[meta-oe,kirkstone,11/12] ImageMagick: Fix CVE-2025-55298

Backport the fix for CVE-2025-55298

Add below patch to fix
0011-ImageMagick-Fix-CVE-2025-55298.patch

Signed-off-by: Divyanshu Rathore <Divyanshu.Rathore@bmwtechworks.in>
---
 ...support-patch-1-to-fix-CVE-2025-5529.patch |  49 ++++
 ...support-patch-2-to-fix-CVE-2025-5529.patch |  58 ++++
 ...support-patch-3-to-fix-CVE-2025-5529.patch | 205 +++++++++++++
 ...support-patch-4-to-fix-CVE-2025-5529.patch | 103 +++++++
 ...011-ImageMagick-Fix-1-CVE-2025-55298.patch |  71 +++++
 ...011-ImageMagick-Fix-2-CVE-2025-55298.patch | 274 ++++++++++++++++++
 .../imagemagick/imagemagick_7.0.10.bb         |   6 +
 7 files changed, 766 insertions(+)
 create mode 100644 meta-oe/recipes-support/imagemagick/files/0011-ImageMagick-Add-support-patch-1-to-fix-CVE-2025-5529.patch
 create mode 100644 meta-oe/recipes-support/imagemagick/files/0011-ImageMagick-Add-support-patch-2-to-fix-CVE-2025-5529.patch
 create mode 100644 meta-oe/recipes-support/imagemagick/files/0011-ImageMagick-Add-support-patch-3-to-fix-CVE-2025-5529.patch
 create mode 100644 meta-oe/recipes-support/imagemagick/files/0011-ImageMagick-Add-support-patch-4-to-fix-CVE-2025-5529.patch
 create mode 100644 meta-oe/recipes-support/imagemagick/files/0011-ImageMagick-Fix-1-CVE-2025-55298.patch
 create mode 100644 meta-oe/recipes-support/imagemagick/files/0011-ImageMagick-Fix-2-CVE-2025-55298.patch

These patches fail to apply - could you please take a look at this? It
looks that this patch's content is already present.


ERROR: imagemagick-7.0.10-62-r0 do_patch: Applying patch
'0011-ImageMagick-Add-support-patch-2-to-fix-CVE-2025-5529.patch' on
target directory
'/cocto/kirkstone-next/build/tmp/work/core2-64-poky-linux/imagemagick/7.0.10-62-r0/git'
CmdError('quilt --quiltrc
/cocto/kirkstone-next/build/tmp/work/core2-64-poky-linux/imagemagick/7.0.10-62-r0/recipe-sysroot-native/etc/quiltrc
push', 0, 'stdout: Applying patch
0011-ImageMagick-Add-support-patch-2-to-fix-CVE-2025-5529.patch
patching file MagickCore/image.c
Hunk #1 FAILED at 1650.
Hunk #2 FAILED at 1666.
2 out of 2 hunks FAILED -- rejects in file MagickCore/image.c
Patch 0011-ImageMagick-Add-support-patch-2-to-fix-CVE-2025-5529.patch
can be reverse-applied


On 11/20/25 09:49, Divyanshu Rathore via lists.openembedded.org wrote:
> Backport the fix for CVE-2025-55298
>
> Add below patch to fix
> 0011-ImageMagick-Fix-CVE-2025-55298.patch
>
> Signed-off-by: Divyanshu Rathore <Divyanshu.Rathore@bmwtechworks.in>
> ---
>  ...support-patch-1-to-fix-CVE-2025-5529.patch |  49 ++++
>  ...support-patch-2-to-fix-CVE-2025-5529.patch |  58 ++++
>  ...support-patch-3-to-fix-CVE-2025-5529.patch | 205 +++++++++++++
>  ...support-patch-4-to-fix-CVE-2025-5529.patch | 103 +++++++
>  ...011-ImageMagick-Fix-1-CVE-2025-55298.patch |  71 +++++
>  ...011-ImageMagick-Fix-2-CVE-2025-55298.patch | 274 ++++++++++++++++++
>  .../imagemagick/imagemagick_7.0.10.bb         |   6 +
>  7 files changed, 766 insertions(+)
>  create mode 100644 meta-oe/recipes-support/imagemagick/files/0011-ImageMagick-Add-support-patch-1-to-fix-CVE-2025-5529.patch
>  create mode 100644 meta-oe/recipes-support/imagemagick/files/0011-ImageMagick-Add-support-patch-2-to-fix-CVE-2025-5529.patch
>  create mode 100644 meta-oe/recipes-support/imagemagick/files/0011-ImageMagick-Add-support-patch-3-to-fix-CVE-2025-5529.patch
>  create mode 100644 meta-oe/recipes-support/imagemagick/files/0011-ImageMagick-Add-support-patch-4-to-fix-CVE-2025-5529.patch
>  create mode 100644 meta-oe/recipes-support/imagemagick/files/0011-ImageMagick-Fix-1-CVE-2025-55298.patch
>  create mode 100644 meta-oe/recipes-support/imagemagick/files/0011-ImageMagick-Fix-2-CVE-2025-55298.patch
>
> diff --git a/meta-oe/recipes-support/imagemagick/files/0011-ImageMagick-Add-support-patch-1-to-fix-CVE-2025-5529.patch b/meta-oe/recipes-support/imagemagick/files/0011-ImageMagick-Add-support-patch-1-to-fix-CVE-2025-5529.patch
> new file mode 100644
> index 0000000000..d4bd7d6acb
> --- /dev/null
> +++ b/meta-oe/recipes-support/imagemagick/files/0011-ImageMagick-Add-support-patch-1-to-fix-CVE-2025-5529.patch
