https://github.com/ImageMagick/ImageMagick/issues/6623

magick/cache-private.h

@@ -249,6 +249,17 @@ typedef struct _CacheInfo
     height_limit;
 } CacheInfo;
 
+static inline MagickBooleanType IsValidPixelOffset(const ssize_t y,
+  const size_t columns)
+{
+  if (columns == 0)
+    return(MagickTrue);
+  if ((y >= (MAGICK_SSIZE_MAX/(ssize_t) columns)) ||
+      (y <= (MAGICK_SSIZE_MIN/(ssize_t) columns)))
+    return(MagickFalse);
+  return(MagickTrue);
+}
+
 extern MagickExport Cache
   AcquirePixelCache(const size_t),
   ClonePixelCache(const Cache),

magick/cache.c

@@ -2930,17 +2930,6 @@ static inline MagickBooleanType IsOffsetOverflow(const ssize_t x,
   return(MagickTrue);
 }     
 
-static inline MagickBooleanType IsValidOffset(const ssize_t y,
-  const size_t columns)
-{
-  if (columns == 0)
-    return(MagickTrue);
-  if ((y >= (MAGICK_SSIZE_MAX/(ssize_t) columns)) ||
-      (y <= (MAGICK_SSIZE_MIN/(ssize_t) columns)))
-    return(MagickFalse);
-  return(MagickTrue);
-} 
-
 static inline ssize_t RandomX(RandomInfo *random_info,const size_t columns)
 {
   return((ssize_t) (columns*GetPseudoRandomValue(random_info)));
@@ -3027,7 +3016,7 @@ MagickExport const PixelPacket *GetVirtualPixelCacheNexus(const Image *image,
     MagickTrue : MagickFalse,nexus_info,exception);
   if (pixels == (PixelPacket *) NULL)
     return((const PixelPacket *) NULL);
-  if (IsValidOffset(nexus_info->region.y,cache_info->columns) == MagickFalse)
+  if (IsValidPixelOffset(nexus_info->region.y,cache_info->columns) == MagickFalse)
     return((const PixelPacket *) NULL);
   offset=nexus_info->region.y*(MagickOffsetType) cache_info->columns;
   if (IsOffsetOverflow(offset,nexus_info->region.x) == MagickFalse)
@@ -4416,7 +4405,7 @@ MagickExport PixelPacket *QueueAuthenticPixelCacheNexus(Image *image,
         "PixelsAreNotAuthentic","`%s'",image->filename);
       return((PixelPacket *) NULL);
     }
-  if (IsValidOffset(y,cache_info->columns) == MagickFalse)
+  if (IsValidPixelOffset(y,cache_info->columns) == MagickFalse)
     return((PixelPacket *) NULL);
   offset=y*(MagickOffsetType) cache_info->columns+x;
   if (offset < 0)
@@ -4655,7 +4644,7 @@ static MagickBooleanType ReadPixelCacheIndexes(
     return(MagickFalse);
   if (nexus_info->authentic_pixel_cache != MagickFalse)
     return(MagickTrue);
-  if (IsValidOffset(nexus_info->region.y,cache_info->columns) == MagickFalse)
+  if (IsValidPixelOffset(nexus_info->region.y,cache_info->columns) == MagickFalse)
     return(MagickFalse);
   offset=nexus_info->region.y*(MagickOffsetType) cache_info->columns+
     nexus_info->region.x;
@@ -4824,7 +4813,7 @@ static MagickBooleanType ReadPixelCachePixels(
 
