new file mode 100644
@@ -0,0 +1,197 @@
+From 766d3f6eb8a536dd33ce9b43df361e13e34bcf45 Mon Sep 17 00:00:00 2001
+From: Shaik Moin <careers.myinfo@gmail.com>
+Date: Tue, 7 Apr 2026 15:31:24 +0530
+Subject: [PATCH] imagemagick: Fix CVE-2025-62594
+
+ImageMagick CLAHE : Unsigned underflow and division-by-zero lead to OOB pointer arithmetic and process crash (DoS)
+Reference - https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-wpp4-vqfq-v4hp
+
+CVE: CVE-2025-62594
+
+Upstream-Status: Backport [https://github.com/ImageMagick/ImageMagick/commit/7b47fe369eda90483402fcd3d78fa4167d3bb129]
+
+Changes are made with 7.0.10 version code and only required and
+compatible code is taken into patch.
+In image-private.h file, only couple of "MACRO's" and
+"CastDoubleToPtrdiffT" is taken as other functions are not effecting our
+current code.
+Composite.c file - is not taken in consideration as the change is for a
+space " ".
+Enhance.c file - All hunks are taken in our current code.
+
+Signed-off-by: Cristy <urban-warrior@imagemagick.org>
+Signed-off-by: Shaik Moin <careers.myinfo@gmail.com>
+---
+ MagickCore/enhance.c | 45 ++++++++++++++++++++------------------
+ MagickCore/image-private.h | 26 ++++++++++++++++++++++
+ 2 files changed, 50 insertions(+), 21 deletions(-)
+
+diff --git a/MagickCore/enhance.c b/MagickCore/enhance.c
+index 23134d5..54b2695 100644
+--- a/MagickCore/enhance.c
++++ b/MagickCore/enhance.c
+@@ -69,6 +69,7 @@
+ #include "MagickCore/option.h"
+ #include "MagickCore/pixel.h"
+ #include "MagickCore/pixel-accessor.h"
++#include "MagickCore/pixel-private.h"
+ #include "MagickCore/quantum.h"
+ #include "MagickCore/quantum-private.h"
+ #include "MagickCore/resample.h"
+@@ -320,11 +321,8 @@ static void ClipCLAHEHistogram(const double clip_limit,const size_t number_bins,
+ */
+ cumulative_excess=0;
+ for (i=0; i < (ssize_t) number_bins; i++)
+- {
+- excess=(ssize_t) histogram[i]-(ssize_t) clip_limit;
+- if (excess > 0)
+- cumulative_excess+=excess;
+- }
++ if (histogram[i] > clip_limit)
++ cumulative_excess+=(ssize_t) (histogram[i]-clip_limit);
+ /*
+ Clip histogram and redistribute excess pixels across all bins.
+ */
+@@ -483,9 +481,6 @@ static MagickBooleanType CLAHE(const RectangleInfo *clahe_info,
+ MemoryInfo
+ *tile_cache;
+
+- unsigned short
+- *p;
+-
+ size_t
+ limit,
+ *tiles;
+@@ -494,14 +489,15 @@ static MagickBooleanType CLAHE(const RectangleInfo *clahe_info,
+ y;
+
+ unsigned short
+- *lut;
++ *lut,
++ *p;
+
+ /*
+ Constrast limited adapted histogram equalization.
+ */
+ if (clip_limit == 1.0)
+ return(MagickTrue);
+- tile_cache=AcquireVirtualMemory((size_t) clahe_info->x*number_bins,
++ tile_cache=AcquireVirtualMemory((size_t) clahe_info->x*number_bins,(size_t)
+ clahe_info->y*sizeof(*tiles));
+ if (tile_cache == (MemoryInfo *) NULL)
+ return(MagickFalse);
+@@ -512,7 +508,8 @@ static MagickBooleanType CLAHE(const RectangleInfo *clahe_info,
+ return(MagickFalse);
+ }
+ tiles=(size_t *) GetVirtualMemoryBlob(tile_cache);
+- limit=(size_t) (clip_limit*(tile_info->width*tile_info->height)/number_bins);
++ limit=(size_t) (clip_limit*((double) tile_info->width*tile_info->height)/
++ number_bins);
+ if (limit < 1UL)
+ limit=1UL;
+ /*
+@@ -537,7 +534,7 @@ static MagickBooleanType CLAHE(const RectangleInfo *clahe_info,
+ tile_info->height,histogram);
+ p+=tile_info->width;
+ }
+- p+=clahe_info->width*(tile_info->height-1);
++ p+=CastDoubleToPtrdiffT((double) clahe_info->width*(tile_info->height-1));
+ }
+ /*
+ Interpolate greylevel mappings to get CLAHE image.
