new file mode 100644
@@ -0,0 +1,49 @@
+From 11f9e946dab3f2a4de68809bab9c01be2967bb08 Mon Sep 17 00:00:00 2001
+From: Divyanshu Rathore <Divyanshu.Rathore@bmwtechworks.in>
+Date: Tue, 11 Nov 2025 14:34:12 +0530
+Subject: [PATCH 1/6] ImageMagick: Add support patch 1 to fix CVE-2025-55298
+
+Upstream-Status: Backport [https://github.com/ImageMagick/ImageMagick/commit/83caf59fce695fea0c5878e9f0d0b65e662cae66]
+
+Comment: Refreshed hunk to match latest kirkstone
+
+Signed-off-by: Divyanshu Rathore <Divyanshu.Rathore@bmwtechworks.in>
+---
+ MagickCore/image.c | 8 +++++---
+ 1 file changed, 5 insertions(+), 3 deletions(-)
+
+diff --git a/MagickCore/image.c b/MagickCore/image.c
+index 34804e522..849a89931 100644
+--- a/MagickCore/image.c
++++ b/MagickCore/image.c
+@@ -1640,15 +1640,15 @@ MagickExport size_t InterpretImageFilename(const ImageInfo *image_info,
+ char
+ *q;
+
++ const char
++ *p;
++
+ int
+ c;
+
+ MagickBooleanType
+ canonical;
+
+- const char
+- *p;
+-
+ ssize_t
+ field_width,
+ offset;
+@@ -1656,6 +1656,8 @@ MagickExport size_t InterpretImageFilename(const ImageInfo *image_info,
+ canonical=MagickFalse;
+ offset=0;
+ (void) CopyMagickString(filename,format,MagickPathExtent);
++ if (IsStringTrue(GetImageOption(image_info,"filename:literal")) != MagickFalse)
++ return(strlen(filename));
+ for (p=strchr(format,'%'); p != (char *) NULL; p=strchr(p+1,'%'))
+ {
+ q=(char *) p+1;
+--
+2.34.1
+
new file mode 100644
@@ -0,0 +1,58 @@
+From c02868456edccf0dd555c3d004efb491974c92c7 Mon Sep 17 00:00:00 2001
+From: Divyanshu Rathore <Divyanshu.Rathore@bmwtechworks.in>
+Date: Tue, 11 Nov 2025 15:17:32 +0530
+Subject: [PATCH 2/6] ImageMagick: Add support patch-2 to fix CVE-2025-55298
+
+Upstream-Status: Backport [https://github.com/ImageMagick/ImageMagick/commit/66dc8f51c11b0ae1f1cdeacd381c3e9a4de69774]
+
+Comment: Refreshed hunk to match latest kirkstone
+
+Signed-off-by: Divyanshu Rathore <Divyanshu.Rathore@bmwtechworks.in>
+---
+ MagickCore/image.c | 13 +++++++------
+ 1 file changed, 7 insertions(+), 6 deletions(-)
+
+diff --git a/MagickCore/image.c b/MagickCore/image.c
+index 849a89931..3437ed358 100644
+--- a/MagickCore/image.c
++++ b/MagickCore/image.c
+@@ -1650,7 +1650,6 @@ MagickExport size_t InterpretImageFilename(const ImageInfo *image_info,
+ canonical;
+
+ ssize_t
+- field_width,
+ offset;
+
+ canonical=MagickFalse;
+@@ -1666,21 +1665,23 @@ MagickExport size_t InterpretImageFilename(const ImageInfo *image_info,
+ p=q+1;
