From: Cristy <urban-warrior@imagemagick.org>
Date: Fri, 27 Jun 2025 20:02:12 -0400
Subject: [PATCH]
  https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-qh3h-j545-h8c9

origin: backport, https://github.com/ImageMagick/ImageMagick/commit/66dc8f51c11b0ae1f1cdeacd381c3e9a4de69774
bug: https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-qh3h-j545-h8c9
---
 MagickCore/image.c | 15 ++++++++-------
 1 file changed, 8 insertions(+), 7 deletions(-)

diff --git a/MagickCore/image.c b/MagickCore/image.c
index 1b242f8..63d6ef0 100644
--- a/MagickCore/image.c
+++ b/MagickCore/image.c
@@ -1665,7 +1665,6 @@ MagickExport size_t InterpretImageFilename(const ImageInfo *image_info,
     canonical;
 
   ssize_t
-    field_width,
     offset;
 
   canonical=MagickFalse;
@@ -1681,22 +1680,24 @@ MagickExport size_t InterpretImageFilename(const ImageInfo *image_info,
         p++;
         continue;
       }
-    field_width=0;
-    if (*q == '0')
-      field_width=(ssize_t) strtol(q,&q,10);
     switch (*q)
     {
       case 'd':
       case 'o':
       case 'x':
       {
+        ssize_t
+          count;
+
         q++;
         c=(*q);
         *q='\0';
-        (void) FormatLocaleString(filename+(p-format-offset),(size_t)
+        count=FormatLocaleString(filename+(p-format-offset),(size_t)
           (MagickPathExtent-(p-format-offset)),p,value);
-        offset+=(4-field_width);
-        *q=c;
+        if ((count <= 0) || (count > (MagickPathExtent-(p-format-offset))))
+          return(0);
+        offset+=(ssize_t) ((q-p)-count);
+        *q=(char) c;
         (void) ConcatenateMagickString(filename,q,MagickPathExtent);
         canonical=MagickTrue;
         if (*(q-1) != '%')