Commit b2740b95f for imagemagick.org

commit b2740b95f3682c0d4cf19f32755ecd070ff7250b
Author: Dirk Lemstra <dirk@lemstra.org>
Date:   Tue Jun 30 21:51:57 2026 +0200

    Added method that can be used to check if incrementing a value would result in an overflow.

diff --git a/MagickCore/memory_.h b/MagickCore/memory_.h
index 24ebf6ffa..d9a593fc7 100644
--- a/MagickCore/memory_.h
+++ b/MagickCore/memory_.h
@@ -107,6 +107,17 @@ static inline MagickBooleanType HeapOverflowSanityCheckGetSize(
   return(MagickFalse);
 }

+static inline MagickBooleanType HeapOverflowSanityCheckAddition(
+  const size_t size,const size_t increment)
+{
+  if (size > (MAGICK_SIZE_MAX-increment))
+    {
+      errno=ENOMEM;
+      return(MagickTrue);
+    }
+  return(MagickFalse);
+}
+
 #if defined(__cplusplus) || defined(c_plusplus)
 }
 #endif
diff --git a/coders/ept.c b/coders/ept.c
index bfdb9496d..fb7e63b20 100644
--- a/coders/ept.c
+++ b/coders/ept.c
@@ -201,12 +201,16 @@ static Image *ReadEPTImage(const ImageInfo *image_info,ExceptionInfo *exception)
     ThrowReaderException(CorruptImageError,"ImproperImageHeader");
   ept_info.postscript_offset=(MagickOffsetType) ReadBlobLSBLong(image);
   ept_info.postscript_length=ReadBlobLSBLong(image);
+  if (HeapOverflowSanityCheckAddition(ept_info.postscript_length,1) != MagickFalse)
+    ThrowReaderException(ResourceLimitError,"MemoryAllocationFailed");
   if ((MagickSizeType) ept_info.postscript_length > GetBlobSize(image))
     ThrowReaderException(CorruptImageError,"InsufficientImageDataInFile");
   (void) ReadBlobLSBLong(image);
   (void) ReadBlobLSBLong(image);
   ept_info.tiff_offset=(MagickOffsetType) ReadBlobLSBLong(image);
   ept_info.tiff_length=ReadBlobLSBLong(image);
+  if (HeapOverflowSanityCheckAddition(ept_info.tiff_length,1) != MagickFalse)
+    ThrowReaderException(ResourceLimitError,"MemoryAllocationFailed");
   if ((ept_info.postscript_length+ept_info.tiff_length) == 0)
     ThrowReaderException(CorruptImageError,"ImproperImageHeader");
   if ((MagickSizeType) ept_info.tiff_length > GetBlobSize(image))