+ continue;
+ }
+- field_width=0;
+- if (*q == '0')
+- field_width=(ssize_t) strtol(q,&q,10);
+ switch (*q)
+ {
+ case 'd':
+ case 'o':
+ case 'x':
+ {
++ ssize_t
++ count;
++
+ q++;
+ c=(*q);
+ *q='\0';
+- (void) FormatLocaleString(filename+(p-format-offset),(size_t)
++ count=FormatLocaleString(filename+(p-format-offset),(size_t)
+ (MagickPathExtent-(p-format-offset)),p,value);
+- offset+=(4-field_width);
++ if ((count <= 0) || (count > (MagickPathExtent-(p-format-offset))))
++ return(0);
++ offset+=(ssize_t) ((q-p)-count);
+ *q=c;
+ (void) ConcatenateMagickString(filename,q,MagickPathExtent);
+ canonical=MagickTrue;
+--
+2.34.1
+
new file mode 100644
@@ -0,0 +1,205 @@
+From 19073f73f83c78a1fed8f040ed08b16ccfc817f5 Mon Sep 17 00:00:00 2001
+From: Divyanshu Rathore <Divyanshu.Rathore@bmwtechworks.in>
+Date: Tue, 11 Nov 2025 21:53:10 +0530
+Subject: [PATCH 3/6] ImageMagick: Add support patch-3 to fix CVE-2025-55298
+
+Upstream-Status: Backport [https://github.com/ImageMagick/ImageMagick/commit/82550750ec8f79393b381c3ed349dd495bbab8a7]
+
+Comment: Refreshed hunk to match latest kirkstone
+
+Signed-off-by: Divyanshu Rathore <Divyanshu.Rathore@bmwtechworks.in>
+---
+ MagickCore/image.c | 134 +++++++++++++++++++--------------------------
+ 1 file changed, 55 insertions(+), 79 deletions(-)
+
+diff --git a/MagickCore/image.c b/MagickCore/image.c
+index 3437ed358..cd4de6df9 100644
+--- a/MagickCore/image.c
++++ b/MagickCore/image.c
+@@ -1638,34 +1638,41 @@ MagickExport size_t InterpretImageFilename(const ImageInfo *image_info,
+ ExceptionInfo *exception)
+ {
+ char
+- *q;
++ *p = filename,
++ pattern[MagickPathExtent];
+
+ const char
+- *p;
+-
+- int
+- c;
+-
+- MagickBooleanType
+- canonical;
+-
+- ssize_t
+- offset;
++ *cursor = format;
+
+- canonical=MagickFalse;
+- offset=0;
++ /*
++ Start with a copy of the format string.
++ */
+ (void) CopyMagickString(filename,format,MagickPathExtent);
+ if (IsStringTrue(GetImageOption(image_info,"filename:literal")) != MagickFalse)
+ return(strlen(filename));
+- for (p=strchr(format,'%'); p != (char *) NULL; p=strchr(p+1,'%'))
++ while ((cursor=strchr(cursor,'%')) != (const char *) NULL)
+ {
+- q=(char *) p+1;
+- if (*q == '%')
++ const char
++ *q = cursor;
++
++ ssize_t
++ offset = (ssize_t) (cursor-format);
++
++ cursor++; /* move past '%' */
++ if (*cursor == '%')
+ {
+- p=q+1;
++ /*
++ Escaped %%.
++ */
++ cursor++;
+ continue;
+ }
+- switch (*q)
++ /*
++ Skip padding digits like %03d.
