[meta-oe,whinlatter,04/11] imagemagick: patch CVE-2026-25576

Message ID	20260306150602.616834-4-skandigraun@gmail.com
State	New
Headers	show Return-Path: <skandigraun@gmail.com> ip: 209.85.128.54, mailfrom: skandigraun@gmail.com) From: Gyorgy Sarvari <skandigraun@gmail.com> To: openembedded-devel@lists.openembedded.org Subject: [meta-oe][whinlatter][PATCH 04/11] imagemagick: patch CVE-2026-25576 Date: Fri, 6 Mar 2026 16:05:55 +0100 Message-ID: <20260306150602.616834-4-skandigraun@gmail.com> In-Reply-To: <20260306150602.616834-1-skandigraun@gmail.com> References: <20260306150602.616834-1-skandigraun@gmail.com> MIME-Version: 1.0 Content-Transfer-Encoding: 8bit
Series	[meta-oe,whinlatter,01/11] imagemagick: patch CVE-2026-24481 \| expand [meta-oe,whinlatter,01/11] imagemagick: patch CVE-2026-24481 [meta-oe,whinlatter,02/11] imagemagick: patch CVE-2026-24484 [meta-oe,whinlatter,03/11] imagemagick: patch CVE-2026-24485 [meta-oe,whinlatter,04/11] imagemagick: patch CVE-2026-25576 [meta-oe,whinlatter,05/11] imagemagick: patch CVE-2026-25637 [meta-oe,whinlatter,06/11] imagemagick: patch CVE-2026-25638 [meta-oe,whinlatter,07/11] imagemagick: patch CVE-2026-25794 [meta-oe,whinlatter,08/11] imagemagick: patch CVE-2026-25795 [meta-oe,whinlatter,09/11] imagemagick: patch CVE-2026-25796 [meta-oe,whinlatter,10/11] imagemagick: patch CVE-2026-25797 [meta-oe,whinlatter,11/11] imagemagick: patch CVE-2026-25798

diff --git a/meta-oe/recipes-support/imagemagick/imagemagick/CVE-2026-25576.patch b/meta-oe/recipes-support/imagemagick/imagemagick/CVE-2026-25576.patch new file mode 100644 index 0000000000..87003f503e --- /dev/null +++ b/meta-oe/recipes-support/imagemagick/imagemagick/CVE-2026-25576.patch @@ -0,0 +1,604 @@ +From 5b9798eeef019d2f9c6f120fbc173ffd872a7cf7 Mon Sep 17 00:00:00 2001 +From: Dirk Lemstra <dirk@lemstra.org> +Date: Sun, 25 Jan 2026 19:21:20 +0100 +Subject: [PATCH] Fixed out of bounds read in multiple coders that read raw + pixel data (GHSA-jv4p-gjwq-9r2j) + +CVE: CVE-2026-25576 +Upstream-Status: Backport [https://github.com/ImageMagick/ImageMagick/commit/077b42643212d7da8c1a4f6b2cd0067ebca8ec0f] +Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com> +--- + coders/bgr.c | 22 ++++++++++++---------- + coders/cmyk.c | 26 ++++++++++++++------------ + coders/gray.c | 14 ++++++++------ + coders/raw.c | 4 +++- + coders/rgb.c | 26 +++++++++++++++----------- + coders/ycbcr.c | 22 ++++++++++++---------- + 6 files changed, 64 insertions(+), 50 deletions(-) + +diff --git a/coders/bgr.c b/coders/bgr.c +index 822653543..4b4939054 100644 +--- a/coders/bgr.c ++++ b/coders/bgr.c +@@ -125,6 +125,7 @@ static Image *ReadBGRImage(const ImageInfo *image_info,ExceptionInfo *exception) + length; + + ssize_t ++ columns, + count, + y; + +@@ -203,6 +204,7 @@ static Image *ReadBGRImage(const ImageInfo *image_info,ExceptionInfo *exception) + scene=0; + status=MagickTrue; + stream=NULL; ++ columns=(ssize_t) MagickMin(image->columns,canvas_image->columns); + do + { + /* +@@ -264,7 +266,7 @@ static Image *ReadBGRImage(const ImageInfo *image_info,ExceptionInfo *exception) + if ((p == (const Quantum *) NULL) || + (q == (Quantum *) NULL)) + break; +- for (x=0; x < (ssize_t) image->columns; x++) ++ for (x=0; x < columns; x++) + { + SetPixelRed(image,GetPixelRed(canvas_image,p),q); + SetPixelGreen(image,GetPixelGreen(canvas_image,p),q); +@@ -347,7 +349,7 @@ static Image *ReadBGRImage(const ImageInfo *image_info,ExceptionInfo *exception) + if ((p == (const Quantum *) NULL) || + (q == (Quantum *) NULL)) + break; +- for (x=0; x < (ssize_t) image->columns; x++) ++ for (x=0; x < columns; x++) + { + switch (quantum_type) + { +@@ -443,7 +445,7 @@ static Image *ReadBGRImage(const ImageInfo *image_info,ExceptionInfo *exception) + if ((p == (const Quantum *) NULL) || + (q == (Quantum *) NULL)) + break; +- for (x=0; x < (ssize_t) image->columns; x++) ++ for (x=0; x < columns; x++) + { + SetPixelRed(image,GetPixelRed(canvas_image,p),q); + p+=(ptrdiff_t) GetPixelChannels(canvas_image); +@@ -496,7 +498,7 @@ static Image *ReadBGRImage(const ImageInfo *image_info,ExceptionInfo *exception) + if ((p == (const Quantum *) NULL) || + (q == (Quantum *) NULL)) + break; +- for (x=0; x < (ssize_t) image->columns; x++) ++ for (x=0; x < columns; x++) + { + SetPixelGreen(image,GetPixelGreen(canvas_image,p),q); + p+=(ptrdiff_t) GetPixelChannels(canvas_image); +@@ -549,7 +551,7 @@ static Image *ReadBGRImage(const ImageInfo *image_info,ExceptionInfo *exception) + if ((p == (const Quantum *) NULL) || + (q == (Quantum *) NULL)) + break; +- for (x=0; x < (ssize_t) image->columns; x++) ++ for (x=0; x < columns; x++) + { + SetPixelBlue(image,GetPixelBlue(canvas_image,p),q); + p+=(ptrdiff_t) GetPixelChannels(canvas_image); +@@ -611,7 +613,7 @@ static Image *ReadBGRImage(const ImageInfo *image_info,ExceptionInfo *exception) + if ((p == (const Quantum *) NULL) || + (q == (Quantum *) NULL)) + break; +- for (x=0; x < (ssize_t) image->columns; x++) ++ for (x=0; x < columns; x++) + { + SetPixelAlpha(image,GetPixelAlpha(canvas_image,p),q); + p+=(ptrdiff_t) GetPixelChannels(canvas_image); +@@ -702,7 +704,7 @@ static Image *ReadBGRImage(const ImageInfo *image_info,ExceptionInfo *exception) + if ((p == (const Quantum *) NULL) || + (q == (Quantum *) NULL)) + break; +- for (x=0; x < (ssize_t) image->columns; x++) ++ for (x=0; x < columns; x++) + { + SetPixelRed(image,GetPixelRed(canvas_image,p),q); + p+=(ptrdiff_t) GetPixelChannels(canvas_image); +@@ -774,7 +776,7 @@ static Image *ReadBGRImage(const ImageInfo *image_info,ExceptionInfo *exception) + if ((p == (const Quantum *) NULL) || + (q == (Quantum *) NULL)) + break; +- for (x=0; x < (ssize_t) image->columns; x++) ++ for (x=0; x < columns; x++) + { + SetPixelGreen(image,GetPixelGreen(canvas_image,p),q); + p+=(ptrdiff_t) GetPixelChannels(canvas_image); +@@ -846,7 +848,7 @@ static Image *ReadBGRImage(const ImageInfo *image_info,ExceptionInfo *exception) + if ((p == (const Quantum *) NULL) || + (q == (Quantum *) NULL)) + break; +- for (x=0; x < (ssize_t) image->columns; x++) ++ for (x=0; x < columns; x++) + { + SetPixelBlue(image,GetPixelBlue(canvas_image,p),q); + p+=(ptrdiff_t) GetPixelChannels(canvas_image); +@@ -920,7 +922,7 @@ static Image *ReadBGRImage(const ImageInfo *image_info,ExceptionInfo *exception) + if ((p == (const Quantum *) NULL) || + (q == (Quantum *) NULL)) + break; +- for (x=0; x < (ssize_t) image->columns; x++) ++ for (x=0; x < columns; x++) + { + SetPixelAlpha(image,GetPixelAlpha(canvas_image,p),q); + p+=(ptrdiff_t) GetPixelChannels(canvas_image); +diff --git a/coders/cmyk.c b/coders/cmyk.c +index 03f193ef4..3929bad95 100644 +--- a/coders/cmyk.c ++++ b/coders/cmyk.c +@@ -125,6 +125,7 @@ static Image *ReadCMYKImage(const ImageInfo *image_info, + length; + + ssize_t ++ columns, + count, + y; + +@@ -202,6 +203,7 @@ static Image *ReadCMYKImage(const ImageInfo *image_info, + scene=0; + status=MagickTrue; + stream=NULL; ++ columns=(ssize_t) MagickMin(image->columns,canvas_image->columns); + do + { + /* +@@ -264,7 +266,7 @@ static Image *ReadCMYKImage(const ImageInfo *image_info, + image->columns,1,exception); + if ((p == (const Quantum *) NULL) || (q == (Quantum *) NULL)) + break; +- for (x=0; x < (ssize_t) image->columns; x++) ++ for (x=0; x < columns; x++) + { + SetPixelRed(image,GetPixelRed(canvas_image,p),q); + SetPixelGreen(image,GetPixelGreen(canvas_image,p),q); +@@ -348,7 +350,7 @@ static Image *ReadCMYKImage(const ImageInfo *image_info, + image->columns,1,exception); + if ((p == (const Quantum *) NULL) || (q == (Quantum *) NULL)) + break; +- for (x=0; x < (ssize_t) image->columns; x++) ++ for (x=0; x < columns; x++) + { + switch (quantum_type) + { +@@ -443,7 +445,7 @@ static Image *ReadCMYKImage(const ImageInfo *image_info, + image->columns,1,exception); + if ((p == (const Quantum *) NULL) || (q == (Quantum *) NULL)) + break; +- for (x=0; x < (ssize_t) image->columns; x++) ++ for (x=0; x < columns; x++) + { + SetPixelRed(image,GetPixelRed(canvas_image,p),q); + p+=(ptrdiff_t) GetPixelChannels(canvas_image); +@@ -495,7 +497,7 @@ static Image *ReadCMYKImage(const ImageInfo *image_info, + image->columns,1,exception); + if ((p == (const Quantum *) NULL) || (q == (Quantum *) NULL)) + break; +- for (x=0; x < (ssize_t) image->columns; x++) ++ for (x=0; x < columns; x++) + { + SetPixelGreen(image,GetPixelGreen(canvas_image,p),q); + p+=(ptrdiff_t) GetPixelChannels(canvas_image); +@@ -547,7 +549,7 @@ static Image *ReadCMYKImage(const ImageInfo *image_info, + image->columns,1,exception); + if ((p == (const Quantum *) NULL) || (q == (Quantum *) NULL)) + break; +- for (x=0; x < (ssize_t) image->columns; x++) ++ for (x=0; x < columns; x++) + { + SetPixelBlue(image,GetPixelBlue(canvas_image,p),q); + p+=(ptrdiff_t) GetPixelChannels(canvas_image); +@@ -599,7 +601,7 @@ static Image *ReadCMYKImage(const ImageInfo *image_info, + image->columns,1,exception); + if ((p == (const Quantum *) NULL) || (q == (Quantum *) NULL)) + break; +- for (x=0; x < (ssize_t) image->columns; x++) ++ for (x=0; x < columns; x++) + { + SetPixelBlack(image,GetPixelBlack(canvas_image,p),q); + p+=(ptrdiff_t) GetPixelChannels(canvas_image); +@@ -654,7 +656,7 @@ static Image *ReadCMYKImage(const ImageInfo *image_info, + image->columns,1,exception); + if ((p == (const Quantum *) NULL) || (q == (Quantum *) NULL)) + break; +- for (x=0; x < (ssize_t) image->columns; x++) ++ for (x=0; x < columns; x++) + { + SetPixelAlpha(image,GetPixelAlpha(canvas_image,p),q); + p+=(ptrdiff_t) GetPixelChannels(canvas_image); +@@ -744,7 +746,7 @@ static Image *ReadCMYKImage(const ImageInfo *image_info, + image->columns,1,exception); + if ((p == (const Quantum *) NULL) || (q == (Quantum *) NULL)) + break; +- for (x=0; x < (ssize_t) image->columns; x++) ++ for (x=0; x < columns; x++) + { + SetPixelRed(image,GetPixelRed(canvas_image,p),q); + p+=(ptrdiff_t) GetPixelChannels(canvas_image); +@@ -815,7 +817,7 @@ static Image *ReadCMYKImage(const ImageInfo *image_info, + image->columns,1,exception); + if ((p == (const Quantum *) NULL) || (q == (Quantum *) NULL)) + break; +- for (x=0; x < (ssize_t) image->columns; x++) ++ for (x=0; x < columns; x++) + { + SetPixelGreen(image,GetPixelGreen(canvas_image,p),q); + p+=(ptrdiff_t) GetPixelChannels(canvas_image); +@@ -887,7 +889,7 @@ static Image *ReadCMYKImage(const ImageInfo *image_info, + if ((p == (const Quantum *) NULL) || + (q == (Quantum *) NULL)) + break; +- for (x=0; x < (ssize_t) image->columns; x++) ++ for (x=0; x < columns; x++) + { + SetPixelBlue(image,GetPixelBlue(canvas_image,p),q); + p+=(ptrdiff_t) GetPixelChannels(canvas_image); +@@ -959,7 +961,7 @@ static Image *ReadCMYKImage(const ImageInfo *image_info, + if ((p == (const Quantum *) NULL) || + (q == (Quantum *) NULL)) + break; +- for (x=0; x < (ssize_t) image->columns; x++) ++ for (x=0; x < columns; x++) + { + SetPixelBlack(image,GetPixelBlack(canvas_image,p),q); + p+=(ptrdiff_t) GetPixelChannels(canvas_image); +@@ -1033,7 +1035,7 @@ static Image *ReadCMYKImage(const ImageInfo *image_info, + if ((p == (const Quantum *) NULL) || + (q == (Quantum *) NULL)) + break; +- for (x=0; x < (ssize_t) image->columns; x++) ++ for (x=0; x < columns; x++) + { + SetPixelAlpha(image,GetPixelAlpha(canvas_image,p),q); + p+=(ptrdiff_t) GetPixelChannels(canvas_image); +diff --git a/coders/gray.c b/coders/gray.c +index 14bdaf034..fc06b77f2 100644 +--- a/coders/gray.c ++++ b/coders/gray.c +@@ -126,6 +126,7 @@ static Image *ReadGRAYImage(const ImageInfo *image_info, + length; + + ssize_t ++ columns, + count, + y; + +@@ -203,6 +204,7 @@ static Image *ReadGRAYImage(const ImageInfo *image_info, + scene=0; + status=MagickTrue; + stream=NULL; ++ columns=(ssize_t) MagickMin(image->columns,canvas_image->columns); + do + { + /* +@@ -263,7 +265,7 @@ static Image *ReadGRAYImage(const ImageInfo *image_info, + image->columns,1,exception); + if ((p == (const Quantum *) NULL) || (q == (Quantum *) NULL)) + break; +- for (x=0; x < (ssize_t) image->columns; x++) ++ for (x=0; x < columns; x++) + { + SetPixelRed(image,GetPixelRed(canvas_image,p),q); + SetPixelGreen(image,GetPixelGreen(canvas_image,p),q); +@@ -343,7 +345,7 @@ static Image *ReadGRAYImage(const ImageInfo *image_info, + image->columns,1,exception); + if ((p == (const Quantum *) NULL) || (q == (Quantum *) NULL)) + break; +- for (x=0; x < (ssize_t) image->columns; x++) ++ for (x=0; x < columns; x++) + { + switch (quantum_type) + { +@@ -423,7 +425,7 @@ static Image *ReadGRAYImage(const ImageInfo *image_info, + image->columns,1,exception); + if ((p == (const Quantum *) NULL) || (q == (Quantum *) NULL)) + break; +- for (x=0; x < (ssize_t) image->columns; x++) ++ for (x=0; x < columns; x++) + { + SetPixelGray(image,GetPixelGray(canvas_image,p),q); + p+=(ptrdiff_t) GetPixelChannels(canvas_image); +@@ -478,7 +480,7 @@ static Image *ReadGRAYImage(const ImageInfo *image_info, + image->columns,1,exception); + if ((p == (const Quantum *) NULL) || (q == (Quantum *) NULL)) + break; +- for (x=0; x < (ssize_t) image->columns; x++) ++ for (x=0; x < columns; x++) + { + SetPixelAlpha(image,GetPixelAlpha(canvas_image,p),q); + p+=(ptrdiff_t) GetPixelChannels(canvas_image); +@@ -568,7 +570,7 @@ static Image *ReadGRAYImage(const ImageInfo *image_info, + image->columns,1,exception); + if ((p == (const Quantum *) NULL) || (q == (Quantum *) NULL)) + break; +- for (x=0; x < (ssize_t) image->columns; x++) ++ for (x=0; x < columns; x++) + { + SetPixelRed(image,GetPixelRed(canvas_image,p),q); + p+=(ptrdiff_t) GetPixelChannels(canvas_image); +@@ -642,7 +644,7 @@ static Image *ReadGRAYImage(const ImageInfo *image_info, + image->columns,1,exception); + if ((p == (const Quantum *) NULL) || (q == (Quantum *) NULL)) + break; +- for (x=0; x < (ssize_t) image->columns; x++) ++ for (x=0; x < columns; x++) + { + SetPixelAlpha(image,GetPixelAlpha(canvas_image,p),q); + p+=(ptrdiff_t) GetPixelChannels(canvas_image); +diff --git a/coders/raw.c b/coders/raw.c +index c7abd8798..ec3f6fb4b 100644 +--- a/coders/raw.c ++++ b/coders/raw.c +@@ -119,6 +119,7 @@ static Image *ReadRAWImage(const ImageInfo *image_info,ExceptionInfo *exception) + length; + + ssize_t ++ columns, + count, + y; + +@@ -187,6 +188,7 @@ static Image *ReadRAWImage(const ImageInfo *image_info,ExceptionInfo *exception) + length=0; + status=MagickTrue; + stream=NULL; ++ columns=(ssize_t) MagickMin(image->columns,canvas_image->columns); + do + { + /* +@@ -239,7 +241,7 @@ static Image *ReadRAWImage(const ImageInfo *image_info,ExceptionInfo *exception) + 1,exception); + if ((p == (const Quantum *) NULL) || (q == (Quantum *) NULL)) + break; +- for (x=0; x < (ssize_t) image->columns; x++) ++ for (x=0; x < columns; x++) + { + SetPixelRed(image,GetPixelRed(canvas_image,p),q); + SetPixelGreen(image,GetPixelGreen(canvas_image,p),q); +diff --git a/coders/rgb.c b/coders/rgb.c +index 80b0f2d0f..a0c95fa2e 100644 +--- a/coders/rgb.c ++++ b/coders/rgb.c +@@ -126,6 +126,7 @@ static Image *ReadRGBImage(const ImageInfo *image_info,ExceptionInfo *exception) + + ssize_t + count, ++ columns, + y; + + unsigned char +@@ -206,6 +207,7 @@ static Image *ReadRGBImage(const ImageInfo *image_info,ExceptionInfo *exception) + scene=0; + status=MagickTrue; + stream=NULL; ++ columns=(ssize_t) MagickMin(image->columns,canvas_image->columns); + do + { + /* +@@ -266,7 +268,7 @@ static Image *ReadRGBImage(const