Commit e047ee2c7 for imagemagick.org

commit e047ee2c7b937c1db92302fe3701e2e9c169de27
Author: Cristy <urban-warrior@imagemagick.org>
Date:   Sun Jun 14 06:56:07 2026 -0400

    https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-vghg-5jrg-2398

diff --git a/MagickCore/blob.c b/MagickCore/blob.c
index 6f58d519a..13c210229 100644
--- a/MagickCore/blob.c
+++ b/MagickCore/blob.c
@@ -83,10 +83,6 @@
 /*
   Define declarations.
 */
-#define IsPathAuthorized(rights,filename) \
-  ((IsRightsAuthorized(PathPolicyDomain,rights,filename) != MagickFalse) && \
-   ((IsRightsAuthorizedByName(SystemPolicyDomain,"symlink",rights,"follow") != MagickFalse) || \
-    (is_symlink_utf8(filename) == MagickFalse)))
 #define MagickMaxBlobExtent  (8*8192)
 #if !defined(MAP_ANONYMOUS) && defined(MAP_ANON)
 # define MAP_ANONYMOUS  MAP_ANON
diff --git a/MagickCore/policy-private.h b/MagickCore/policy-private.h
index 37916eb4c..ce5930689 100644
--- a/MagickCore/policy-private.h
+++ b/MagickCore/policy-private.h
@@ -22,6 +22,8 @@
 extern "C" {
 #endif

+#include "MagickCore/utility-private.h"
+
 #if MAGICKCORE_ZERO_CONFIGURATION_SUPPORT
 /*
   Zero configuration security policy.  Discussion @
@@ -41,6 +43,16 @@ extern MagickPrivate MagickBooleanType
 extern MagickPrivate void
   PolicyComponentTerminus(void);

+static inline MagickBooleanType IsPathAuthorized(const PolicyRights rights,
+  const char *filename)
+{
+  MagickBooleanType status =
+   ((IsRightsAuthorized(PathPolicyDomain,rights,filename) != MagickFalse) &&
+   ((IsRightsAuthorizedByName(SystemPolicyDomain,"symlink",rights,"follow") != MagickFalse) ||
+    (is_symlink_utf8(filename) == MagickFalse)));
+  return(status);
+}
+
 #if defined(__cplusplus) || defined(c_plusplus)
 }
 #endif
diff --git a/MagickWand/script-token.c b/MagickWand/script-token.c
index ba36e91b8..2d59e313f 100644
--- a/MagickWand/script-token.c
+++ b/MagickWand/script-token.c
@@ -175,6 +175,9 @@
 #  include "MagickWand/studio.h"
 #  include "MagickWand/MagickWand.h"
 #  include "MagickWand/script-token.h"
+#  include "MagickCore/exception-private.h"
+#  include "MagickCore/policy.h"
+#  include "MagickCore/policy-private.h"
 #  include "MagickCore/string-private.h"
 #  include "MagickCore/utility-private.h"
 #endif
@@ -207,9 +210,11 @@ WandExport ScriptTokenInfo *AcquireScriptTokenInfo(const char *filename)
   ScriptTokenInfo
     *token_info;

+  if (IsPathAuthorized(ReadPolicyRights,filename) == MagickFalse)
+    return((ScriptTokenInfo *) NULL);
   token_info=(ScriptTokenInfo *) AcquireMagickMemory(sizeof(*token_info));
   if (token_info == (ScriptTokenInfo *) NULL)
-    return token_info;
+    return(token_info);
   (void) memset(token_info,0,sizeof(*token_info));

   token_info->opened=MagickFalse;