++ */
++ if (*cursor == '0')
++ (void) strtol(cursor,(char **) &cursor,10);
++ switch (*cursor)
+ {
+ case 'd':
+ case 'o':
+@@ -1674,93 +1681,62 @@ MagickExport size_t InterpretImageFilename(const ImageInfo *image_info,
+ ssize_t
+ count;
+
+- q++;
+- c=(*q);
+- *q='\0';
+- count=FormatLocaleString(filename+(p-format-offset),(size_t)
+- (MagickPathExtent-(p-format-offset)),p,value);
+- if ((count <= 0) || (count > (MagickPathExtent-(p-format-offset))))
++ count=FormatLocaleString(pattern,sizeof(pattern),q,value);
++ if ((count <= 0) || (count >= MagickPathExtent))
+ return(0);
+- offset+=(ssize_t) ((q-p)-count);
+- *q=c;
+- (void) ConcatenateMagickString(filename,q,MagickPathExtent);
+- canonical=MagickTrue;
+- if (*(q-1) != '%')
+- break;
+- p++;
++ if ((offset+count) >= MagickPathExtent)
++ return(0);
++ (void) CopyMagickString(p+offset,pattern,(size_t) (MagickPathExtent-
++ offset));
++ cursor++;
+ break;
+ }
+ case '[':
+ {
+- char
+- pattern[MagickPathExtent];
+-
+ const char
+- *option;
++ *end = strchr(cursor,']'),
++ *option = (const char *) NULL;
+
+- char
+- *r;
+-
+- ssize_t
+- i;
+-
+- ssize_t
+- depth;
++ size_t
++ extent = (size_t) (end-cursor);
+
+ /*
+- Image option.
++ Handle %[key:value];
+ */
+- if (strchr(p,']') == (char *) NULL)
++ if (end == (const char *) NULL)
+ break;
+- depth=1;
+- r=q+1;
+- for (i=0; (i < (MagickPathExtent-1L)) && (*r != '\0'); i++)
+- {
+- if (*r == '[')
+- depth++;
+- if (*r == ']')
+- depth--;
+- if (depth <= 0)
+- break;
+- pattern[i]=(*r++);
+- }
+- pattern[i]='\0';
+- if (LocaleNCompare(pattern,"filename:",9) != 0)
++ if (extent >= sizeof(pattern))
+ break;
+- option=(const char *) NULL;
++ (void) CopyMagickString(pattern,cursor,extent);
++ pattern[extent]='\0';
+ if (image != (Image *) NULL)
+ option=GetImageProperty(image,pattern,exception);
+- if ((option == (const char *) NULL) && (image != (Image *) NULL))
++ if ((option == (const char *) NULL) && (image != (Image *)NULL))
+ option=GetImageArtifact(image,pattern);
+ if ((option == (const char *) NULL) &&
+ (image_info != (ImageInfo *) NULL))
+ option=GetImageOption(image_info,pattern);
+ if (option == (const char *) NULL)
+ break;
+- q--;
+- c=(*q);
+- *q='\0';
+- (void) CopyMagickString(filename+(p-format-offset),option,(size_t)
+- (MagickPathExtent-(p-format-offset)));
+- offset+=strlen(pattern)-strlen(option)+3;
+- *q=c;
+- (void) ConcatenateMagickString(filename,r+1,MagickPathExtent);
+- canonical=MagickTrue;
+- if (*(q-1) != '%')
+- break;
+- p++;
++ (void) CopyMagickString(p+offset,option,(size_t) (MagickPathExtent-
++ offset));
++ cursor=end+1;
+ break;
+ }
+ default:
+ break;
+ }
+ }
+- if (canonical == MagickFalse)
+- (void) CopyMagickString(filename,format,MagickPathExtent);
+- else
+- for (q=filename; *q != '\0'; q++)
+- if ((*q == '%') && (*(q+1) == '%'))
+- (void) CopyMagickString(q,q+1,(size_t) (MagickPathExtent-(q-filename)));
++ for (p=filename; *p != '\0'; )
++ {
++ /*
++ Replace "%%" with "%".
