Commit af7b85012 for imagemagick.org

commit af7b85012e62fa65393277790b96c56a98d882b6
Author: Cristy <urban-warrior@imagemagick.org>
Date:   Sat Sep 5 12:12:48 2026 -0400

    https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-8xmr-6q99-c4x8

diff --git a/MagickCore/blob.c b/MagickCore/blob.c
index 83641e0b6..87fc88771 100644
--- a/MagickCore/blob.c
+++ b/MagickCore/blob.c
@@ -1758,7 +1758,8 @@ MagickExport MagickBooleanType GetBlobError(const Image *image)
 %                                                                             %
 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
 %
-%  GetBlobFileHandle() returns the file handle associated with the image blob.
+%  GetBlobFileHandle() returns the stdio file handle associated with the image
+%  blob. If the blob is not backed by a FILE object, NULL is returned.
 %
 %  The format of the GetBlobFile method is:
 %
@@ -1773,7 +1774,23 @@ MagickExport FILE *GetBlobFileHandle(const Image *image)
 {
   assert(image != (const Image *) NULL);
   assert(image->signature == MagickCoreSignature);
-  return(image->blob->file_info.file);
+  assert(image->blob != (BlobInfo *) NULL);
+  assert(image->blob->signature == MagickCoreSignature);
+  switch (image->blob->type)
+  {
+    case StandardStream:
+    case FileStream:
+    case PipeStream:
+     return(image->blob->file_info.file);
+    case UndefinedStream:
+    case ZipStream:
+    case BZipStream:
+    case FifoStream:
+    case BlobStream:
+    case CustomStream:
+      break;
+  }
+  return((FILE *) NULL);
 }

 /*
diff --git a/coders/info.c b/coders/info.c
index b0059d4df..87b2d8abf 100644
--- a/coders/info.c
+++ b/coders/info.c
@@ -160,6 +160,12 @@ static MagickBooleanType WriteINFOImage(const ImageInfo *image_info,
   const char
     *format;

+  FILE
+    *file;
+
+  ImageInfo
+    *clone_info;
+
   MagickBooleanType
     status;

@@ -183,6 +189,15 @@ static MagickBooleanType WriteINFOImage(const ImageInfo *image_info,
     return(status);
   scene=0;
   number_scenes=GetImageListLength(image);
+  file=GetBlobFileHandle(image);
+  if (file == (FILE *) NULL)
+    {
+      (void) CloseBlob(image);
+      (void) ThrowMagickException(exception,GetMagickModule(),CoderError,
+        "CoderDoesNotSupportThisStreamType","`%s'",image->filename);
+      return(MagickFalse);
+    }
+  clone_info=CloneImageInfo(image_info);
   do
   {
     format=GetImageOption(image_info,"format");
@@ -192,15 +207,14 @@ static MagickBooleanType WriteINFOImage(const ImageInfo *image_info,
           MagickPathExtent);
         image->magick_columns=image->columns;
         image->magick_rows=image->rows;
-        (void) IdentifyImage(image,GetBlobFileHandle(image),
-          image_info->verbose,exception);
+        (void) IdentifyImage(image,file,image_info->verbose,exception);
       }
     else
       {
         char
           *text;

-        text=InterpretImageProperties((ImageInfo *) image_info,image,format,
+        text=InterpretImageProperties(clone_info,image,format,
           exception);
         if (text != (char *) NULL)
           {
@@ -215,6 +229,7 @@ static MagickBooleanType WriteINFOImage(const ImageInfo *image_info,
     if (status == MagickFalse)
       break;
   } while (image_info->adjoin != MagickFalse);
+  clone_info=DestroyImageInfo(clone_info);
   if (CloseBlob(image) == MagickFalse)
     status=MagickFalse;
   return(status);
diff --git a/coders/json.c b/coders/json.c
index cca034c50..3751113d5 100644
--- a/coders/json.c
+++ b/coders/json.c
@@ -1751,7 +1751,12 @@ static MagickBooleanType WriteJSONImage(const ImageInfo *image_info,
     return(status);
   file=GetBlobFileHandle(image);
   if (file == (FILE *) NULL)
-    file=stdout;
+    {
+      (void) CloseBlob(image);
+      (void) ThrowMagickException(exception,GetMagickModule(),CoderError,
+        "CoderDoesNotSupportThisStreamType","`%s'",image->filename);
+      return(MagickFalse);
+    }
   scene=0;
   number_scenes=GetImageListLength(image);
   do
diff --git a/coders/yaml.c b/coders/yaml.c
index 2f1350cc5..ba071180c 100644
--- a/coders/yaml.c
+++ b/coders/yaml.c
@@ -644,9 +644,9 @@ static ssize_t PrintChannelMoments(FILE *file,const PixelChannel channel,
   n+=FormatLocaleFile(file,"        ellipseIntensity: %.*g\n",
     GetMagickPrecision(),channel_moments[channel].ellipse_intensity);
   for (i=0; i < 7; i++)
-    n+=FormatLocaleFile(file,"        I%.17g: %.*g\n",i+1.0,
+    n+=FormatLocaleFile(file,"        I%.17g: %.*g\n",(double) i+1.0,
       GetMagickPrecision(),channel_moments[channel].invariant[i]);
-  n+=FormatLocaleFile(file,"        I%.17g: %.*g\n",i+1.0,
+  n+=FormatLocaleFile(file,"        I%.17g: %.*g\n",(double) i+1.0,
     GetMagickPrecision(),channel_moments[channel].invariant[i]);
   (void) FormatLocaleFile(file,"      ");
   if (separator != MagickFalse)
@@ -1718,7 +1718,12 @@ static MagickBooleanType WriteYAMLImage(const ImageInfo *image_info,
     return(status);
   file=GetBlobFileHandle(image);
   if (file == (FILE *) NULL)
-    file=stdout;
+    {
+      (void) CloseBlob(image);
+      (void) ThrowMagickException(exception,GetMagickModule(),CoderError,
+        "CoderDoesNotSupportThisStreamType","`%s'",image->filename);
+      return(MagickFalse);
+    }
   scene=0;
   number_scenes=GetImageListLength(image);
   do
diff --git a/config/english.xml b/config/english.xml
index 5f28c6704..3f8765cc9 100644
--- a/config/english.xml
+++ b/config/english.xml
@@ -83,6 +83,9 @@
     </cache>
     <coder>
       <error>
+        <message name="CoderDoesNotSupportThisStreamType">
+          coder does not support this stream tyype
+        </message>
         <message name="ColormapTypeNotSupported">
           colormap type not supported
         </message>
diff --git a/config/francais.xml b/config/francais.xml
index f1cf8b413..4f7a65209 100644
--- a/config/francais.xml
+++ b/config/francais.xml
@@ -83,6 +83,9 @@
     </cache>
     <coder>
       <error>
+        <message name="CoderDoesNotSupportThisStreamType">
+          coder does not support this stream tyype
+        </message>
         <message name="ColormapTypeNotSupported">
           table de couleurs non supportée
         </message>