> @@ -0,0 +1,49 @@
> +From 11f9e946dab3f2a4de68809bab9c01be2967bb08 Mon Sep 17 00:00:00 2001
> +From: Divyanshu Rathore <Divyanshu.Rathore@bmwtechworks.in>
> +Date: Tue, 11 Nov 2025 14:34:12 +0530
> +Subject: [PATCH 1/6] ImageMagick: Add support patch 1 to fix CVE-2025-55298
> +
> +Upstream-Status: Backport [https://github.com/ImageMagick/ImageMagick/commit/83caf59fce695fea0c5878e9f0d0b65e662cae66]
> +
> +Comment: Refreshed hunk to match latest kirkstone
> +
> +Signed-off-by: Divyanshu Rathore <Divyanshu.Rathore@bmwtechworks.in>
> +---
> + MagickCore/image.c | 8 +++++---
> + 1 file changed, 5 insertions(+), 3 deletions(-)
> +
> +diff --git a/MagickCore/image.c b/MagickCore/image.c
> +index 34804e522..849a89931 100644
> +--- a/MagickCore/image.c
> ++++ b/MagickCore/image.c
> +@@ -1640,15 +1640,15 @@ MagickExport size_t InterpretImageFilename(const ImageInfo *image_info,
> +   char
> +     *q;
> + 
> ++  const char
> ++    *p;
> ++
> +   int
> +     c;
> + 
> +   MagickBooleanType
> +     canonical;
> + 
> +-  const char
> +-    *p;
> +-
> +   ssize_t
> +     field_width,
> +     offset;
> +@@ -1656,6 +1656,8 @@ MagickExport size_t InterpretImageFilename(const ImageInfo *image_info,
> +   canonical=MagickFalse;
> +   offset=0;
> +   (void) CopyMagickString(filename,format,MagickPathExtent);
> ++  if (IsStringTrue(GetImageOption(image_info,"filename:literal")) != MagickFalse)
> ++    return(strlen(filename));
> +   for (p=strchr(format,'%'); p != (char *) NULL; p=strchr(p+1,'%'))
> +   {
> +     q=(char *) p+1;
> +-- 
> +2.34.1
> +
> diff --git a/meta-oe/recipes-support/imagemagick/files/0011-ImageMagick-Add-support-patch-2-to-fix-CVE-2025-5529.patch b/meta-oe/recipes-support/imagemagick/files/0011-ImageMagick-Add-support-patch-2-to-fix-CVE-2025-5529.patch
> new file mode 100644
> index 0000000000..3550a4abba
> --- /dev/null
> +++ b/meta-oe/recipes-support/imagemagick/files/0011-ImageMagick-Add-support-patch-2-to-fix-CVE-2025-5529.patch
> @@ -0,0 +1,58 @@
> +From c02868456edccf0dd555c3d004efb491974c92c7 Mon Sep 17 00:00:00 2001
> +From: Divyanshu Rathore <Divyanshu.Rathore@bmwtechworks.in>
> +Date: Tue, 11 Nov 2025 15:17:32 +0530
> +Subject: [PATCH 2/6] ImageMagick: Add support patch-2 to fix CVE-2025-55298
> +
> +Upstream-Status: Backport [https://github.com/ImageMagick/ImageMagick/commit/66dc8f51c11b0ae1f1cdeacd381c3e9a4de69774]
> +
> +Comment: Refreshed hunk to match latest kirkstone
> +
> +Signed-off-by: Divyanshu Rathore <Divyanshu.Rathore@bmwtechworks.in>
> +---
> + MagickCore/image.c | 13 +++++++------
> + 1 file changed, 7 insertions(+), 6 deletions(-)
> +
> +diff --git a/MagickCore/image.c b/MagickCore/image.c
> +index 849a89931..3437ed358 100644
> +--- a/MagickCore/image.c
> ++++ b/MagickCore/image.c
> +@@ -1650,7 +1650,6 @@ MagickExport size_t InterpretImageFilename(const ImageInfo *image_info,
> +     canonical;
> + 
> +   ssize_t
> +-    field_width,
> +     offset;
> + 
> +   canonical=MagickFalse;
> +@@ -1666,21 +1665,23 @@ MagickExport size_t InterpretImageFilename(const ImageInfo *image_info,
> +         p=q+1;
> +         continue;
> +       }
> +-    field_width=0;
> +-    if (*q == '0')
> +-      field_width=(ssize_t) strtol(q,&q,10);
> +     switch (*q)
> +     {
> +       case 'd':
> +       case 'o':
> +       case 'x':
> +       {
> ++        ssize_t
> ++          count;
> ++
> +         q++;
> +         c=(*q);
> +         *q='\0';
> +-        (void) FormatLocaleString(filename+(p-format-offset),(size_t)
> ++        count=FormatLocaleString(filename+(p-format-offset),(size_t)
> +           (MagickPathExtent-(p-format-offset)),p,value);
> +-        offset+=(4-field_width);
> ++        if ((count <= 0) || (count > (MagickPathExtent-(p-format-offset))))
> ++          return(0);
> ++        offset+=(ssize_t) ((q-p)-count);
> +         *q=c;
> +         (void) ConcatenateMagickString(filename,q,MagickPathExtent);
> +         canonical=MagickTrue;
> +-- 
> +2.34.1
> +