++ */
++ if ((*p == '%') && (*(p+1) == '%'))
++ (void) memmove(p,p+1,strlen(p)); /* shift left */
++ else
++ p++;
++ }
+ return(strlen(filename));
+ }
+
+--
+2.34.1
+
new file mode 100644
@@ -0,0 +1,103 @@
+From 3b5f524f80851b819bcbfd40e30912af3710ef48 Mon Sep 17 00:00:00 2001
+From: Divyanshu Rathore <Divyanshu.Rathore@bmwtechworks.in>
+Date: Wed, 12 Nov 2025 11:35:37 +0530
+Subject: [PATCH 4/6] ImageMagick: Add support patch-4 to fix CVE-2025-55298
+
+Upstream-Status: Backport [https://github.com/ImageMagick/ImageMagick/commit/6c7c8d5866b9c0ce6cc76a741e05b9482716101e]
+
+Comment: Refreshed hunk to match latest kirkstone
+
+Signed-off-by: Divyanshu Rathore <Divyanshu.Rathore@bmwtechworks.in>
+---
+ MagickCore/image.c | 31 +++++++++++++++++++++----------
+ 1 file changed, 21 insertions(+), 10 deletions(-)
+
+diff --git a/MagickCore/image.c b/MagickCore/image.c
+index cd4de6df9..1acf8edbd 100644
+--- a/MagickCore/image.c
++++ b/MagickCore/image.c
+@@ -1647,6 +1647,8 @@ MagickExport size_t InterpretImageFilename(const ImageInfo *image_info,
+ /*
+ Start with a copy of the format string.
+ */
++ assert(format != (const char *) NULL);
++ assert(filename != (char *) NULL);
+ (void) CopyMagickString(filename,format,MagickPathExtent);
+ if (IsStringTrue(GetImageOption(image_info,"filename:literal")) != MagickFalse)
+ return(strlen(filename));
+@@ -1670,7 +1672,7 @@ MagickExport size_t InterpretImageFilename(const ImageInfo *image_info,
+ /*
+ Skip padding digits like %03d.
+ */
+- if (*cursor == '0')
++ if (isdigit((int) ((unsigned char) *cursor)) != 0)
+ (void) strtol(cursor,(char **) &cursor,10);
+ switch (*cursor)
+ {
+@@ -1682,9 +1684,8 @@ MagickExport size_t InterpretImageFilename(const ImageInfo *image_info,
+ count;
+
+ count=FormatLocaleString(pattern,sizeof(pattern),q,value);
+- if ((count <= 0) || (count >= MagickPathExtent))
+- return(0);
+- if ((offset+count) >= MagickPathExtent)
++ if ((count <= 0) || (count >= MagickPathExtent) ||
++ ((offset+count) >= MagickPathExtent))
+ return(0);
+ (void) CopyMagickString(p+offset,pattern,(size_t) (MagickPathExtent-
+ offset));
+@@ -1698,7 +1699,9 @@ MagickExport size_t InterpretImageFilename(const ImageInfo *image_info,
+ *option = (const char *) NULL;
+
+ size_t
+- extent = (size_t) (end-cursor);
++ extent = (size_t) (end-cursor-1),
++ option_length,
++ tail_length;
+
+ /*
+ Handle %[key:value];
+@@ -1707,19 +1710,27 @@ MagickExport size_t InterpretImageFilename(const ImageInfo *image_info,
+ break;
+ if (extent >= sizeof(pattern))
+ break;
+- (void) CopyMagickString(pattern,cursor,extent);
++ (void) CopyMagickString(pattern,cursor+1,extent+1);
+ pattern[extent]='\0';
+ if (image != (Image *) NULL)
+- option=GetImageProperty(image,pattern,exception);
+- if ((option == (const char *) NULL) && (image != (Image *)NULL))
+- option=GetImageArtifact(image,pattern);
++ {
++ option=GetImageProperty(image,pattern,exception);
++ if (option == (const char *) NULL)
++ option=GetImageArtifact(image,pattern);
++ }
+ if ((option == (const char *) NULL) &&
+ (image_info != (ImageInfo *) NULL))
+ option=GetImageOption(image_info,pattern);
+ if (option == (const char *) NULL)
+ break;
++ option_length=strlen(option);
++ tail_length=strlen(end+1);
++ if ((offset+option_length+tail_length+1) > MagickPathExtent)
++ return(0);
+ (void) CopyMagickString(p+offset,option,(size_t) (MagickPathExtent-
+ offset));
++ (void) ConcatenateMagickString(p+offset+option_length,end+1,(size_t) (
++ MagickPathExtent-offset-option_length-tail_length-1));
+ cursor=end+1;
+ break;
+ }
+@@ -1733,7 +1744,7 @@ MagickExport size_t InterpretImageFilename(const ImageInfo *image_info,
+ Replace "%%" with "%".
