Commit b5da5eac0 for imagemagick.org

commit b5da5eac006bae77c587a7c238e346c90ea52acd
Author: Dirk Lemstra <dirk@lemstra.org>
Date:   Tue Sep 1 20:53:38 2026 +0200

    More fixes for GHSA-89wq-f8f6-2j2v

diff --git a/coders/cube.c b/coders/cube.c
index 8bd206d57..4e1e66b2a 100644
--- a/coders/cube.c
+++ b/coders/cube.c
@@ -317,8 +317,12 @@ static Image *ReadCUBEImage(const ImageInfo *image_info,
   if (status == MagickFalse)
     return(DestroyImageList(image));
   if (image_info->scene != 0)
-    for (i=0; i < (ssize_t) image_info->scene; i++)
-      AppendImageToList(&image,CloneImage(image,0,0,MagickTrue,exception));
+    {
+      if (AcquireMagickResource(ListLengthResource,image_info->scene) == MagickFalse)
+        ThrowReaderException(ResourceLimitError,"ListLengthExceedsLimit");
+      for (i=0; i < (ssize_t) image_info->scene; i++)
+        AppendImageToList(&image,CloneImage(image,0,0,MagickTrue,exception));
+    }
   return(GetFirstImageInList(image));
 }

diff --git a/coders/hald.c b/coders/hald.c
index de238b577..c6bd9d11d 100644
--- a/coders/hald.c
+++ b/coders/hald.c
@@ -189,8 +189,12 @@ static Image *ReadHALDImage(const ImageInfo *image_info,
   if (status == MagickFalse)
     return(DestroyImageList(image));
   if (image_info->scene != 0)
-    for (i=0; i < (ssize_t) image_info->scene; i++)
-      AppendImageToList(&image,CloneImage(image,0,0,MagickTrue,exception));
+    {
+      if (AcquireMagickResource(ListLengthResource,image_info->scene) == MagickFalse)
+        ThrowReaderException(ResourceLimitError,"ListLengthExceedsLimit");
+      for (i=0; i < (ssize_t) image_info->scene; i++)
+        AppendImageToList(&image,CloneImage(image,0,0,MagickTrue,exception));
+    }
   return(GetFirstImageInList(image));
 }