dd0c60
--- ImageMagick-6.2.5/magick/image.c.format-string-again	2005-10-22 12:17:39.000000000 -0400
dd0c60
+++ ImageMagick-6.2.5/magick/image.c	2006-01-23 09:15:40.000000000 -0500
dd0c60
@@ -2847,25 +2847,8 @@
f981a6
       /*
dd0c60
         Rectify multi-image file support.
f981a6
       */
dd0c60
-      (void) CopyMagickString(filename,image_info->filename,MaxTextExtent);
f981a6
-      for (p=strchr(filename,'%'); p != (char *) NULL; p=strchr(p+1,'%'))
f981a6
-      {
f981a6
-        char
f981a6
-          *q;
f981a6
-
dd0c60
-        q=(char *) p+1;
f981a6
-        if (*q == '0')
f981a6
-          (void) strtol(q,&q,10);
f981a6
-        if ((*q == '%') || (*q == 'd') || (*q == 'o') || (*q == 'x'))
f981a6
-          {
f981a6
-            char
f981a6
-              format[MaxTextExtent];
f981a6
-
f981a6
-            (void) CopyMagickString(format,p,MaxTextExtent);
dd0c60
-            (void) FormatMagickString(p,MaxTextExtent,format,image_info->scene);
f981a6
-            break;
f981a6
-          }
f981a6
-      }
dd0c60
+      (void) FormatMagickStringNumeric(filename,MaxTextExtent,
dd0c60
+        image_info->filename,image_info->scene);
dd0c60
       if ((LocaleCompare(filename,image_info->filename) != 0) &&
dd0c60
           (strchr(filename,'%') == (char *) NULL))
dd0c60
         image_info->adjoin=MagickFalse;
dd0c60
--- ImageMagick-6.2.5/magick/blob.c.format-string-again	2005-09-28 15:00:17.000000000 -0400
dd0c60
+++ ImageMagick-6.2.5/magick/blob.c	2006-01-23 09:15:40.000000000 -0500
dd0c60
@@ -2121,25 +2121,8 @@
f981a6
       /*
dd0c60
         Form filename for multi-part images.
f981a6
       */
dd0c60
-      (void) CopyMagickString(filename,image->filename,MaxTextExtent);
f981a6
-      for (p=strchr(filename,'%'); p != (char *) NULL; p=strchr(p+1,'%'))
f981a6
-      {
f981a6
-        char
f981a6
-          *q;
f981a6
-
dd0c60
-        q=p+1;
f981a6
-        if (*q == '0')
f981a6
-          (void) strtol(q,&q,10);
f981a6
-        if ((*q == '%') || (*q == 'd') || (*q == 'o') || (*q == 'x'))
f981a6
-          {
f981a6
-            char
f981a6
-              format[MaxTextExtent];
f981a6
-
f981a6
-            (void) CopyMagickString(format,p,MaxTextExtent);
dd0c60
-            (void) FormatMagickString(p,MaxTextExtent,format,image->scene);
f981a6
-            break;
f981a6
-          }
f981a6
-      }
dd0c60
+      (void) FormatMagickStringNumeric(filename,MaxTextExtent,image->filename,
dd0c60
+        image->scene);
dd0c60
       if (image_info->adjoin == MagickFalse)
dd0c60
         if ((image->previous != (Image *) NULL) ||
dd0c60
             (GetNextImageInList(image) != (Image *) NULL))
dd0c60
--- ImageMagick-6.2.5/magick/montage.c.format-string-again	2005-10-22 12:17:39.000000000 -0400
dd0c60
+++ ImageMagick-6.2.5/magick/montage.c	2006-01-23 09:15:40.000000000 -0500
dd0c60
@@ -531,7 +531,7 @@
f981a6
               /*
f981a6
                 Form filename for multi-part images.
f981a6
               */
f981a6
-              (void) FormatMagickString(filename,MaxTextExtent,
f981a6
+              (void) FormatMagickStringNumeric(filename,MaxTextExtent,
f981a6
                 image_info->filename,scene);
f981a6
               if (LocaleCompare(filename,image_info->filename) == 0)
f981a6
                 (void) FormatMagickString(filename,MaxTextExtent,"%s.%lu",
dd0c60
--- ImageMagick-6.2.5/magick/animate.c.format-string-again	2005-10-23 22:15:16.000000000 -0400
dd0c60
+++ ImageMagick-6.2.5/magick/animate.c	2006-01-23 09:15:40.000000000 -0500
dd0c60
@@ -606,7 +606,7 @@
dd0c60
               /*
dd0c60
                 Form filename for multi-part images.