ImageInfo *image_info,ExceptionInfo *exception) + image->columns,1,exception); + if ((p == (const Quantum *) NULL) || (q == (Quantum *) NULL)) + break; +- for (x=0; x < (ssize_t) image->columns; x++) ++ for (x=0; x < columns; x++) + { + SetPixelRed(image,GetPixelRed(canvas_image,p),q); + SetPixelGreen(image,GetPixelGreen(canvas_image,p),q); +@@ -350,7 +352,7 @@ static Image *ReadRGBImage(const ImageInfo *image_info,ExceptionInfo *exception) + image->columns,1,exception); + if ((p == (const Quantum *) NULL) || (q == (Quantum *) NULL)) + break; +- for (x=0; x < (ssize_t) image->columns; x++) ++ for (x=0; x < columns; x++) + { + switch (quantum_type) + { +@@ -445,7 +447,7 @@ static Image *ReadRGBImage(const ImageInfo *image_info,ExceptionInfo *exception) + image->columns,1,exception); + if ((p == (const Quantum *) NULL) || (q == (Quantum *) NULL)) + break; +- for (x=0; x < (ssize_t) image->columns; x++) ++ for (x=0; x < columns; x++) + { + SetPixelRed(image,GetPixelRed(canvas_image,p),q); + p+=(ptrdiff_t) GetPixelChannels(canvas_image); +@@ -497,7 +499,7 @@ static Image *ReadRGBImage(const ImageInfo *image_info,ExceptionInfo *exception) + image->columns,1,exception); + if ((p == (const Quantum *) NULL) || (q == (Quantum *) NULL)) + break; +- for (x=0; x < (ssize_t) image->columns; x++) ++ for (x=0; x < columns; x++) + { + SetPixelGreen(image,GetPixelGreen(canvas_image,p),q); + p+=(ptrdiff_t) GetPixelChannels(canvas_image); +@@ -549,7 +551,7 @@ static Image *ReadRGBImage(const ImageInfo *image_info,ExceptionInfo *exception) + image->columns,1,exception); + if ((p == (const Quantum *) NULL) || (q == (Quantum *) NULL)) + break; +- for (x=0; x < (ssize_t) image->columns; x++) ++ for (x=0; x < columns; x++) + { + SetPixelBlue(image,GetPixelBlue(canvas_image,p),q); + p+=(ptrdiff_t) GetPixelChannels(canvas_image); +@@ -603,7 +605,7 @@ static Image *ReadRGBImage(const ImageInfo *image_info,ExceptionInfo *exception) + image->columns,1,exception); + if ((p == (const Quantum *) NULL) || (q == (Quantum *) NULL)) + break; +- for (x=0; x < (ssize_t) image->columns; x++) ++ for (x=0; x < columns; x++) + { + SetPixelAlpha(image,GetPixelAlpha(canvas_image,p),q); + p+=(ptrdiff_t) GetPixelChannels(canvas_image); +@@ -693,7 +695,7 @@ static Image *ReadRGBImage(const ImageInfo *image_info,ExceptionInfo *exception) + image->columns,1,exception); + if ((p == (const Quantum *) NULL) || (q == (Quantum *) NULL)) + break; +- for (x=0; x < (ssize_t) image->columns; x++) ++ for (x=0; x < columns; x++) + { + SetPixelRed(image,GetPixelRed(canvas_image,p),q); + p+=(ptrdiff_t) GetPixelChannels(canvas_image); +@@ -764,7 +766,7 @@ static Image *ReadRGBImage(const ImageInfo *image_info,ExceptionInfo *exception) + image->columns,1,exception); + if ((p == (const Quantum *) NULL) || (q == (Quantum *) NULL)) + break; +- for (x=0; x < (ssize_t) image->columns; x++) ++ for (x=0; x < columns; x++) + { + SetPixelGreen(image,GetPixelGreen(canvas_image,p),q); + p+=(ptrdiff_t) GetPixelChannels(canvas_image); +@@ -835,7 +837,7 @@ static Image *ReadRGBImage(const