From 06fb1aa7589f4eec363b33c2bbda5986a92bb259 Mon Sep 17 00:00:00 2001 From: Cristy Date: Thu, 14 May 2026 19:41:53 -0400 Subject: [PATCH] https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-rcr6-g7jc-f57g --- MagickCore/fx.c | 14 ++++++++++++-- 1 file changed, 12 insertions(+), 2 deletions(-) diff --git a/MagickCore/fx.c b/MagickCore/fx.c index 8492856075..dc96e9bdd2 100644 --- a/MagickCore/fx.c +++ b/MagickCore/fx.c @@ -2249,12 +2249,22 @@ static MagickBooleanType GetOperand ( } return MagickTrue; } else if (OprIsUnaryPrefix (op)) { + MagickBooleanType operand_ok; if (!PushOperatorStack (pfx, (int) op)) return MagickFalse; pfx->pex++; SkipSpaces (pfx); if (!*pfx->pex) return MagickFalse; - - if (!GetOperand (pfx, UserSymbol, NewUserSymbol, UserSymNdx, needPopAll)) { + if (pfx->teDepth >= MagickMaxRecursionDepth) { + (void) ThrowMagickException ( + pfx->exception, GetMagickModule(), OptionError, + "Expression too deeply nested", "(depth %i exceeds limit %i)", + pfx->teDepth, MagickMaxRecursionDepth); + return MagickFalse; + } + pfx->teDepth++; + operand_ok=GetOperand (pfx, UserSymbol, NewUserSymbol, UserSymNdx, needPopAll); + pfx->teDepth--; + if (!operand_ok) { (void) ThrowMagickException ( pfx->exception, GetMagickModule(), OptionError, "After unary, bad operand at", "'%s'",