+ */
+ if ((*p == '%') && (*(p+1) == '%'))
+- (void) memmove(p,p+1,strlen(p)); /* shift left */
++ (void) memmove(p,p+1,strlen(p+1)+1); /* shift left */
+ else
+ p++;
+ }
+--
+2.34.1
+
new file mode 100644
@@ -0,0 +1,71 @@
+From bc530e782bcee75960dac57e9191ab7257842bd9 Mon Sep 17 00:00:00 2001
+From: Divyanshu Rathore <Divyanshu.Rathore@bmwtechworks.in>
+Date: Wed, 12 Nov 2025 11:52:00 +0530
+Subject: [PATCH 5/6] ImageMagick: Fix CVE-2025-55298
+
+CVE: CVE-2025-55298
+
+This CVE fixed in two parts, this commit includes the first fix.
+
+Upstream-Status: Backport [https://github.com/ImageMagick/ImageMagick/commit/1f93323df9d8c011c31bc4c6880390071f7fb895]
+
+Comment: Refreshed hunk to match latest kirkstone
+
+Signed-off-by: Divyanshu Rathore <Divyanshu.Rathore@bmwtechworks.in>
+---
+ MagickCore/image.c | 32 ++++++++++++++++++++++++++++++++
+ 1 file changed, 32 insertions(+)
+
+diff --git a/MagickCore/image.c b/MagickCore/image.c
+index 1acf8edbd..7a52236d8 100644
+--- a/MagickCore/image.c
++++ b/MagickCore/image.c
+@@ -1633,6 +1633,31 @@ MagickExport VirtualPixelMethod GetImageVirtualPixelMethod(const Image *image)
+ % o exception: return any errors or warnings in this structure.
+ %
+ */
++
++static inline MagickBooleanType PercentNInvalidOperation(char *filename)
++{
++ MagickBooleanType
++ match = MagickFalse;
++
++ size_t
++ length = strlen(filename);
++
++ ssize_t
++ i;
++
++ for (i=0; i < (ssize_t) length-1; i++)
++ {
++ if ((filename[i] == '%') &&
++ ((filename[i+1] == 'n') || (filename[i+1] == 'N')))
++ {
++ filename[i]='?';
++ filename[i+1]='\?';
++ match=MagickTrue;
++ }
++ }
++ return(match);
++}
++
+ MagickExport size_t InterpretImageFilename(const ImageInfo *image_info,
+ Image *image,const char *format,int value,char *filename,
+ ExceptionInfo *exception)
+@@ -1652,6 +1677,13 @@ MagickExport size_t InterpretImageFilename(const ImageInfo *image_info,
+ (void) CopyMagickString(filename,format,MagickPathExtent);
+ if (IsStringTrue(GetImageOption(image_info,"filename:literal")) != MagickFalse)
+ return(strlen(filename));
++ if (PercentNInvalidOperation(filename) != MagickFalse)
++ {
++ errno=EPERM;
++ (void) ThrowMagickException(exception,GetMagickModule(),OptionError,
++ "InvalidArgument","`%s'",filename);
++ return(0);
++ }
+ while ((cursor=strchr(cursor,'%')) != (const char *) NULL)
+ {
+ const char
+--
+2.34.1
+
new file mode 100644
@@ -0,0 +1,274 @@
+From 51bdbd8ba79cc29b5b8bd1cbe201612c4f1b6a14 Mon Sep 17 00:00:00 2001
+From: Divyanshu Rathore <Divyanshu.Rathore@bmwtechworks.in>
+Date: Wed, 12 Nov 2025 13:05:40 +0530
+Subject: [PATCH 6/6] ImageMagick: Fix CVE-2025-55298
+
+CVE: CVE-2025-55298
+
+This CVE fixed in two parts, this commit includes the second fix.
