (dmsy > GetBlobSize(image)))
+              {
+                imbuf=(sixel_pixel_t *) RelinquishMagickMemory(imbuf);
+                (void) ThrowMagickException(exception,GetMagickModule(),
+                  CorruptImageError,"InsufficientImageDataInFile","`%s'",
+                  image->filename);
+                return(MagickFalse);
+              }
             if (SetImageExtent(image,(size_t) dmsx,(size_t) dmsy,exception) == MagickFalse)
               {
                 imbuf=(sixel_pixel_t *) RelinquishMagickMemory(imbuf);
@@ -636,6 +658,14 @@ static MagickBooleanType sixel_decode(Image *image,unsigned char *p,
     {
       dmsx=max_x;
       dmsy=max_y;
+      if ((dmsx > GetBlobSize(image)) || (dmsy > GetBlobSize(image)))
+        {
+          imbuf=(sixel_pixel_t *) RelinquishMagickMemory(imbuf);
+          (void) ThrowMagickException(exception,GetMagickModule(),
+            CorruptImageError,"InsufficientImageDataInFile","`%s'",
+            image->filename);
+          return(MagickFalse);
+        }
       if (SetImageExtent(image,(size_t) dmsx,(size_t) dmsy,exception) == MagickFalse)
         {
           imbuf=(sixel_pixel_t *) RelinquishMagickMemory(imbuf);
@@ -1155,6 +1185,12 @@ static Image *ReadSIXELImage(const ImageInfo *image_info,
   /*
     Prepare image geometry.
   */
+  if ((width > GetBlobSize(image)) || (height > GetBlobSize(image)))
+    {
+      (void) ThrowMagickException(exception,GetMagickModule(),CorruptImageError,
+        "InsufficientImageDataInFile","`%s'",image->filename);
+      goto cleanup;
+    }
   if (SetImageExtent(image,width,height,exception) == MagickFalse)
     goto cleanup;
   /*