Commit 75bcc76ea for imagemagick.org

commit 75bcc76eac8b26ce0d6900117c9b308b0aed5719
Author: Cristy <urban-warrior@imagemagick.org>
Date:   Thu May 14 19:01:44 2026 -0400

    https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-p93h-f2jc-477j

diff --git a/MagickCore/distribute-cache.c b/MagickCore/distribute-cache.c
index cfc07184c..43be88b4f 100644
--- a/MagickCore/distribute-cache.c
+++ b/MagickCore/distribute-cache.c
@@ -726,6 +726,7 @@ static MagickBooleanType WriteDistributeCacheMetacontent(
     count;

   MagickSizeType
+    extent,
     length;

   Quantum
@@ -761,6 +762,9 @@ static MagickBooleanType WriteDistributeCacheMetacontent(
   (void) memcpy(&region.y,p,sizeof(region.y));
   p+=(ptrdiff_t) sizeof(region.y);
   (void) memcpy(&length,p,sizeof(length));
+  extent=((MagickSizeType) region.width*region.height*sizeof(Quantum));
+  if (length > extent)
+    return(MagickFalse);
   p+=(ptrdiff_t) sizeof(length);
   q=GetAuthenticPixels(image,region.x,region.y,region.width,region.height,
     exception);
@@ -786,6 +790,7 @@ static MagickBooleanType WriteDistributeCachePixels(SplayTreeInfo *registry,
     count;

   MagickSizeType
+    extent,
     length;

   Quantum
@@ -819,6 +824,10 @@ static MagickBooleanType WriteDistributeCachePixels(SplayTreeInfo *registry,
   (void) memcpy(&region.y,p,sizeof(region.y));
   p+=(ptrdiff_t) sizeof(region.y);
   (void) memcpy(&length,p,sizeof(length));
+  extent=((MagickSizeType) region.width*region.height*image->number_channels*
+    sizeof(Quantum));
+  if (length > extent)
+    return(MagickFalse);
   p+=(ptrdiff_t) sizeof(length);
   q=GetAuthenticPixels(image,region.x,region.y,region.width,region.height,
     exception);