+
+Upstream-Status: Backport [https://github.com/ImageMagick/ImageMagick/commit/439b362b93c074eea6c3f834d84982b43ef057d5]
+
+Comment: Refreshed hunk to match latest kirkstone
+
+Signed-off-by: Divyanshu Rathore <Divyanshu.Rathore@bmwtechworks.in>
+---
+ MagickCore/image.c | 182 ++++++++++++++++++++++++---------------------
+ 1 file changed, 96 insertions(+), 86 deletions(-)
+
+diff --git a/MagickCore/image.c b/MagickCore/image.c
+index 7a52236d8..beaf69728 100644
+--- a/MagickCore/image.c
++++ b/MagickCore/image.c
+@@ -1619,7 +1619,7 @@ MagickExport VirtualPixelMethod GetImageVirtualPixelMethod(const Image *image)
+ %
+ % A description of each parameter follows.
+ %
+-% o image_info: the image info..
++% o image_info: the image info.
+ %
+ % o image: the image.
+ %
+@@ -1634,28 +1634,39 @@ MagickExport VirtualPixelMethod GetImageVirtualPixelMethod(const Image *image)
+ %
+ */
+
+-static inline MagickBooleanType PercentNInvalidOperation(char *filename)
++static inline MagickBooleanType IsValidFormatSpecifier(const char *start,
++ const char *end)
+ {
+- MagickBooleanType
+- match = MagickFalse;
++ char
++ specifier = end[-1];
+
+ size_t
+- length = strlen(filename);
++ length = end-start;
+
+- ssize_t
+- i;
++ /*
++ Is this a valid format specifier?
++ */
++ if ((specifier != 'd') && (specifier != 'x') && (specifier != 'o'))
++ return(MagickFalse);
++ if ((length == 1) && (*start == specifier))
++ return(MagickTrue);
++ if (length >= 2)
++ {
++ size_t
++ i = 0;
+
+- for (i=0; i < (ssize_t) length-1; i++)
+- {
+- if ((filename[i] == '%') &&
+- ((filename[i+1] == 'n') || (filename[i+1] == 'N')))
+- {
+- filename[i]='?';
+- filename[i+1]='\?';
+- match=MagickTrue;
+- }
+- }
+- return(match);
++ if (*start == '0')
++ {
++ if ((length >= 3) && (start[1] == '0'))
++ return(MagickFalse);
++ i=1;
++ }
++ for ( ; i < (length-1); i++)
++ if (isdigit((int) ((unsigned char) start[i])) == 0)
++ return(MagickFalse);
++ return(MagickTrue);
++ }
++ return(MagickFalse);
+ }
+
+ MagickExport size_t InterpretImageFilename(const ImageInfo *image_info,
+@@ -1669,82 +1680,89 @@ MagickExport size_t InterpretImageFilename(const ImageInfo *image_info,
+ const char
+ *cursor = format;
+
+- /*
+- Start with a copy of the format string.
+- */
+ assert(format != (const char *) NULL);
+ assert(filename != (char *) NULL);
+- (void) CopyMagickString(filename,format,MagickPathExtent);
+ if (IsStringTrue(GetImageOption(image_info,"filename:literal")) != MagickFalse)
+- return(strlen(filename));
+- if (PercentNInvalidOperation(filename) != MagickFalse)
+ {
+- errno=EPERM;
+- (void) ThrowMagickException(exception,GetMagickModule(),OptionError,
+- "InvalidArgument","`%s'",filename);
+- return(0);
++ (void) CopyMagickString(filename,format,MagickPathExtent);
++ return(strlen(filename));
+ }
+- while ((cursor=strchr(cursor,'%')) != (const char *) NULL)
++ while ((*cursor != '\0') && ((p-filename) < ((ssize_t) MagickPathExtent-1)))
+ {
+ const char
+- *q = cursor;
+-
+- ssize_t
+- offset = (ssize_t) (cursor-format);
++ *specifier_start,
++ *start;
+
+- cursor++; /* move past '%' */
++ if (*cursor != '%')
++ {
++ *p++=(*cursor++);
++ continue;
++ }
++ start=cursor++; /* Skip '%' */
+ if (*cursor == '%')
+ {
+- /*
+- Escaped %%.
