Commit 78378cd62 for imagemagick.org

commit 78378cd623468760bee82a5930cb3011725916f8
Author: Dirk Lemstra <dirk@lemstra.org>
Date:   Thu Aug 27 22:16:47 2026 +0200

    Escape the labels to prevent code injection (GHSA-5rg6-j44q-q892)

diff --git a/coders/ps.c b/coders/ps.c
index 94befbc4e..02a90746c 100644
--- a/coders/ps.c
+++ b/coders/ps.c
@@ -1854,8 +1854,12 @@ static MagickBooleanType WritePSImage(const ImageInfo *image_info,Image *image,
       {
         for (i=0; labels[i] != (char *) NULL; i++)
         {
-          (void) FormatLocaleString(buffer,MagickPathExtent,"%s \n",
-            labels[i]);
+          char
+            *escape;
+
+          escape=EscapeParenthesis(labels[i]);
+          (void) FormatLocaleString(buffer,MagickPathExtent,"%s \n",escape);
+          escape=DestroyString(escape);
           (void) WriteBlobString(image,buffer);
           labels[i]=DestroyString(labels[i]);
         }
diff --git a/coders/ps2.c b/coders/ps2.c
index 984fd528d..2d03d72d8 100644
--- a/coders/ps2.c
+++ b/coders/ps2.c
@@ -72,6 +72,7 @@
 #include "MagickCore/timer-private.h"
 #include "MagickCore/utility.h"
 #include "coders/coders-private.h"
+#include "coders/ghostscript-private.h"

 /*
   Define declarations.
@@ -789,8 +790,12 @@ static MagickBooleanType WritePS2Image(const ImageInfo *image_info,Image *image,
       {
         for (i=0; labels[i] != (char *) NULL; i++)
         {
-          (void) FormatLocaleString(buffer,MagickPathExtent,"%s \n",
-            labels[i]);
+          char
+            *escape;
+
+          escape=EscapeParenthesis(labels[i]);
+          (void) FormatLocaleString(buffer,MagickPathExtent,"%s \n",escape);
+          escape=DestroyString(escape);
           (void) WriteBlobString(image,buffer);
           labels[i]=DestroyString(labels[i]);
         }
diff --git a/coders/ps3.c b/coders/ps3.c
index ad1aa0173..acc814f6e 100644
--- a/coders/ps3.c
+++ b/coders/ps3.c
@@ -76,6 +76,7 @@
 #include "MagickCore/token.h"
 #include "MagickCore/utility.h"
 #include "coders/coders-private.h"
+#include "coders/ghostscript-private.h"

 /*
   Define declarations.
@@ -1292,20 +1293,25 @@ static MagickBooleanType WritePS3Image(const ImageInfo *image_info,Image *image,
       {
         for (i=0; labels[i] != (char *) NULL; i++)
         {
+          char
+            *escape;
+
+          escape=EscapeParenthesis(labels[i]);
           if (compression != NoCompression)
             {
-              for (j=0; labels[i][j] != '\0'; j++)
-                (void) WriteBlobByte(image,(unsigned char) labels[i][j]);
+              for (j=0; escape[j] != '\0'; j++)
+                (void) WriteBlobByte(image,(unsigned char) escape[j]);
               (void) WriteBlobByte(image,'\n');
             }
           else
             {
               (void) WriteBlobString(image,"<~");
               Ascii85Initialize(image);
-              for (j=0; labels[i][j] != '\0'; j++)
-                Ascii85Encode(image,(unsigned char) labels[i][j]);
+              for (j=0; escape[j] != '\0'; j++)
+                Ascii85Encode(image,(unsigned char) escape[j]);
               Ascii85Flush(image);
             }
+          escape=DestroyString(escape);
           labels[i]=DestroyString(labels[i]);
         }
         labels=(char **) RelinquishMagickMemory(labels);