> diff --git a/meta-oe/recipes-support/imagemagick/files/0011-ImageMagick-Add-support-patch-3-to-fix-CVE-2025-5529.patch b/meta-oe/recipes-support/imagemagick/files/0011-ImageMagick-Add-support-patch-3-to-fix-CVE-2025-5529.patch
> new file mode 100644
> index 0000000000..63e88ebfd9
> --- /dev/null
> +++ b/meta-oe/recipes-support/imagemagick/files/0011-ImageMagick-Add-support-patch-3-to-fix-CVE-2025-5529.patch
> @@ -0,0 +1,205 @@
> +From 19073f73f83c78a1fed8f040ed08b16ccfc817f5 Mon Sep 17 00:00:00 2001
> +From: Divyanshu Rathore <Divyanshu.Rathore@bmwtechworks.in>
> +Date: Tue, 11 Nov 2025 21:53:10 +0530
> +Subject: [PATCH 3/6] ImageMagick: Add support patch-3 to fix CVE-2025-55298
> +
> +Upstream-Status: Backport [https://github.com/ImageMagick/ImageMagick/commit/82550750ec8f79393b381c3ed349dd495bbab8a7]
> +
> +Comment: Refreshed hunk to match latest kirkstone
> +
> +Signed-off-by: Divyanshu Rathore <Divyanshu.Rathore@bmwtechworks.in>
> +---
> + MagickCore/image.c | 134 +++++++++++++++++++--------------------------
> + 1 file changed, 55 insertions(+), 79 deletions(-)
> +
> +diff --git a/MagickCore/image.c b/MagickCore/image.c
> +index 3437ed358..cd4de6df9 100644
> +--- a/MagickCore/image.c
> ++++ b/MagickCore/image.c
> +@@ -1638,34 +1638,41 @@ MagickExport size_t InterpretImageFilename(const ImageInfo *image_info,
> +   ExceptionInfo *exception)
> + {
> +   char
> +-    *q;
> ++    *p = filename,
> ++    pattern[MagickPathExtent];
> + 
> +   const char
> +-    *p;
> +-
> +-  int
> +-    c;
> +-
> +-  MagickBooleanType
> +-    canonical;
> +-
> +-  ssize_t
> +-    offset;
> ++    *cursor = format;
> + 
> +-  canonical=MagickFalse;
> +-  offset=0;
> ++  /*
> ++    Start with a copy of the format string.
> ++  */
> +   (void) CopyMagickString(filename,format,MagickPathExtent);
> +   if (IsStringTrue(GetImageOption(image_info,"filename:literal")) != MagickFalse)
> +     return(strlen(filename));
> +-  for (p=strchr(format,'%'); p != (char *) NULL; p=strchr(p+1,'%'))
> ++  while ((cursor=strchr(cursor,'%')) != (const char *) NULL)
> +   {
> +-    q=(char *) p+1;
> +-    if (*q == '%')
> ++    const char
> ++      *q = cursor;
> ++
> ++    ssize_t
> ++      offset = (ssize_t) (cursor-format);
> ++
> ++    cursor++;  /* move past '%' */
> ++    if (*cursor == '%')
> +       {
> +-        p=q+1;
> ++        /*
> ++          Escaped %%.
> ++        */
> ++        cursor++;
> +         continue;
> +       }
> +-    switch (*q)
> ++    /*
> ++      Skip padding digits like %03d.
> ++    */
> ++    if (*cursor == '0')
> ++      (void) strtol(cursor,(char **) &cursor,10);
> ++    switch (*cursor)
> +     {
> +       case 'd':
> +       case 'o':
> +@@ -1674,93 +1681,62 @@ MagickExport size_t InterpretImageFilename(const ImageInfo *image_info,
> +         ssize_t
> +           count;
> + 
> +-        q++;
> +-        c=(*q);
> +-        *q='\0';
> +-        count=FormatLocaleString(filename+(p-format-offset),(size_t)
> +-          (MagickPathExtent-(p-format-offset)),p,value);
> +-        if ((count <= 0) || (count > (MagickPathExtent-(p-format-offset))))
> ++        count=FormatLocaleString(pattern,sizeof(pattern),q,value);
> ++        if ((count <= 0) || (count >= MagickPathExtent))
> +           return(0);
> +-        offset+=(ssize_t) ((q-p)-count);
> +-        *q=c;
> +-        (void) ConcatenateMagickString(filename,q,MagickPathExtent);
> +-        canonical=MagickTrue;
> +-        if (*(q-1) != '%')
> +-          break;
> +-        p++;
> ++        if ((offset+count) >= MagickPathExtent)
> ++          return(0);
> ++        (void) CopyMagickString(p+offset,pattern,(size_t) (MagickPathExtent-
> ++          offset));
> ++        cursor++;
> +         break;
> +       }
> +       case '[':
> +       {
> +-        char
> +-          pattern[MagickPathExtent];
> +-
> +         const char
> +-          *option;
> ++          *end = strchr(cursor,']'),
> ++          *option = (const char *) NULL;
> + 
> +-        char
> +-          *r;
> +-
> +-        ssize_t
> +-          i;
> +-
> +-        ssize_t
> +-          depth;
> ++        size_t
> ++          extent = (size_t) (end-cursor);
> + 
> +         /*
> +-          Image option.