+- */
++ *p++='%';
+ cursor++;
+ continue;
+ }
+- /*
+- Skip padding digits like %03d.
+- */
+- if (isdigit((int) ((unsigned char) *cursor)) != 0)
+- (void) strtol(cursor,(char **) &cursor,10);
+- switch (*cursor)
+- {
+- case 'd':
+- case 'o':
+- case 'x':
++ specifier_start=cursor;
++ while (isdigit((int) ((unsigned char) *cursor)) != 0)
++ cursor++;
++ if ((*cursor == 'd') || (*cursor == 'o') || (*cursor == 'x'))
+ {
+- ssize_t
+- count;
++ const char
++ *specifier_end = cursor+1;
+
+- count=FormatLocaleString(pattern,sizeof(pattern),q,value);
+- if ((count <= 0) || (count >= MagickPathExtent) ||
+- ((offset+count) >= MagickPathExtent))
+- return(0);
+- (void) CopyMagickString(p+offset,pattern,(size_t) (MagickPathExtent-
+- offset));
+- cursor++;
+- break;
++ if (IsValidFormatSpecifier(specifier_start,specifier_end) != MagickFalse)
++ {
++ char
++ format_specifier[MagickPathExtent];
++
++ size_t
++ length = cursor-specifier_start;
++
++ ssize_t
++ count;
++
++ (void) snprintf(format_specifier,sizeof(format_specifier),
++ "%%%.*s%c",(int) length,specifier_start,*cursor);
++ count=FormatLocaleString(pattern,sizeof(pattern),format_specifier,
++ value);
++ if ((count <= 0) || ((p-filename+count) >= MagickPathExtent))
++ return(0);
++ (void) CopyMagickString(p,pattern,MagickPathExtent-(p-filename));
++ p+=strlen(pattern);
++ cursor++;
++ continue;
++ }
++ else
++ {
++ /*
++ Invalid specifier — treat as literal.
++ */
++ cursor=start;
++ *p++=(*cursor++);
++ continue;
++ }
+ }
+- case '[':
++ if (*cursor == '[')
+ {
+ const char
+ *end = strchr(cursor,']'),
+ *option = (const char *) NULL;
+
+ size_t
+- extent = (size_t) (end-cursor-1),
+- option_length,
+- tail_length;
++ extent,
++ option_length;
+
+- /*
+- Handle %[key:value];
+- */
+ if (end == (const char *) NULL)
+- break;
++ continue;
++ extent=(size_t) (end-cursor-1);
+ if (extent >= sizeof(pattern))
+- break;
++ continue;
+ (void) CopyMagickString(pattern,cursor+1,extent+1);
+ pattern[extent]='\0';
+- if (image != (Image *) NULL)
++ if (image != NULL)
+ {
+ option=GetImageProperty(image,pattern,exception);
+ if (option == (const char *) NULL)
+@@ -1754,32 +1772,24 @@ MagickExport size_t InterpretImageFilename(const ImageInfo *image_info,
+ (image_info != (ImageInfo *) NULL))
+ option=GetImageOption(image_info,pattern);
+ if (option == (const char *) NULL)
+- break;
++ continue;
+ option_length=strlen(option);
+- tail_length=strlen(end+1);
+- if ((offset+option_length+tail_length+1) > MagickPathExtent)
++ if ((p-filename+option_length) >= MagickPathExtent)
+ return(0);
+- (void) CopyMagickString(p+offset,option,(size_t) (MagickPathExtent-
+- offset));
+- (void) ConcatenateMagickString(p+offset+option_length,end+1,(size_t) (
+- MagickPathExtent-offset-option_length-tail_length-1));
++ (void) CopyMagickString(p,option,MagickPathExtent-(p-filename));
++ p+=option_length;
+ cursor=end+1;
+- break;
++ continue;
+ }
+- default:
+- break;
+- }
+- }
+- for (p=filename; *p != '\0'; )
+- {
+ /*
+- Replace "%%" with "%".