   if (nexus_info->authentic_pixel_cache != MagickFalse)
     return(MagickTrue);
-  if (IsValidOffset(nexus_info->region.y,cache_info->columns) == MagickFalse)
+  if (IsValidPixelOffset(nexus_info->region.y,cache_info->columns) == MagickFalse)
     return(MagickFalse);
   offset=nexus_info->region.y*(MagickOffsetType) cache_info->columns;
   if ((offset/(MagickOffsetType) cache_info->columns) != nexus_info->region.y)
@@ -5220,14 +5209,19 @@ static PixelPacket *SetPixelCacheNexusPixels(
       return((PixelPacket *) NULL);
     }
   if (((MagickSizeType) width > cache_info->width_limit) ||
-      ((MagickSizeType) height > cache_info->height_limit) ||
-      (ValidatePixelOffset(x,width) == MagickFalse) ||
-      (ValidatePixelOffset(y,height) == MagickFalse))
+      ((MagickSizeType) height > cache_info->height_limit))
     {
       (void) ThrowMagickException(exception,GetMagickModule(),ImageError,
         "WidthOrHeightExceedsLimit","`%s'",cache_info->filename);
       return((PixelPacket *) NULL);
     }
+  if ((ValidatePixelOffset(x,width) == MagickFalse) ||
+      (ValidatePixelOffset(y,height) == MagickFalse))
+    {
+      (void) ThrowMagickException(exception,GetMagickModule(),CorruptImageError,
+        "InvalidPixel","`%s'",cache_info->filename);
+      return((PixelPacket *) NULL);
+    }
   if (((cache_info->type == MemoryCache) || (cache_info->type == MapCache)) &&
       (buffered == MagickFalse))
     {
@@ -5242,7 +5236,7 @@ static PixelPacket *SetPixelCacheNexusPixels(
           /*
             Pixels are accessed directly from memory.
           */
-          if (IsValidOffset(y,cache_info->columns) == MagickFalse)
+          if (IsValidPixelOffset(y,cache_info->columns) == MagickFalse)
             return((PixelPacket *) NULL);
           offset=y*(MagickOffsetType) cache_info->columns+x;
           nexus_info->pixels=cache_info->pixels+offset;
@@ -5772,7 +5766,7 @@ static MagickBooleanType WritePixelCacheIndexes(CacheInfo *cache_info,
     return(MagickTrue);
   if (nexus_info->indexes == (IndexPacket *) NULL)
     return(MagickFalse);
-  if (IsValidOffset(nexus_info->region.y,cache_info->columns) == MagickFalse)
+  if (IsValidPixelOffset(nexus_info->region.y,cache_info->columns) == MagickFalse)
     return(MagickFalse);
   offset=nexus_info->region.y*(MagickOffsetType) cache_info->columns+
     nexus_info->region.x;
@@ -5941,7 +5935,7 @@ static MagickBooleanType WritePixelCachePixels(CacheInfo *cache_info,
 
   if (nexus_info->authentic_pixel_cache != MagickFalse)
     return(MagickTrue);
-  if (IsValidOffset(nexus_info->region.y,cache_info->columns) == MagickFalse)
+  if (IsValidPixelOffset(nexus_info->region.y,cache_info->columns) == MagickFalse)
     return(MagickFalse);
   offset=nexus_info->region.y*(MagickOffsetType) cache_info->columns+
     nexus_info->region.x;

magick/colorspace.c

@@ -917,8 +917,8 @@ MagickExport MagickBooleanType RGBTransformImage(Image *image,
         I and Q, normally -0.5 through 0.5, are normalized to the range 0
         through QuantumRange.
       */
-      primary_info.y=(double) (MaxMap+1.0)/2.0;
-      primary_info.z=(double) (MaxMap+1.0)/2.0;
+      primary_info.y=((double) MaxMap+1.0)/2.0;
+      primary_info.z=((double) MaxMap+1.0)/2.0;
 #if defined(MAGICKCORE_OPENMP_SUPPORT)
       #pragma omp parallel for schedule(static)
 #endif
@@ -972,8 +972,8 @@ MagickExport MagickBooleanType RGBTransformImage(Image *image,
         Cb and Cr, normally -0.5 through 0.5, are normalized to the range 0
         through QuantumRange.
       */
-      primary_info.y=(double) (MaxMap+1.0)/2.0;
-      primary_info.z=(double) (MaxMap+1.0)/2.0;
+      primary_info.y=((double) MaxMap+1.0)/2.0;
+      primary_info.z=((double) MaxMap+1.0)/2.0;
 #if defined(MAGICKCORE_OPENMP_SUPPORT)
       #pragma omp parallel for schedule(static)
 #endif
@@ -1027,8 +1027,8 @@ MagickExport MagickBooleanType RGBTransformImage(Image *image,
         Cb and Cr, normally -0.5 through 0.5, are normalized to the range 0
         through QuantumRange.
       */
-      primary_info.y=(double) (MaxMap+1.0)/2.0;
-      primary_info.z=(double) (MaxMap+1.0)/2.0;
+      primary_info.y=((double) MaxMap+1.0)/2.0;
+      primary_info.z=((double) MaxMap+1.0)/2.0;
 #if defined(MAGICKCORE_OPENMP_SUPPORT)
       #pragma omp parallel for schedule(static)
 #endif