> ++          Handle %[key:value];
> +         */
> +-        if (strchr(p,']') == (char *) NULL)
> ++        if (end == (const char *) NULL)
> +           break;
> +-        depth=1;
> +-        r=q+1;
> +-        for (i=0; (i < (MagickPathExtent-1L)) && (*r != '\0'); i++)
> +-        {
> +-          if (*r == '[')
> +-            depth++;
> +-          if (*r == ']')
> +-            depth--;
> +-          if (depth <= 0)
> +-            break;
> +-          pattern[i]=(*r++);
> +-        }
> +-        pattern[i]='\0';
> +-        if (LocaleNCompare(pattern,"filename:",9) != 0)
> ++        if (extent >= sizeof(pattern))
> +           break;
> +-        option=(const char *) NULL;
> ++        (void) CopyMagickString(pattern,cursor,extent);
> ++        pattern[extent]='\0';
> +         if (image != (Image *) NULL)
> +           option=GetImageProperty(image,pattern,exception);
> +-        if ((option == (const char *) NULL) && (image != (Image *) NULL))
> ++        if ((option == (const char *) NULL) && (image != (Image *)NULL))
> +           option=GetImageArtifact(image,pattern);
> +         if ((option == (const char *) NULL) &&
> +             (image_info != (ImageInfo *) NULL))
> +           option=GetImageOption(image_info,pattern);
> +         if (option == (const char *) NULL)
> +           break;
> +-        q--;
> +-        c=(*q);
> +-        *q='\0';
> +-        (void) CopyMagickString(filename+(p-format-offset),option,(size_t)
> +-          (MagickPathExtent-(p-format-offset)));
> +-        offset+=strlen(pattern)-strlen(option)+3;
> +-        *q=c;
> +-        (void) ConcatenateMagickString(filename,r+1,MagickPathExtent);
> +-        canonical=MagickTrue;
> +-        if (*(q-1) != '%')
> +-          break;
> +-        p++;
> ++        (void) CopyMagickString(p+offset,option,(size_t) (MagickPathExtent-
> ++          offset));
> ++        cursor=end+1;
> +         break;
> +       }
> +       default:
> +         break;
> +     }
> +   }
> +-  if (canonical == MagickFalse)
> +-    (void) CopyMagickString(filename,format,MagickPathExtent);
> +-  else
> +-    for (q=filename; *q != '\0'; q++)
> +-      if ((*q == '%') && (*(q+1) == '%'))
> +-        (void) CopyMagickString(q,q+1,(size_t) (MagickPathExtent-(q-filename)));
> ++  for (p=filename; *p != '\0'; )
> ++  {
> ++    /*
> ++      Replace "%%" with "%".
> ++    */
> ++    if ((*p == '%') && (*(p+1) == '%'))
> ++      (void) memmove(p,p+1,strlen(p));  /* shift left */
> ++    else
> ++      p++;
> ++  }
> +   return(strlen(filename));
> + }
> + 
> +-- 
> +2.34.1
> +
> diff --git a/meta-oe/recipes-support/imagemagick/files/0011-ImageMagick-Add-support-patch-4-to-fix-CVE-2025-5529.patch b/meta-oe/recipes-support/imagemagick/files/0011-ImageMagick-Add-support-patch-4-to-fix-CVE-2025-5529.patch
> new file mode 100644
> index 0000000000..65739cbf44
> --- /dev/null
> +++ b/meta-oe/recipes-support/imagemagick/files/0011-ImageMagick-Add-support-patch-4-to-fix-CVE-2025-5529.patch
> @@ -0,0 +1,103 @@
> +From 3b5f524f80851b819bcbfd40e30912af3710ef48 Mon Sep 17 00:00:00 2001
> +From: Divyanshu Rathore <Divyanshu.Rathore@bmwtechworks.in>
> +Date: Wed, 12 Nov 2025 11:35:37 +0530
> +Subject: [PATCH 4/6] ImageMagick: Add support patch-4 to fix CVE-2025-55298
> +
> +Upstream-Status: Backport [https://github.com/ImageMagick/ImageMagick/commit/6c7c8d5866b9c0ce6cc76a741e05b9482716101e]
> +
> +Comment: Refreshed hunk to match latest kirkstone
> +
> +Signed-off-by: Divyanshu Rathore <Divyanshu.Rathore@bmwtechworks.in>
> +---
> + MagickCore/image.c | 31 +++++++++++++++++++++----------
> + 1 file changed, 21 insertions(+), 10 deletions(-)
> +
> +diff --git a/MagickCore/image.c b/MagickCore/image.c
> +index cd4de6df9..1acf8edbd 100644
> +--- a/MagickCore/image.c
> ++++ b/MagickCore/image.c
> +@@ -1647,6 +1647,8 @@ MagickExport size_t InterpretImageFilename(const ImageInfo *image_info,
> +   /*
> +     Start with a copy of the format string.
