From cd7acd2c4bea5c953fae062d9ce43d11374dcb60 Mon Sep 17 00:00:00 2001
From: Jake Lodwick <jakelodwick@users.noreply.github.com>
Date: Sun, 1 Mar 2026 04:46:29 -0700
Subject: [PATCH] Add overflow check to sixel write path (#8587)

---
 coders/sixel.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/coders/sixel.c b/coders/sixel.c
index d3a77aff21..b242959385 100644
--- a/coders/sixel.c
+++ b/coders/sixel.c
@@ -815,6 +815,8 @@ static MagickBooleanType sixel_encode_impl(sixel_pixel_t *pixels,size_t width,
   context->pos = 0;
   if (ncolors < 1)
     return(MagickFalse);
+  if (HeapOverflowSanityCheck(ncolors,width) != MagickFalse)
+    return(MagickFalse);
   len=ncolors*width;
   context->active_palette=(-1);
   map=(sixel_pixel_t *) AcquireQuantumMemory(len,sizeof(sixel_pixel_t));