Commit d954e9c48 for imagemagick.org

commit d954e9c48a7b2bdb76f0c9a3f8bc0e22071288e6
Author: Cristy <urban-warrior@imagemagick.org>
Date:   Thu May 14 18:48:58 2026 -0400

    https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-4g75-9r48-jf92

diff --git a/MagickCore/distribute-cache.c b/MagickCore/distribute-cache.c
index cfc07184c..43be88b4f 100644
--- a/MagickCore/distribute-cache.c
+++ b/MagickCore/distribute-cache.c
@@ -726,6 +726,7 @@ static MagickBooleanType WriteDistributeCacheMetacontent(
     count;

   MagickSizeType
+    extent,
     length;

   Quantum
@@ -761,6 +762,9 @@ static MagickBooleanType WriteDistributeCacheMetacontent(
   (void) memcpy(&region.y,p,sizeof(region.y));
   p+=(ptrdiff_t) sizeof(region.y);
   (void) memcpy(&length,p,sizeof(length));
+  extent=((MagickSizeType) region.width*region.height*sizeof(Quantum));
+  if (length > extent)
+    return(MagickFalse);
   p+=(ptrdiff_t) sizeof(length);
   q=GetAuthenticPixels(image,region.x,region.y,region.width,region.height,
     exception);
@@ -786,6 +790,7 @@ static MagickBooleanType WriteDistributeCachePixels(SplayTreeInfo *registry,
     count;

   MagickSizeType
+    extent,
     length;

   Quantum
@@ -819,6 +824,10 @@ static MagickBooleanType WriteDistributeCachePixels(SplayTreeInfo *registry,
   (void) memcpy(&region.y,p,sizeof(region.y));
   p+=(ptrdiff_t) sizeof(region.y);
   (void) memcpy(&length,p,sizeof(length));
+  extent=((MagickSizeType) region.width*region.height*image->number_channels*
+    sizeof(Quantum));
+  if (length > extent)
+    return(MagickFalse);
   p+=(ptrdiff_t) sizeof(length);
   q=GetAuthenticPixels(image,region.x,region.y,region.width,region.height,
     exception);