From: Dirk Lemstra <dirk@lemstra.org>
Date: Fri, 2 May 2025 18:33:17 +0200
Subject: [PATCH] Added extra checks to make sure we don't get stuck in the
  while loop.

origin: https://github.com/ImageMagick/ImageMagick/commit/229fa96a988a21d78318bbca61245a6ed1ee33a0
bug: https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-vmhh-8rxq-fp9g
bug-debian-security: https://security-tracker.debian.org/tracker/CVE-2025-53015
bug-debian: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1109339
---
 MagickCore/image-private.h |  1 +
 MagickCore/profile.c       | 11 +++++++++++
 2 files changed, 12 insertions(+)

diff --git a/MagickCore/image-private.h b/MagickCore/image-private.h
index 4ce71c3..11dca10 100644
--- a/MagickCore/image-private.h
+++ b/MagickCore/image-private.h
@@ -52,6 +52,7 @@ extern "C" {
 #define MAGICK_SIZE_MAX  (SIZE_MAX)
 #define MAGICK_SSIZE_MAX  (SSIZE_MAX)
 #define MAGICK_SSIZE_MIN  (-SSIZE_MAX-1)
+#define MAGICK_ULONG_MAX  (ULONG_MAX)
 #define MatteColor  "#bdbdbd"  /* gray */
 #define MatteColorRGBA  ScaleShortToQuantum(0xbdbd),\
   ScaleShortToQuantum(0xbdbd),ScaleShortToQuantum(0xbdbd),OpaqueAlpha
diff --git a/MagickCore/profile.c b/MagickCore/profile.c
index 7eea1d3..85c1801 100644
--- a/MagickCore/profile.c
+++ b/MagickCore/profile.c
@@ -2571,6 +2571,17 @@ static void GetXmpNumeratorAndDenominator(double value,
   *denominator=1;
   if (value <= MagickEpsilon)
     return;
+  if (value > (double) MAGICK_ULONG_MAX)
+    {
+      *numerator = MAGICK_ULONG_MAX;
+      *denominator = 1;
+      return;
+    }
+  if (floor(value) == value)
+    {
+      *numerator = (unsigned long) value;
+      *denominator = 1;
+    }
   *numerator=1;
   df=1.0;
   while(fabs(df - value) > MagickEpsilon)