Commit dab73a389 for imagemagick.org

commit dab73a389810283dfe180046458a2794f2bcd87b
Author: Cristy <urban-warrior@imagemagick.org>
Date:   Sat May 9 18:57:27 2026 -0400

    https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-hg5x-pmmv-4q7g

diff --git a/coders/sun.c b/coders/sun.c
index 0a28256e9..dd518ed1f 100644
--- a/coders/sun.c
+++ b/coders/sun.c
@@ -841,7 +841,8 @@ static MagickBooleanType WriteSUNImage(const ImageInfo *image_info,Image *image,
     sun_info.maptype=RMT_NONE;
     sun_info.maplength=0;
     number_pixels=(MagickSizeType) image->columns*image->rows;
-    if ((4*number_pixels) != (size_t) (4*number_pixels))
+    if ((HeapOverflowSanityCheck(image->columns,image->rows) != MagickFalse) ||
+        (number_pixels > (MAGICK_SSIZE_MAX/4)))
       ThrowWriterException(ResourceLimitError,"MemoryAllocationFailed");
     if (image->storage_class == DirectClass)
       {
diff --git a/coders/viff.c b/coders/viff.c
index 67a12a394..f0df5d275 100644
--- a/coders/viff.c
+++ b/coders/viff.c
@@ -322,10 +322,10 @@ static Image *ReadVIFFImage(const ImageInfo *image_info,
     if (EOFBlob(image) != MagickFalse)
       ThrowReaderException(CorruptImageError,"UnexpectedEndOfFile");
     number_pixels=(MagickSizeType) viff_info.columns*viff_info.rows;
+    if (HeapOverflowSanityCheck(viff_info.columns,viff_info.rows) != MagickFalse)
+        ThrowReaderException(ResourceLimitError,"MemoryAllocationFailed");
     if (number_pixels > 8*GetBlobSize(image))
       ThrowReaderException(CorruptImageError,"InsufficientImageDataInFile");
-    if (number_pixels != (size_t) number_pixels)
-      ThrowReaderException(ResourceLimitError,"MemoryAllocationFailed");
     if (number_pixels == 0)
       ThrowReaderException(CoderError,"ImageColumnOrRowSizeIsNotSupported");
     image->columns=viff_info.rows;