Corrected loop initialization to prevent out of bounds read (https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-wrhr-rf8j-r842)

dlemstra · dlemstra · commit 5204a166fd24 · 2026-01-27T21:45:05.000+01:00
diff --git a/coders/pcd.c b/coders/pcd.c
@@ -314,7 +314,7 @@ static MagickBooleanType DecodeImage(Image *image,unsigned char *luma,
       Decode luminance or chrominance deltas.
     */
     r=pcd_table[plane];
-    for (i=0; ((i < pcd_length[plane]) && ((sum & r->mask) != r->sequence)); i++)
+    for (i=1; ((i < pcd_length[plane]) && ((sum & r->mask) != r->sequence)); i++)
       r++;
     if ((row > image->rows) || (r == (PCDTable *) NULL))
       {

Original file line number	Diff line number	Diff line change
`@@ -314,7 +314,7 @@ static MagickBooleanType DecodeImage(Image image,unsigned char luma,`
`314`	`314`	`Decode luminance or chrominance deltas.`
`315`	`315`	`*/`
`316`	`316`	`r=pcd_table[plane];`
`317`		`- for (i=0; ((i < pcd_length[plane]) && ((sum & r->mask) != r->sequence)); i++)`
	`317`	`+ for (i=1; ((i < pcd_length[plane]) && ((sum & r->mask) != r->sequence)); i++)`
`318`	`318`	`r++;`
`319`	`319`	`if ((row > image->rows) \|\| (r == (PCDTable *) NULL))`
`320`	`320`	`{`