magick/pixel.c

@@ -4502,6 +4502,9 @@ MagickExport MagickBooleanType InterpolateMagickPixelPacket(
   status=MagickTrue;
   x_offset=CastDoubleToLong(floor(x));
   y_offset=CastDoubleToLong(floor(y));
+  if ((ValidatePixelOffset(x_offset,source->columns) == MagickFalse) ||
+      (ValidatePixelOffset(y_offset,source->rows) == MagickFalse))
+    return(MagickFalse);
   interpolate = method;
   if (interpolate == UndefinedInterpolatePixel)
     interpolate=image->interpolate;

magick/visual-effects.c

@@ -1068,21 +1068,21 @@ MagickExport Image *ImplodeImage(const Image *image,const double amount,
     double
       distance;
 
+    IndexPacket
+      *magick_restrict implode_indexes;
+
     MagickPixelPacket
       pixel;
 
+    PixelPacket
+      *magick_restrict q;
+
     PointInfo
       delta;
 
-    IndexPacket
-      *magick_restrict implode_indexes;
-
     ssize_t
       x;
 
-    PixelPacket
-      *magick_restrict q;
-
     if (status == MagickFalse)
       continue;
     q=GetCacheViewAuthenticPixels(implode_view,0,y,implode_image->columns,1,
@@ -1093,31 +1093,34 @@ MagickExport Image *ImplodeImage(const Image *image,const double amount,
         continue;
       }
     implode_indexes=GetCacheViewAuthenticIndexQueue(implode_view);
-    delta.y=scale.y*(double) (y-center.y);
+    delta.y=scale.y*((double) y-center.y);
     pixel=zero;
     for (x=0; x < (ssize_t) image->columns; x++)
     {
       /*
         Determine if the pixel is within an ellipse.
       */
-      delta.x=scale.x*(double) (x-center.x);
+      delta.x=scale.x*((double) x-center.x);
       distance=delta.x*delta.x+delta.y*delta.y;
       if (distance < (radius*radius))
         {
           double
             factor;
 
+          PointInfo
+            offset;
+
           /*
             Implode the pixel.
           */
           factor=1.0;
           if (distance > 0.0)
-            factor=pow(sin((double) (MagickPI*sqrt((double) distance)*
-              PerceptibleReciprocal(radius)/2)),-amount);
+            factor=pow(sin((double) (MagickPI*sqrt(distance)*
+              PerceptibleReciprocal(radius)/2.0)),-amount);
+          offset.x=factor*delta.x*PerceptibleReciprocal(scale.x)+center.x;
+          offset.y=actor*delta.y*PerceptibleReciprocal(scale.y)+center.y:
           status=InterpolateMagickPixelPacket(image,image_view,
-            UndefinedInterpolatePixel,(double) (factor*delta.x*
-            PerceptibleReciprocal(scale.x)+center.x),(double) (factor*delta.y*
-            PerceptibleReciprocal(scale.y)+center.y),&pixel,exception);
+            UndefinedInterpolatePixel,offset.x,offset.y,&pixel,exception);
           if (status == MagickFalse)
             break;
           SetPixelPacket(implode_image,&pixel,q,implode_indexes+x);