Commit fb743d607 for imagemagick.org

commit fb743d60700c9bc350c3d2a0b48b998bdabc466c
Author: Cristy <urban-warrior@imagemagick.org>
Date:   Sat Sep 5 13:32:55 2026 -0400

    https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-v2x3-wpmg-c4w6

diff --git a/MagickCore/fx.c b/MagickCore/fx.c
index 3461d1f31..16b52f7ff 100644
--- a/MagickCore/fx.c
+++ b/MagickCore/fx.c
@@ -1071,23 +1071,43 @@ static MagickBooleanType AllocFxRt (FxInfo * pfx, fxRtT * pfxrt)
   return MagickTrue;
 }

-static MagickBooleanType ExtendRPN (FxInfo * pfx)
+static MagickBooleanType ExtendRPN(FxInfo * pfx)
 {
-  pfx->numElements = (int) ceil (pfx->numElements * (1 + TableExtend));
-  pfx->Elements = (ElementT*) ResizeMagickMemory (pfx->Elements, (size_t) pfx->numElements * sizeof(ElementT));
-  if (!pfx->Elements) {
-    (void) ThrowMagickException (
-      pfx->exception, GetMagickModule(), ResourceLimitFatalError,
-      "Elements", "%i",
-      pfx->numElements);
-    return MagickFalse;
-  }
-  return MagickTrue;
+  ElementT
+    *new_elements;
+
+  size_t
+    element_count;
+
+  /*
+    Keep the original table and size intact unless growth succeeds.
+  */
+  element_count=(size_t) ceil(pfx->numElements*(1+TableExtend));
+  new_elements=(ElementT *) AcquireQuantumMemory((size_t) element_count,
+    sizeof(*new_elements));
+  if (new_elements == (ElementT *) NULL)
+    {
+      (void) ThrowMagickException(pfx->exception,GetMagickModule(),
+        ResourceLimitError,"MemoryAllocationFailed","`%s'","RPN table");
+      return(MagickFalse);
+    }
+  (void) memcpy(new_elements,pfx->Elements,(size_t) pfx->usedElements*
+    sizeof(*new_elements));
+   pfx->Elements=(ElementT *) RelinquishMagickMemory(pfx->Elements);
+   pfx->Elements=new_elements;
+   pfx->numElements=element_count;
+   if (!pfx->Elements)
+     {
+       (void) ThrowMagickException(pfx->exception,GetMagickModule(),
+         ResourceLimitFatalError,"Elements","%i",pfx->numElements);
+       return(MagickFalse);
+     }
+  return(MagickTrue);
 }

-static inline MagickBooleanType OprInPlace (int op)
+static inline MagickBooleanType OprInPlace(int op)
 {
-  return (op >= oAddEq && op <= oSubSub ? MagickTrue : MagickFalse);
+  return(op >= oAddEq && op <= oSubSub ? MagickTrue : MagickFalse);
 }

 static const char * OprStr (int oprNum)
@@ -1264,16 +1284,25 @@ static MagickBooleanType TokenMaybeUserSymbol (FxInfo * pfx)
   return MagickTrue;
 }

-static MagickBooleanType AddElement (FxInfo * pfx, fxFltType val, int oprNum)
+static MagickBooleanType AddElement(FxInfo * pfx,fxFltType val,int oprNum)
 {
   ElementT * pel;

   assert (oprNum <= rNull);

-  if (++pfx->usedElements >= pfx->numElements) {
-    if (!ExtendRPN (pfx)) return MagickFalse;
-  }
-
+  if (++pfx->usedElements >= pfx->numElements)
+    {
+      if (ExtendRPN(pfx) == MagickFalse)
+        {
+          pfx->usedElements--;
+          return(MagickFalse);
+        }
+    }
+  if (pfx->Elements == (ElementT *) NULL)
+    {
+      pfx->usedElements--;
+      return(MagickFalse);
+    }
   pel = &pfx->Elements[pfx->usedElements-1];
   pel->type = TypeOfOpr (oprNum);
   pel->val = val;