+@@ -578,6 +575,11 @@ static MagickBooleanType CLAHE(const RectangleInfo *clahe_info,
+ }
+ for (x=0; x <= (ssize_t) clahe_info->x; x++)
+ {
++ double
++ Q11,
++ Q12,
++ Q21,
++ Q22;
+ tile.width=tile_info->width;
+ tile.x=x-1;
+ offset.x=tile.x+1;
+@@ -600,15 +602,16 @@ static MagickBooleanType CLAHE(const RectangleInfo *clahe_info,
+ tile.x=clahe_info->x-1;
+ offset.x=tile.x;
+ }
+- InterpolateCLAHE(clahe_info,
+- tiles+(number_bins*(tile.y*clahe_info->x+tile.x)), /* Q12 */
+- tiles+(number_bins*(tile.y*clahe_info->x+offset.x)), /* Q22 */
+- tiles+(number_bins*(offset.y*clahe_info->x+tile.x)), /* Q11 */
+- tiles+(number_bins*(offset.y*clahe_info->x+offset.x)), /* Q21 */
+- &tile,lut,p);
++ Q12=(double) number_bins*(tile.y*clahe_info->x+tile.x);
++ Q22=(double) number_bins*(tile.y*clahe_info->x+offset.x);
++ Q11=(double) number_bins*(offset.y*clahe_info->x+tile.x);
++ Q21=(double) number_bins*(offset.y*clahe_info->x+offset.x);
++ InterpolateCLAHE(clahe_info,tiles+CastDoubleToPtrdiffT(Q12),
++ tiles+CastDoubleToPtrdiffT(Q22),tiles+CastDoubleToPtrdiffT(Q11),
++ tiles+CastDoubleToPtrdiffT(Q21),&tile,lut,p);
+ p+=tile.width;
+ }
+- p+=clahe_info->width*(tile.height-1);
++ p+=CastDoubleToPtrdiffT((double) clahe_info->width*(tile.height-1));
+ }
+ lut=(unsigned short *) RelinquishMagickMemory(lut);
+ tile_cache=RelinquishVirtualMemory(tile_cache);
+@@ -661,10 +664,10 @@ MagickExport MagickBooleanType CLAHEImage(Image *image,const size_t width,
+ (void) LogMagickEvent(TraceEvent,GetMagickModule(),"%s",image->filename);
+ range_info.min=0;
+ range_info.max=NumberCLAHEGrays-1;
+- tile_info.width=width;
++ tile_info.width=MagickMax(width,2);
+ if (tile_info.width == 0)
+ tile_info.width=image->columns >> 3;
+- tile_info.height=height;
++ tile_info.height=MagickMax(height,2);
+ if (tile_info.height == 0)
+ tile_info.height=image->rows >> 3;
+ tile_info.x=0;
+diff --git a/MagickCore/image-private.h b/MagickCore/image-private.h
+index 8ce0208..eaed34f 100644
+--- a/MagickCore/image-private.h
++++ b/MagickCore/image-private.h
+@@ -38,6 +38,8 @@ extern "C" {
+ #define MagickPHI 1.61803398874989484820458683436563811772030917980576
+ #define MagickPI2 1.57079632679489661923132169163975144209858469968755
+ #define MagickPI 3.14159265358979323846264338327950288419716939937510
++#define MAGICK_PTRDIFF_MAX (PTRDIFF_MAX)
++#define MAGICK_PTRDIFF_MIN (-PTRDIFF_MAX-1)
+ #define MagickSQ1_2 0.70710678118654752440084436210484903928483593768847
+ #define MagickSQ2 1.41421356237309504880168872420969807856967187537695
+ #define MagickSQ2PI 2.50662827463100024161235523934010416269302368164062
+@@ -53,6 +55,30 @@ extern "C" {
+ #define UndefinedCompressionQuality 0UL
+ #define UndefinedTicksPerSecond 100L
+
++static inline ptrdiff_t CastDoubleToPtrdiffT(const double x)
++{
++ double
++ value;
++
++ if (IsNaN(x) != 0)
++ {
++ errno=ERANGE;
++ return(0);
++ }
++ value=(x < 0.0) ? ceil(x) : floor(x);
++ if (value < ((double) MAGICK_PTRDIFF_MIN))
++ {
++ errno=ERANGE;
++ return(MAGICK_PTRDIFF_MIN);
++ }
++ if (value > ((double) MAGICK_PTRDIFF_MAX))
++ {
++ errno=ERANGE;
++ return(MAGICK_PTRDIFF_MAX);
++ }
++ return((ptrdiff_t) value);
++}
++
+ static inline ssize_t CastDoubleToLong(const double x)
+ {
+ if (IsNaN(x) != 0)
+--
+2.34.1
+
@@ -54,6 +54,7 @@ SRC_URI = "git://github.com/ImageMagick/ImageMagick.git;branch=main;protocol=htt
file://CVE-2026-22770.patch \
file://CVE-2026-23874.patch \
file://CVE-2026-23876.patch \
+ file://CVE-2025-62594.patch \
"
SRCREV = "35b4991eb0939a327f3489988c366e21068b0178"