Commit 768bdd0db for imagemagick.org

commit 768bdd0dbb9a9ad743b6a6e557126b788b325970
Author: Cristy <urban-warrior@imagemagick.org>
Date:   Mon Aug 24 11:42:39 2026 -0400

    https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-r868-pmwh-fv2c

diff --git a/coders/cut.c b/coders/cut.c
index 5d1bd8678..a558b387d 100644
--- a/coders/cut.c
+++ b/coders/cut.c
@@ -382,24 +382,24 @@ static Image *ReadCUTImage(const ImageInfo *image_info,ExceptionInfo *exception)
   while((int) RunCountMasked!=0)  /*end of line?*/
     {
       i=1;
-      if((int) RunCount<0x80) i=(ssize_t) RunCountMasked;
+      if ((int) RunCount<0x80) i=(ssize_t) RunCountMasked;
       offset=SeekBlob(image,TellBlob(image)+i,SEEK_SET);
       if (offset < 0)
         ThrowCUTReaderException(CorruptImageError,"ImproperImageHeader");
-      if(EOFBlob(image) != MagickFalse) goto CUT_KO;  /*wrong data*/
+      if (EOFBlob(image) != MagickFalse) goto CUT_KO;  /*wrong data*/
       EncodedByte-=(size_t)(i+1);
       ldblk+=(ssize_t) RunCountMasked;

       RunCount=(unsigned char) ReadBlobByte(image);
-      if(EOFBlob(image) != MagickFalse)  goto CUT_KO;  /*wrong data: unexpected eof in line*/
+      if (EOFBlob(image) != MagickFalse)  goto CUT_KO;  /*wrong data: unexpected eof in line*/
       RunCountMasked=RunCount & 0x7F;
     }
-  if(EncodedByte!=1) goto CUT_KO;  /*wrong data: size incorrect*/
+  if (EncodedByte!=1) goto CUT_KO;  /*wrong data: size incorrect*/
   i=0;        /*guess a number of bit planes*/
-  if(ldblk==(int) Header.Width)   i=8;
-  if(2*ldblk==(int) Header.Width) i=4;
-  if(8*ldblk==(int) Header.Width) i=1;
-  if(i==0) goto CUT_KO;    /*wrong data: incorrect bit planes*/
+  if (ldblk==(int) Header.Width)   i=8;
+  if (2*ldblk==(int) Header.Width) i=4;
+  if (8*ldblk==(int) Header.Width) i=1;
+  if (i==0) goto CUT_KO;    /*wrong data: incorrect bit planes*/
   depth=i;

   image->columns=Header.Width;
@@ -420,11 +420,11 @@ static Image *ReadCUTImage(const ImageInfo *image_info,ExceptionInfo *exception)
   j=i;
   while(--i>0)
     {
-      if(clone_info->filename[i]=='.')
+      if (clone_info->filename[i]=='.')
         {
           break;
         }
-      if(clone_info->filename[i]=='/' || clone_info->filename[i]=='\\' ||
+      if (clone_info->filename[i]=='/' || clone_info->filename[i]=='\\' ||
          clone_info->filename[i]==':' )
         {
           i=j;
@@ -432,25 +432,25 @@ static Image *ReadCUTImage(const ImageInfo *image_info,ExceptionInfo *exception)
         }
     }

+  (void) CopyMagickString(clone_info->filename+i,".PAL",(size_t)
+    (MagickPathExtent-i));
   authorized=IsPathAuthorized(ReadPolicyRights,clone_info->filename);
   if (authorized == MagickFalse)
     ThrowCUTReaderException(PolicyError,"NotAuthorized");
-  (void) CopyMagickString(clone_info->filename+i,".PAL",(size_t)
-    (MagickPathExtent-i));
-  if((clone_info->file=fopen_utf8(clone_info->filename,"rb"))==NULL)
+  if ((clone_info->file=fopen_utf8(clone_info->filename,"rb")) == NULL)
     {
       (void) CopyMagickString(clone_info->filename+i,".pal",(size_t)
         (MagickPathExtent-i));
-      if((clone_info->file=fopen_utf8(clone_info->filename,"rb"))==NULL)
+      authorized=IsPathAuthorized(ReadPolicyRights,clone_info->filename);
+      if (authorized == MagickFalse)
+        ThrowCUTReaderException(PolicyError,"NotAuthorized");
+      if ((clone_info->file=fopen_utf8(clone_info->filename,"rb")) == NULL)
         {
-          authorized=IsPathAuthorized(ReadPolicyRights,clone_info->filename);
-          if (authorized == MagickFalse)
-            ThrowCUTReaderException(PolicyError,"NotAuthorized");
           clone_info->filename[i]='\0';
           authorized=IsPathAuthorized(ReadPolicyRights,clone_info->filename);
           if (authorized == MagickFalse)
             ThrowCUTReaderException(PolicyError,"NotAuthorized");
-          if ((clone_info->file=fopen_utf8(clone_info->filename,"rb"))==NULL)
+          if ((clone_info->file=fopen_utf8(clone_info->filename,"rb")) == NULL)
             {
               clone_info=DestroyImageInfo(clone_info);
               clone_info=NULL;
@@ -459,7 +459,7 @@ static Image *ReadCUTImage(const ImageInfo *image_info,ExceptionInfo *exception)
         }
     }