> +   */
> ++  assert(format != (const char *) NULL);
> ++  assert(filename != (char *) NULL);
> +   (void) CopyMagickString(filename,format,MagickPathExtent);
> +   if (IsStringTrue(GetImageOption(image_info,"filename:literal")) != MagickFalse)
> +     return(strlen(filename));
> +@@ -1670,7 +1672,7 @@ MagickExport size_t InterpretImageFilename(const ImageInfo *image_info,
> +     /*
> +       Skip padding digits like %03d.
> +     */
> +-    if (*cursor == '0')
> ++    if (isdigit((int) ((unsigned char) *cursor)) != 0)
> +       (void) strtol(cursor,(char **) &cursor,10);
> +     switch (*cursor)
> +     {
> +@@ -1682,9 +1684,8 @@ MagickExport size_t InterpretImageFilename(const ImageInfo *image_info,
> +           count;
> + 
> +         count=FormatLocaleString(pattern,sizeof(pattern),q,value);
> +-        if ((count <= 0) || (count >= MagickPathExtent))
> +-          return(0);
> +-        if ((offset+count) >= MagickPathExtent)
> ++        if ((count <= 0) || (count >= MagickPathExtent) ||
> ++            ((offset+count) >= MagickPathExtent))
> +           return(0);
> +         (void) CopyMagickString(p+offset,pattern,(size_t) (MagickPathExtent-
> +           offset));
> +@@ -1698,7 +1699,9 @@ MagickExport size_t InterpretImageFilename(const ImageInfo *image_info,
> +           *option = (const char *) NULL;
> + 
> +         size_t
> +-          extent = (size_t) (end-cursor);
> ++          extent = (size_t) (end-cursor-1),
> ++          option_length,
> ++          tail_length;
> + 
> +         /*
> +           Handle %[key:value];
> +@@ -1707,19 +1710,27 @@ MagickExport size_t InterpretImageFilename(const ImageInfo *image_info,
> +           break;
> +         if (extent >= sizeof(pattern))
> +           break;
> +-        (void) CopyMagickString(pattern,cursor,extent);
> ++        (void) CopyMagickString(pattern,cursor+1,extent+1);
> +         pattern[extent]='\0';
> +         if (image != (Image *) NULL)
> +-          option=GetImageProperty(image,pattern,exception);
> +-        if ((option == (const char *) NULL) && (image != (Image *)NULL))
> +-          option=GetImageArtifact(image,pattern);
> ++          {
> ++            option=GetImageProperty(image,pattern,exception);
> ++            if (option == (const char *) NULL)
> ++              option=GetImageArtifact(image,pattern);
> ++          }
> +         if ((option == (const char *) NULL) &&
> +             (image_info != (ImageInfo *) NULL))
> +           option=GetImageOption(image_info,pattern);
> +         if (option == (const char *) NULL)
> +           break;
> ++        option_length=strlen(option);
> ++        tail_length=strlen(end+1);
> ++        if ((offset+option_length+tail_length+1) > MagickPathExtent)
> ++          return(0);
> +         (void) CopyMagickString(p+offset,option,(size_t) (MagickPathExtent-
> +           offset));
> ++        (void) ConcatenateMagickString(p+offset+option_length,end+1,(size_t) (
> ++          MagickPathExtent-offset-option_length-tail_length-1));
> +         cursor=end+1;
> +         break;
> +       }
> +@@ -1733,7 +1744,7 @@ MagickExport size_t InterpretImageFilename(const ImageInfo *image_info,
> +       Replace "%%" with "%".
> +     */
> +     if ((*p == '%') && (*(p+1) == '%'))
> +-      (void) memmove(p,p+1,strlen(p));  /* shift left */
> ++      (void) memmove(p,p+1,strlen(p+1)+1);  /* shift left */
> +     else
> +       p++;
> +   }
> +-- 
> +2.34.1
> +
> diff --git a/meta-oe/recipes-support/imagemagick/files/0011-ImageMagick-Fix-1-CVE-2025-55298.patch b/meta-oe/recipes-support/imagemagick/files/0011-ImageMagick-Fix-1-CVE-2025-55298.patch
> new file mode 100644
> index 0000000000..1a92b36755
> --- /dev/null
> +++ b/meta-oe/recipes-support/imagemagick/files/0011-ImageMagick-Fix-1-CVE-2025-55298.patch
> @@ -0,0 +1,71 @@
> +From bc530e782bcee75960dac57e9191ab7257842bd9 Mon Sep 17 00:00:00 2001
> +From: Divyanshu Rathore <Divyanshu.Rathore@bmwtechworks.in>
> +Date: Wed, 12 Nov 2025 11:52:00 +0530
> +Subject: [PATCH 5/6] ImageMagick: Fix CVE-2025-55298
> +
> +CVE: CVE-2025-55298
> +
> +This CVE fixed in two parts, this commit includes the first fix.
