Commit e18959ada for imagemagick.org

commit e18959ada1ca92008b14aea4773a702f30d51fa6
Author: Cristy <urban-warrior@imagemagick.org>
Date:   Thu Sep 3 06:27:40 2026 -0400

    revert

diff --git a/MagickCore/cache.c b/MagickCore/cache.c
index 5fbe6881c..f878ed2bf 100644
--- a/MagickCore/cache.c
+++ b/MagickCore/cache.c
@@ -3799,8 +3799,8 @@ static MagickBooleanType OpenPixelCache(Image *image,const MapMode mode,
     ThrowBinaryException(CacheError,"NoPixelsDefinedInCache",image->filename);
   cache_info=(CacheInfo *) image->cache;
   assert(cache_info->signature == MagickCoreSignature);
-  if (((MagickSizeType) image->columns >= cache_info->width_limit) ||
-      ((MagickSizeType) image->rows >= cache_info->height_limit))
+  if (((MagickSizeType) image->columns > cache_info->width_limit) ||
+      ((MagickSizeType) image->rows > cache_info->height_limit))
     {
       (void) ThrowMagickException(exception,GetMagickModule(),ImageError,
         "WidthOrHeightExceedsLimit","`%s' (%.17gx%.17g) > (%.17gx%.17g)",
@@ -5243,8 +5243,8 @@ static Quantum *SetPixelCacheNexusPixels(
         "NoPixelsDefinedInCache","`%s'",cache_info->filename);
       return((Quantum *) NULL);
     }
-  if (((MagickSizeType) width >= cache_info->width_limit) ||
-      ((MagickSizeType) height >= cache_info->height_limit))
+  if (((MagickSizeType) width > cache_info->width_limit) ||
+      ((MagickSizeType) height > cache_info->height_limit))
     {
       (void) ThrowMagickException(exception,GetMagickModule(),ImageError,
         "WidthOrHeightExceedsLimit","`%s'",cache_info->filename);
@@ -5292,7 +5292,13 @@ static Quantum *SetPixelCacheNexusPixels(
   /*
     Pixels are stored in a staging region until they are synced to the cache.
   */
-  number_pixels=(MagickSizeType) width*height;
+  if (CacheOverflowSanityCheckGetSize(width,height,&number_pixels) != MagickFalse)
+    {
+      (void) ThrowMagickException(exception,GetMagickModule(),
+        ResourceLimitError,"MemoryAllocationFailed","`%s'",
+        cache_info->filename);
+      return((Quantum *) NULL);
+    }
   {
     MagickSizeType
       extent,