-  if( (palette=AcquireImage(clone_info,exception))==NULL ) goto NoPalette;
+  if ( (palette=AcquireImage(clone_info,exception)) == NULL ) goto NoPalette;
   status=OpenBlob(clone_info,palette,ReadBinaryBlobMode,exception);
   if (status == MagickFalse)
     {
@@ -470,10 +470,10 @@ static Image *ReadCUTImage(const ImageInfo *image_info,ExceptionInfo *exception)
     }


-  if(palette!=NULL)
+  if (palette!=NULL)
     {
       (void) ReadBlob(palette,2,(unsigned char *) PalHeader.FileId);
-      if(strncmp(PalHeader.FileId,"AH",2) != 0) goto ErasePalette;
+      if (strncmp(PalHeader.FileId,"AH",2) != 0) goto ErasePalette;
       PalHeader.Version=ReadBlobLSBShort(palette);
       PalHeader.Size=ReadBlobLSBShort(palette);
       PalHeader.FileType=(char) ReadBlobByte(palette);
@@ -488,18 +488,18 @@ static Image *ReadCUTImage(const ImageInfo *image_info,ExceptionInfo *exception)
       if (EOFBlob(image))
         ThrowCUTReaderException(CorruptImageError,"UnexpectedEndOfFile");

-      if(PalHeader.MaxIndex<1) goto ErasePalette;
+      if (PalHeader.MaxIndex<1) goto ErasePalette;
       image->colors=PalHeader.MaxIndex+1;
       if (AcquireImageColormap(image,image->colors,exception) == MagickFalse) goto NoMemory;

-      if(PalHeader.MaxRed==0) PalHeader.MaxRed=(unsigned int) QuantumRange;  /*avoid division by 0*/
-      if(PalHeader.MaxGreen==0) PalHeader.MaxGreen=(unsigned int) QuantumRange;
-      if(PalHeader.MaxBlue==0) PalHeader.MaxBlue=(unsigned int) QuantumRange;
+      if (PalHeader.MaxRed==0) PalHeader.MaxRed=(unsigned int) QuantumRange;  /*avoid division by 0*/
+      if (PalHeader.MaxGreen==0) PalHeader.MaxGreen=(unsigned int) QuantumRange;
+      if (PalHeader.MaxBlue==0) PalHeader.MaxBlue=(unsigned int) QuantumRange;

       for(i=0;i<=(int) PalHeader.MaxIndex;i++)
         {      /*this may be wrong- I don't know why is palette such strange*/
           j=(ssize_t) TellBlob(palette);
-          if((j % 512)>512-6)
+          if ((j % 512)>512-6)
             {
               j=((j / 512)+1)*512;
               offset=SeekBlob(palette,j,SEEK_SET);
@@ -536,7 +536,7 @@ static Image *ReadCUTImage(const ImageInfo *image_info,ExceptionInfo *exception)


  NoPalette:
-  if(palette==NULL)
+  if (palette == NULL)
     {

       image->colors=256;
@@ -558,7 +558,7 @@ static Image *ReadCUTImage(const ImageInfo *image_info,ExceptionInfo *exception)
   /* ----- Load RLE compressed raster ----- */
   BImgBuff=(unsigned char *) AcquireQuantumMemory((size_t) ldblk,
     sizeof(*BImgBuff));  /*Ldblk was set in the check phase*/
-  if(BImgBuff==NULL) goto NoMemory;
+  if (BImgBuff == NULL) goto NoMemory;
   (void) memset(BImgBuff,0,(size_t) ldblk*sizeof(*BImgBuff));

   offset=SeekBlob(image,6 /*sizeof(Header)*/,SEEK_SET);
@@ -583,16 +583,16 @@ static Image *ReadCUTImage(const ImageInfo *image_info,ExceptionInfo *exception)

       while ((int) RunCountMasked != 0)
       {
-          if((ssize_t) RunCountMasked>j)
+          if ((ssize_t) RunCountMasked>j)
             {    /*Wrong Data*/
               RunCountMasked=(unsigned char) j;
-              if(j==0)
+              if (j==0)
                 {
                   break;
                 }
             }

-          if((int) RunCount>0x80)
+          if ((int) RunCount>0x80)
             {
               RunValue=(unsigned char) ReadBlobByte(image);
               (void) memset(ptrB,(int) RunValue,(size_t) RunCountMasked);