> +
> +Upstream-Status: Backport [https://github.com/ImageMagick/ImageMagick/commit/1f93323df9d8c011c31bc4c6880390071f7fb895]
> +
> +Comment: Refreshed hunk to match latest kirkstone
> +
> +Signed-off-by: Divyanshu Rathore <Divyanshu.Rathore@bmwtechworks.in>
> +---
> + MagickCore/image.c | 32 ++++++++++++++++++++++++++++++++
> + 1 file changed, 32 insertions(+)
> +
> +diff --git a/MagickCore/image.c b/MagickCore/image.c
> +index 1acf8edbd..7a52236d8 100644
> +--- a/MagickCore/image.c
> ++++ b/MagickCore/image.c
> +@@ -1633,6 +1633,31 @@ MagickExport VirtualPixelMethod GetImageVirtualPixelMethod(const Image *image)
> + %    o exception: return any errors or warnings in this structure.
> + %
> + */
> ++
> ++static inline MagickBooleanType PercentNInvalidOperation(char *filename)
> ++{
> ++  MagickBooleanType
> ++    match = MagickFalse;
> ++
> ++  size_t
> ++    length = strlen(filename);
> ++
> ++  ssize_t
> ++    i;
> ++
> ++  for (i=0; i < (ssize_t) length-1; i++)
> ++  {
> ++    if ((filename[i] == '%') &&
> ++        ((filename[i+1] == 'n') || (filename[i+1] == 'N')))
> ++      {
> ++        filename[i]='?';
> ++        filename[i+1]='\?';
> ++        match=MagickTrue;
> ++      }
> ++  }
> ++  return(match);
> ++}
> ++
> + MagickExport size_t InterpretImageFilename(const ImageInfo *image_info,
> +   Image *image,const char *format,int value,char *filename,
> +   ExceptionInfo *exception)
> +@@ -1652,6 +1677,13 @@ MagickExport size_t InterpretImageFilename(const ImageInfo *image_info,
> +   (void) CopyMagickString(filename,format,MagickPathExtent);
> +   if (IsStringTrue(GetImageOption(image_info,"filename:literal")) != MagickFalse)
> +     return(strlen(filename));
> ++  if (PercentNInvalidOperation(filename) != MagickFalse)
> ++    {
> ++      errno=EPERM;
> ++      (void) ThrowMagickException(exception,GetMagickModule(),OptionError,
> ++        "InvalidArgument","`%s'",filename);
> ++      return(0);
> ++    }
> +   while ((cursor=strchr(cursor,'%')) != (const char *) NULL)
> +   {
> +     const char
> +-- 
> +2.34.1
> +
> diff --git a/meta-oe/recipes-support/imagemagick/files/0011-ImageMagick-Fix-2-CVE-2025-55298.patch b/meta-oe/recipes-support/imagemagick/files/0011-ImageMagick-Fix-2-CVE-2025-55298.patch
> new file mode 100644
> index 0000000000..22fafbb4ff
> --- /dev/null
> +++ b/meta-oe/recipes-support/imagemagick/files/0011-ImageMagick-Fix-2-CVE-2025-55298.patch
> @@ -0,0 +1,274 @@
> +From 51bdbd8ba79cc29b5b8bd1cbe201612c4f1b6a14 Mon Sep 17 00:00:00 2001
> +From: Divyanshu Rathore <Divyanshu.Rathore@bmwtechworks.in>
> +Date: Wed, 12 Nov 2025 13:05:40 +0530
> +Subject: [PATCH 6/6] ImageMagick: Fix CVE-2025-55298
> +
> +CVE: CVE-2025-55298
> +
> +This CVE fixed in two parts, this commit includes the second fix.
> +
> +Upstream-Status: Backport [https://github.com/ImageMagick/ImageMagick/commit/439b362b93c074eea6c3f834d84982b43ef057d5]
> +
> +Comment: Refreshed hunk to match latest kirkstone
> +
> +Signed-off-by: Divyanshu Rathore <Divyanshu.Rathore@bmwtechworks.in>
> +---
> + MagickCore/image.c | 182 ++++++++++++++++++++++++---------------------
> + 1 file changed, 96 insertions(+), 86 deletions(-)
> +
> +diff --git a/MagickCore/image.c b/MagickCore/image.c
> +index 7a52236d8..beaf69728 100644
> +--- a/MagickCore/image.c
> ++++ b/MagickCore/image.c
> +@@ -1619,7 +1619,7 @@ MagickExport VirtualPixelMethod GetImageVirtualPixelMethod(const Image *image)
> + %
> + %  A description of each parameter follows.
> + %
> +-%    o image_info: the image info..
> ++%    o image_info: the image info.
> + %
> + %    o image: the image.
> + %
> +@@ -1634,28 +1634,39 @@ MagickExport VirtualPixelMethod GetImageVirtualPixelMethod(const Image *image)
> + %
> + */
> + 
> +-static inline MagickBooleanType PercentNInvalidOperation(char *filename)
> ++static inline MagickBooleanType IsValidFormatSpecifier(const char *start,
> ++  const char *end)
> + {
> +-  MagickBooleanType
> +-    match = MagickFalse;
> ++  char
> ++    specifier = end[-1];
> + 
> +   size_t
> +-    length = strlen(filename);
> ++    length = end-start;
> + 
> +-  ssize_t
> +-    i;
> ++  /*
> ++    Is this a valid format specifier?
