Commit b5da5eac0 for imagemagick.org
commit b5da5eac006bae77c587a7c238e346c90ea52acd
Author: Dirk Lemstra <dirk@lemstra.org>
Date: Tue Sep 1 20:53:38 2026 +0200
More fixes for GHSA-89wq-f8f6-2j2v
diff --git a/coders/cube.c b/coders/cube.c
index 8bd206d57..4e1e66b2a 100644
--- a/coders/cube.c
+++ b/coders/cube.c
@@ -317,8 +317,12 @@ static Image *ReadCUBEImage(const ImageInfo *image_info,
if (status == MagickFalse)
return(DestroyImageList(image));
if (image_info->scene != 0)
- for (i=0; i < (ssize_t) image_info->scene; i++)
- AppendImageToList(&image,CloneImage(image,0,0,MagickTrue,exception));
+ {
+ if (AcquireMagickResource(ListLengthResource,image_info->scene) == MagickFalse)
+ ThrowReaderException(ResourceLimitError,"ListLengthExceedsLimit");
+ for (i=0; i < (ssize_t) image_info->scene; i++)
+ AppendImageToList(&image,CloneImage(image,0,0,MagickTrue,exception));
+ }
return(GetFirstImageInList(image));
}
diff --git a/coders/hald.c b/coders/hald.c
index de238b577..c6bd9d11d 100644
--- a/coders/hald.c
+++ b/coders/hald.c
@@ -189,8 +189,12 @@ static Image *ReadHALDImage(const ImageInfo *image_info,
if (status == MagickFalse)
return(DestroyImageList(image));
if (image_info->scene != 0)
- for (i=0; i < (ssize_t) image_info->scene; i++)
- AppendImageToList(&image,CloneImage(image,0,0,MagickTrue,exception));
+ {
+ if (AcquireMagickResource(ListLengthResource,image_info->scene) == MagickFalse)
+ ThrowReaderException(ResourceLimitError,"ListLengthExceedsLimit");
+ for (i=0; i < (ssize_t) image_info->scene; i++)
+ AppendImageToList(&image,CloneImage(image,0,0,MagickTrue,exception));
+ }
return(GetFirstImageInList(image));
}