Commit a44ef50cc for imagemagick.org

commit a44ef50cc494253f7d9f0229bb25c064a8e2ae69
Author: Cristy <urban-warrior@imagemagick.org>
Date:   Fri Aug 14 14:25:12 2026 -0400

    https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-9x6f-98x9-rx6g

diff --git a/MagickCore/delegate.c b/MagickCore/delegate.c
index dba326362..0eefa3c47 100644
--- a/MagickCore/delegate.c
+++ b/MagickCore/delegate.c
@@ -1628,6 +1628,9 @@ static MagickBooleanType CopyDelegateFile(const char *source,
   const char *destination,const MagickBooleanType overwrite,
   ExceptionInfo *exception)
 {
+  char
+    filename[MagickPathExtent];
+
   int
     destination_file,
     source_file;
@@ -1660,11 +1663,14 @@ static MagickBooleanType CopyDelegateFile(const char *source,
       if (status != MagickFalse)
         return(MagickTrue);
     }
-  if (IsPathAuthorized(WritePolicyRights,destination) == MagickFalse)
-    ThrowPolicyException(destination,MagickFalse);
-  destination_file=open_utf8(destination,O_WRONLY | O_BINARY | O_CREAT,S_MODE);
+  destination_file=AcquireUniqueFileResource(filename);
   if (destination_file == -1)
     return(MagickFalse);
+  if (IsPathAuthorized(ReadPolicyRights,source) == MagickFalse)
+    {
+      (void) close_utf8(destination_file);
+      ThrowPolicyException(source,MagickFalse);
+    }
   source_file=open_utf8(source,O_RDONLY | O_BINARY,0);
   if (source_file == -1)
     {
@@ -1695,6 +1701,10 @@ static MagickBooleanType CopyDelegateFile(const char *source,
   (void) close_utf8(destination_file);
   (void) close_utf8(source_file);
   buffer=(unsigned char *) RelinquishMagickMemory(buffer);
+  if (IsPathAuthorized(WritePolicyRights,destination) == MagickFalse)
+    ThrowPolicyException(destination,MagickFalse);
+  if (rename_utf8(filename,destination) != 0)
+    return(MagickFalse);
   return(i != 0 ? MagickTrue : MagickFalse);
 }

@@ -1855,13 +1865,6 @@ MagickExport MagickBooleanType InvokeDelegate(ImageInfo *image_info,
   (void) CopyMagickString(input_filename,image->filename,MagickPathExtent);
   for (i=0; commands[i] != (char *) NULL; i++)
   {
-    if (IsPathAuthorized(WritePolicyRights,output_filename) == MagickFalse)
-      {
-        errno=EPERM;
-        (void) ThrowMagickException(exception,GetMagickModule(),PolicyError, \
-          "NotAuthorized","`%s'",output_filename);
-        break;
-      }
     (void) AcquireUniqueSymbolicLink(output_filename,image_info->filename);
     if (AcquireUniqueFilename(image_info->unique) == MagickFalse)
       {
@@ -1886,8 +1889,7 @@ MagickExport MagickBooleanType InvokeDelegate(ImageInfo *image_info,
         /*
           Execute delegate.
         */
-        if (ExternalDelegateCommand(delegate_info->spawn,image_info->verbose,
-          command,(char *) NULL,exception) != 0)
+        if (ExternalDelegateCommand(delegate_info->spawn,image_info->verbose,command,(char *) NULL,exception) != 0)
           status=MagickFalse;
         if (delegate_info->spawn != MagickFalse)
           {
@@ -1906,11 +1908,17 @@ MagickExport MagickBooleanType InvokeDelegate(ImageInfo *image_info,
     if (LocaleCompare(decode,"SCAN") != 0)
       {
         if (CopyDelegateFile(image->filename,input_filename,MagickFalse,exception) == MagickFalse)
-          (void) RelinquishUniqueFileResource(input_filename);
+          {
+            (void) RelinquishUniqueFileResource(input_filename);
+            status=MagickFalse;
+          }
       }
     if ((strcmp(input_filename,output_filename) != 0) &&
         (CopyDelegateFile(image_info->filename,output_filename,MagickTrue,exception) == MagickFalse))
-      (void) RelinquishUniqueFileResource(output_filename);
+      {
+        (void) RelinquishUniqueFileResource(output_filename);
+        status=MagickFalse;
+      }
     if (image_info->temporary != MagickFalse)
       (void) RelinquishUniqueFileResource(image_info->filename);
     (void) RelinquishUniqueFileResource(image_info->unique);
diff --git a/MagickCore/policy.c b/MagickCore/policy.c
index 3331ddb12..0428da326 100644
--- a/MagickCore/policy.c
+++ b/MagickCore/policy.c
@@ -687,9 +687,9 @@ MagickExport MagickBooleanType IsPathAuthorized(const PolicyRights rights,
   MagickBooleanType symlink_follow_allowed = IsRightsAuthorizedByName(
     SystemPolicyDomain,"symlink",rights,"follow");
   MagickBooleanType status =
-   ((IsRightsAuthorized(PathPolicyDomain,rights,path) != MagickFalse) &&
-   ((symlink_follow_allowed != MagickFalse) ||
-    (is_symlink_utf8(path) == MagickFalse))) ? MagickTrue : MagickFalse;
+    ((IsRightsAuthorized(PathPolicyDomain,rights,path) != MagickFalse) &&
+    ((symlink_follow_allowed != MagickFalse) ||
+     (is_symlink_utf8(path) == MagickFalse))) ? MagickTrue : MagickFalse;
   if ((status != MagickFalse) && (symlink_follow_allowed == MagickFalse))
     {
       if ((is_symlink_utf8(path) != MagickFalse) ||