> ++  */
> ++  if ((specifier != 'd') && (specifier != 'x') && (specifier != 'o'))
> ++    return(MagickFalse);
> ++  if ((length == 1) && (*start == specifier))
> ++    return(MagickTrue);
> ++  if (length >= 2)
> ++    {
> ++      size_t
> ++        i = 0;
> + 
> +-  for (i=0; i < (ssize_t) length-1; i++)
> +-  {
> +-    if ((filename[i] == '%') &&
> +-        ((filename[i+1] == 'n') || (filename[i+1] == 'N')))
> +-      {
> +-        filename[i]='?';
> +-        filename[i+1]='\?';
> +-        match=MagickTrue;
> +-      }
> +-  }
> +-  return(match);
> ++      if (*start == '0')
> ++        {
> ++          if ((length >= 3) && (start[1] == '0'))
> ++            return(MagickFalse);
> ++          i=1;
> ++        }
> ++      for ( ; i < (length-1); i++)
> ++        if (isdigit((int) ((unsigned char) start[i])) == 0)
> ++          return(MagickFalse);
> ++      return(MagickTrue);
> ++    }
> ++  return(MagickFalse);
> + }
> + 
> + MagickExport size_t InterpretImageFilename(const ImageInfo *image_info,
> +@@ -1669,82 +1680,89 @@ MagickExport size_t InterpretImageFilename(const ImageInfo *image_info,
> +   const char
> +     *cursor = format;
> + 
> +-  /*
> +-    Start with a copy of the format string.
> +-  */
> +   assert(format != (const char *) NULL);
> +   assert(filename != (char *) NULL);
> +-  (void) CopyMagickString(filename,format,MagickPathExtent);
> +   if (IsStringTrue(GetImageOption(image_info,"filename:literal")) != MagickFalse)
> +-    return(strlen(filename));
> +-  if (PercentNInvalidOperation(filename) != MagickFalse)
> +     {
> +-      errno=EPERM;
> +-      (void) ThrowMagickException(exception,GetMagickModule(),OptionError,
> +-        "InvalidArgument","`%s'",filename);
> +-      return(0);
> ++      (void) CopyMagickString(filename,format,MagickPathExtent);
> ++      return(strlen(filename));
> +     }
> +-  while ((cursor=strchr(cursor,'%')) != (const char *) NULL)
> ++  while ((*cursor != '\0') && ((p-filename) < ((ssize_t) MagickPathExtent-1)))
> +   {
> +     const char
> +-      *q = cursor;
> +-
> +-    ssize_t
> +-      offset = (ssize_t) (cursor-format);
> ++      *specifier_start,
> ++      *start;
> + 
> +-    cursor++;  /* move past '%' */
> ++    if (*cursor != '%')
> ++      {
> ++        *p++=(*cursor++);
> ++        continue;
> ++      }
> ++    start=cursor++;  /* Skip '%' */
> +     if (*cursor == '%')
> +       {
> +-        /*
> +-          Escaped %%.
> +-        */
> ++        *p++='%';
> +         cursor++;
> +         continue;
> +       }
> +-    /*
> +-      Skip padding digits like %03d.
> +-    */
> +-    if (isdigit((int) ((unsigned char) *cursor)) != 0)
> +-      (void) strtol(cursor,(char **) &cursor,10);
> +-    switch (*cursor)
> +-    {
> +-      case 'd':
> +-      case 'o':
> +-      case 'x':
> ++    specifier_start=cursor;
> ++    while (isdigit((int) ((unsigned char) *cursor)) != 0)
> ++      cursor++;
> ++    if ((*cursor == 'd') || (*cursor == 'o') || (*cursor == 'x'))
> +       {
> +-        ssize_t
> +-          count;
> ++        const char
> ++          *specifier_end = cursor+1;
> + 
> +-        count=FormatLocaleString(pattern,sizeof(pattern),q,value);
> +-        if ((count <= 0) || (count >= MagickPathExtent) ||
> +-            ((offset+count) >= MagickPathExtent))
> +-          return(0);
> +-        (void) CopyMagickString(p+offset,pattern,(size_t) (MagickPathExtent-
> +-          offset));
> +-        cursor++;
> +-        break;
> ++        if (IsValidFormatSpecifier(specifier_start,specifier_end) != MagickFalse)
> ++          {
> ++            char
> ++              format_specifier[MagickPathExtent];
> ++
> ++            size_t
> ++              length = cursor-specifier_start;
> ++
> ++            ssize_t
> ++              count;
> ++
> ++            (void) snprintf(format_specifier,sizeof(format_specifier),
> ++              "%%%.*s%c",(int) length,specifier_start,*cursor);
> ++            count=FormatLocaleString(pattern,sizeof(pattern),format_specifier,
> ++              value);
> ++            if ((count <= 0) || ((p-filename+count) >= MagickPathExtent))
> ++              return(0);
> ++            (void) CopyMagickString(p,pattern,MagickPathExtent-(p-filename));
> ++            p+=strlen(pattern);
> ++            cursor++;
> ++            continue;
> ++          }
> ++        else
> ++          {
> ++            /*
> ++              Invalid specifier — treat as literal.