++ Invalid or unsupported specifier — treat as literal.
+ */
+- if ((*p == '%') && (*(p+1) == '%'))
+- (void) memmove(p,p+1,strlen(p+1)+1); /* shift left */
+- else
+- p++;
++ cursor=start;
++ if ((p-filename+1) >= MagickPathExtent)
++ return(0);
++ *p++=(*cursor++);
+ }
++ *p='\0';
+ return(strlen(filename));
+ }
+
+--
+2.34.1
+
@@ -33,6 +33,12 @@ SRC_URI = "git://github.com/ImageMagick/ImageMagick.git;branch=main;protocol=htt
file://0008-ImageMagick-Fix-CVE-2025-57807.patch \
file://0009-ImageMagick-Fix-CVE-2023-34151.patch \
file://0010-ImageMagick-Fix-CVE-2025-55154.patch \
+ file://0011-ImageMagick-Add-support-patch-1-to-fix-CVE-2025-5529.patch \
+ file://0011-ImageMagick-Add-support-patch-2-to-fix-CVE-2025-5529.patch \
+ file://0011-ImageMagick-Add-support-patch-3-to-fix-CVE-2025-5529.patch \
+ file://0011-ImageMagick-Add-support-patch-4-to-fix-CVE-2025-5529.patch \
+ file://0011-ImageMagick-Fix-1-CVE-2025-55298.patch \
+ file://0011-ImageMagick-Fix-2-CVE-2025-55298.patch \
"
SRCREV = "35b4991eb0939a327f3489988c366e21068b0178"
Backport the fix for CVE-2025-55298 Add below patch to fix 0011-ImageMagick-Fix-CVE-2025-55298.patch Signed-off-by: Divyanshu Rathore <Divyanshu.Rathore@bmwtechworks.in> --- ...support-patch-1-to-fix-CVE-2025-5529.patch | 49 ++++ ...support-patch-2-to-fix-CVE-2025-5529.patch | 58 ++++ ...support-patch-3-to-fix-CVE-2025-5529.patch | 205 +++++++++++++ ...support-patch-4-to-fix-CVE-2025-5529.patch | 103 +++++++ ...011-ImageMagick-Fix-1-CVE-2025-55298.patch | 71 +++++ ...011-ImageMagick-Fix-2-CVE-2025-55298.patch | 274 ++++++++++++++++++ .../imagemagick/imagemagick_7.0.10.bb | 6 + 7 files changed, 766 insertions(+) create mode 100644 meta-oe/recipes-support/imagemagick/files/0011-ImageMagick-Add-support-patch-1-to-fix-CVE-2025-5529.patch create mode 100644 meta-oe/recipes-support/imagemagick/files/0011-ImageMagick-Add-support-patch-2-to-fix-CVE-2025-5529.patch create mode 100644 meta-oe/recipes-support/imagemagick/files/0011-ImageMagick-Add-support-patch-3-to-fix-CVE-2025-5529.patch create mode 100644 meta-oe/recipes-support/imagemagick/files/0011-ImageMagick-Add-support-patch-4-to-fix-CVE-2025-5529.patch create mode 100644 meta-oe/recipes-support/imagemagick/files/0011-ImageMagick-Fix-1-CVE-2025-55298.patch create mode 100644 meta-oe/recipes-support/imagemagick/files/0011-ImageMagick-Fix-2-CVE-2025-55298.patch