ImageInfo *image_info,ExceptionInfo *exception) + image->columns,1,exception); + if ((p == (const Quantum *) NULL) || (q == (Quantum *) NULL)) + break; +- for (x=0; x < (ssize_t) image->columns; x++) ++ for (x=0; x < columns; x++) + { + SetPixelBlue(image,GetPixelBlue(canvas_image,p),q); + p+=(ptrdiff_t) GetPixelChannels(canvas_image); +@@ -908,7 +910,7 @@ static Image *ReadRGBImage(const ImageInfo *image_info,ExceptionInfo *exception) + image->columns,1,exception); + if ((p == (const Quantum *) NULL) || (q == (Quantum *) NULL)) + break; +- for (x=0; x < (ssize_t) image->columns; x++) ++ for (x=0; x < columns; x++) + { + SetPixelAlpha(image,GetPixelAlpha(canvas_image,p),q); + p+=(ptrdiff_t) GetPixelChannels(canvas_image); +@@ -1025,6 +1027,7 @@ static Image *ReadRGB565Image(const ImageInfo *image_info, + length; + + ssize_t ++ columns, + count, + y; + +@@ -1097,6 +1100,7 @@ static Image *ReadRGB565Image(const ImageInfo *image_info, + scene=0; + status=MagickTrue; + stream=NULL; ++ columns=(ssize_t) MagickMin(image->columns,canvas_image->columns); + do + { + /* +@@ -1150,7 +1154,7 @@ static Image *ReadRGB565Image(const ImageInfo *image_info, + image->columns,1,exception); + if ((p == (const Quantum *) NULL) || (q == (Quantum *) NULL)) + break; +- for (x=0; x < (ssize_t) image->columns; x++) ++ for (x=0; x < columns; x++) + { + unsigned short + pixel; +diff --git a/coders/ycbcr.c b/coders/ycbcr.c +index 00caf73a3..7f5cee14d 100644 +--- a/coders/ycbcr.c ++++ b/coders/ycbcr.c +@@ -125,6 +125,7 @@ static Image *ReadYCBCRImage(const ImageInfo *image_info, + length; + + ssize_t ++ columns, + count, + y; + +@@ -202,6 +203,7 @@ static Image *ReadYCBCRImage(const ImageInfo *image_info, + scene=0; + status=MagickTrue; + stream=NULL; ++ columns=(ssize_t) MagickMin(image->columns,canvas_image->columns); + do + { + /* +@@ -264,7 +266,7 @@ static Image *ReadYCBCRImage(const ImageInfo *image_info, + image->columns,1,exception); + if ((p == (const Quantum *) NULL) || (q == (Quantum *) NULL)) + break; +- for (x=0; x < (ssize_t) image->columns; x++) ++ for (x=0; x < columns; x++) + { + SetPixelRed(image,GetPixelRed(canvas_image,p),q); + SetPixelGreen(image,GetPixelGreen(canvas_image,p),q); +@@ -346,7 +348,7 @@ static Image *ReadYCBCRImage(const ImageInfo *image_info, + image->columns,1,exception); + if ((p == (const Quantum *) NULL) || (q == (Quantum *) NULL)) + break; +- for (x=0; x < (ssize_t) image->columns; x++) ++ for (x=0; x < columns; x++) + { + switch (quantum_type) + { +@@ -436,7 +438,7 @@ static Image *ReadYCBCRImage(const ImageInfo *image_info, + image->columns,1,exception); + if ((p == (const Quantum *) NULL) || (q == (Quantum *) NULL)) + break; +- for (x=0; x < (ssize_t) image->columns; x++) ++ for (x=0; x < columns; x++) + { + SetPixelRed(image,GetPixelRed(canvas_image,p),q); + p+=(ptrdiff_t) GetPixelChannels(canvas_image); +@@ -488,7 +490,7 @@ static Image *ReadYCBCRImage(const ImageInfo *image_info, + image->columns,1,exception); + if ((p == (const Quantum *) NULL) || (q == (Quantum *) NULL)) + break; +- for (x=0; x < (ssize_t) image->columns; x++) ++ for (x=0; x < columns; x++) + { + SetPixelGreen(image,GetPixelGreen(canvas_image,p),q); + p+=(ptrdiff_t) GetPixelChannels(canvas_image); +@@ -540,7 +542,7 @@ static Image *ReadYCBCRImage(const ImageInfo *image_info, + image->columns,1,exception); + if ((p == (const Quantum *) NULL) || (q == (Quantum *) NULL)) + break; +- for (x=0; x < (ssize_t) image->columns; x++) ++ for (x=0; x < columns; x++) + { + SetPixelBlue(image,GetPixelBlue(canvas_image,p),q); + p+=(ptrdiff_t) GetPixelChannels(canvas_image); +@@ -594,7 +596,7 @@ static Image *ReadYCBCRImage(const ImageInfo *image_info, + image->columns,1,exception); + if ((p == (const Quantum *) NULL) || (q == (Quantum *) NULL)) + break; +- for (x=0; x < (ssize_t) image->columns; x++) ++ for (x=0; x < columns; x++) + { + SetPixelAlpha(image,GetPixelAlpha(canvas_image,p),q); + p+=(ptrdiff_t) GetPixelChannels(canvas_image); +@@ -684,7 +686,7 @@ static Image *ReadYCBCRImage(const ImageInfo *image_info, + image->columns,1,exception); + if ((p == (const Quantum *) NULL) || (q == (Quantum *) NULL)) + break; +- for (x=0; x < (ssize_t) image->columns; x++) ++ for (x=0; x < columns; x++) + { + SetPixelRed(image,GetPixelRed(canvas_image,p),q); + p+=(ptrdiff_t) GetPixelChannels(canvas_image); +@@ -755,7 +757,7 @@ static Image *ReadYCBCRImage(const ImageInfo *image_info, + image->columns,1,exception); + if ((p == (const Quantum *) NULL) || (q == (Quantum *) NULL)) + break; +- for (x=0; x < (ssize_t) image->columns; x++) ++ for (x=0; x < columns; x++) + { + SetPixelGreen(image,GetPixelGreen(canvas_image,p),q); + p+=(ptrdiff_t) GetPixelChannels(canvas_image); +@@ -826,7 +828,7 @@ static Image *ReadYCBCRImage(const ImageInfo *image_info, + image->columns,1,exception); + if ((p == (const Quantum *) NULL) || (q == (Quantum *) NULL)) + break; +- for (x=0; x < (ssize_t) image->columns; x++) ++ for (x=0; x < columns; x++) + { + SetPixelBlue(image,GetPixelBlue(canvas_image,p),q); + p+=(ptrdiff_t) GetPixelChannels(canvas_image); +@@ -900,7 +902,7 @@ static Image *ReadYCBCRImage(const ImageInfo *image_info, + image->columns,1,exception); + if ((p == (const Quantum *) NULL) || (q == (Quantum *) NULL)) + break; +- for (x=0; x < (ssize_t) image->columns; x++) ++ for (x=0; x < columns; x++) + { + SetPixelAlpha(image,GetPixelAlpha(canvas_image,p),q); + p+=(ptrdiff_t) GetPixelChannels(canvas_image); diff --git a/meta-oe/recipes-support/imagemagick/imagemagick_7.1.2-13.bb b/meta-oe/recipes-support/imagemagick/imagemagick_7.1.2-13.bb index 3e2d3ab344..6e0b42cd2a 100644 --- a/meta-oe/recipes-support/imagemagick/imagemagick_7.1.2-13.bb +++ b/meta-oe/recipes-support/imagemagick/imagemagick_7.1.2-13.bb @@ -18,6 +18,7 @@ SRC_URI = "git://github.com/ImageMagick/ImageMagick.git;branch=main;protocol=htt file://CVE-2026-24481.patch \ file://CVE-2026-24484.patch \ file://CVE-2026-24485.patch \ + file://CVE-2026-25576.patch \ " SRCREV = "dd991e286b96918917a3392d6dc3ffc0e6907a4e"

[meta-oe,whinlatter,04/11] imagemagick: patch CVE-2026-25576

Commit Message

Patch