> ++            */
> ++            cursor=start;
> ++            *p++=(*cursor++);
> ++            continue;
> ++          }
> +       }
> +-      case '[':
> ++    if (*cursor == '[')
> +       {
> +         const char
> +           *end = strchr(cursor,']'),
> +           *option = (const char *) NULL;
> + 
> +         size_t
> +-          extent = (size_t) (end-cursor-1),
> +-          option_length,
> +-          tail_length;
> ++          extent,
> ++          option_length;
> + 
> +-        /*
> +-          Handle %[key:value];
> +-        */
> +         if (end == (const char *) NULL)
> +-          break;
> ++          continue;
> ++        extent=(size_t) (end-cursor-1);
> +         if (extent >= sizeof(pattern))
> +-          break;
> ++          continue;
> +         (void) CopyMagickString(pattern,cursor+1,extent+1);
> +         pattern[extent]='\0';
> +-        if (image != (Image *) NULL)
> ++        if (image != NULL)
> +           {
> +             option=GetImageProperty(image,pattern,exception);
> +             if (option == (const char *) NULL)
> +@@ -1754,32 +1772,24 @@ MagickExport size_t InterpretImageFilename(const ImageInfo *image_info,
> +             (image_info != (ImageInfo *) NULL))
> +           option=GetImageOption(image_info,pattern);
> +         if (option == (const char *) NULL)
> +-          break;
> ++          continue;
> +         option_length=strlen(option);
> +-        tail_length=strlen(end+1);
> +-        if ((offset+option_length+tail_length+1) > MagickPathExtent)
> ++        if ((p-filename+option_length) >= MagickPathExtent)
> +           return(0);
> +-        (void) CopyMagickString(p+offset,option,(size_t) (MagickPathExtent-
> +-          offset));
> +-        (void) ConcatenateMagickString(p+offset+option_length,end+1,(size_t) (
> +-          MagickPathExtent-offset-option_length-tail_length-1));
> ++        (void) CopyMagickString(p,option,MagickPathExtent-(p-filename));
> ++        p+=option_length;
> +         cursor=end+1;
> +-        break;
> ++        continue;
> +       }
> +-      default:
> +-        break;
> +-    }
> +-  }
> +-  for (p=filename; *p != '\0'; )
> +-  {
> +     /*
> +-      Replace "%%" with "%".
> ++      Invalid or unsupported specifier — treat as literal.
> +     */
> +-    if ((*p == '%') && (*(p+1) == '%'))
> +-      (void) memmove(p,p+1,strlen(p+1)+1);  /* shift left */
> +-    else
> +-      p++;
> ++    cursor=start;
> ++    if ((p-filename+1) >= MagickPathExtent)
> ++      return(0);
> ++    *p++=(*cursor++);
> +   }
> ++  *p='\0';
> +   return(strlen(filename));
> + }
> + 
> +-- 
> +2.34.1
> +
> diff --git a/meta-oe/recipes-support/imagemagick/imagemagick_7.0.10.bb b/meta-oe/recipes-support/imagemagick/imagemagick_7.0.10.bb
> index af0a3149e3..d929a220f1 100644
> --- a/meta-oe/recipes-support/imagemagick/imagemagick_7.0.10.bb
> +++ b/meta-oe/recipes-support/imagemagick/imagemagick_7.0.10.bb
> @@ -33,6 +33,12 @@ SRC_URI = "git://github.com/ImageMagick/ImageMagick.git;branch=main;protocol=htt
>      file://0008-ImageMagick-Fix-CVE-2025-57807.patch \
>      file://0009-ImageMagick-Fix-CVE-2023-34151.patch \
>      file://0010-ImageMagick-Fix-CVE-2025-55154.patch \
> +    file://0011-ImageMagick-Add-support-patch-1-to-fix-CVE-2025-5529.patch \
> +    file://0011-ImageMagick-Add-support-patch-2-to-fix-CVE-2025-5529.patch \
> +    file://0011-ImageMagick-Add-support-patch-3-to-fix-CVE-2025-5529.patch \
> +    file://0011-ImageMagick-Add-support-patch-4-to-fix-CVE-2025-5529.patch \
> +    file://0011-ImageMagick-Fix-1-CVE-2025-55298.patch \
> +    file://0011-ImageMagick-Fix-2-CVE-2025-55298.patch \
>  "
>  
>  SRCREV = "35b4991eb0939a327f3489988c366e21068b0178"
>
> -=-=-=-=-=-=-=-=-=-=-=-
> Links: You receive all messages sent to this group.
> View/Reply Online (#121947): https://lists.openembedded.org/g/openembedded-devel/message/121947
> Mute This Topic: https://lists.openembedded.org/mt/116392327/6084445
> Group Owner: openembedded-devel+owner@lists.openembedded.org
> Unsubscribe: https://lists.openembedded.org/g/openembedded-devel/unsub [skandigraun@gmail.com]
> -=-=-=-=-=-=-=-=-=-=-=-
>