dd0c60
               */
dd0c60
-              (void) FormatMagickString(filename,MaxTextExtent,
dd0c60
+              (void) FormatMagickStringNumeric(filename,MaxTextExtent,
dd0c60
                 image_info->filename,scene);
dd0c60
               if (LocaleCompare(filename,image_info->filename) == 0)
dd0c60
                 (void) FormatMagickString(filename,MaxTextExtent,"%s[%lu]",
dd0c60
--- ImageMagick-6.2.5/magick/string_.h.format-string-again	2005-10-12 21:59:20.000000000 -0400
dd0c60
+++ ImageMagick-6.2.5/magick/string_.h	2006-01-23 09:20:47.000000000 -0500
dd0c60
@@ -62,6 +62,7 @@
dd0c60
   FormatMagickStringList(char *,const size_t,const char *,va_list)
dd0c60
     magick_attribute((format (printf,3,0))),
dd0c60
   FormatMagickTime(const time_t,const size_t,char *),
dd0c60
+  FormatMagickStringNumeric(char *,const size_t,const char *,int),
dd0c60
   LocaleCompare(const char *,const char *),
dd0c60
   LocaleNCompare(const char *,const char *,const size_t);
dd0c60
 
dd0c60
--- ImageMagick-6.2.5/magick/string.c.format-string-again	2005-10-13 21:03:09.000000000 -0400
dd0c60
+++ ImageMagick-6.2.5/magick/string.c	2006-01-23 09:15:40.000000000 -0500
dd0c60
@@ -960,6 +960,75 @@
dd0c60
 %                                                                             %
dd0c60
 %                                                                             %
dd0c60
 %                                                                             %
f981a6
+%  F o r m a t M a g i c k S t r i n g N u m e r i c                          %
f981a6
+%                                                                             %
f981a6
+%                                                                             %
f981a6
+%                                                                             %
f981a6
+%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
f981a6
+%
f981a6
+%  Method FormatMagickStringNumeric formats output for a single numeric
f981a6
+%  argument. It takes into account that the format string given might be
f981a6
+%  untrusted user input, and returns the length of the formatted string.
f981a6
+%
f981a6
+%  The format of the FormatMagickStringNumeric method is:
f981a6
+%
f981a6
+%      long FormatMagickStringNumeric(char *string,const size_t length,
f981a6
+%                                     const char *format,int value)
f981a6
+%
f981a6
+%  A description of each parameter follows.
f981a6
+%
f981a6
+%   o string:  FormatMagickStringNumeric() returns the formatted string in this
f981a6
+%     character buffer.
f981a6
+%
f981a6
+%   o length: The maximum length of the string.
f981a6
+%
f981a6
+%   o  format:  A string describing the format to use to write the numeric
f981a6
+%      argument. Only the first numeric format identifier is replaced.
f981a6
+%
f981a6
+%   o  value:  Numeric value to substitute into format string.
f981a6
+%
f981a6
+%
f981a6
+*/
f981a6
+MagickExport long FormatMagickStringNumeric(char *string,const size_t length,const char *format,int value)
f981a6
+{
f981a6
+  char
f981a6
+    *p;
f981a6
+
f981a6
+  (void) CopyMagickString(string, format, length);
f981a6
+
f981a6
+  for (p=strchr(format,'%'); p != (char *) NULL; p=strchr(p+1,'%'))
f981a6
+  {
f981a6
+    char
f981a6
+      *q;
f981a6
+
f981a6
+    q=(char *) p+1;
f981a6
+    if (*q == '0')
f981a6
+      (void) strtol(q,&q,10);
f981a6
+    if ((*q == '%') || (*q == 'd') || (*q == 'o') || (*q == 'x'))
f981a6
+    {
f981a6
+      char
f981a6
+        c;
f981a6
+
f981a6
+      q++;
f981a6
+      c=*q;
f981a6
+      *q='\0';
f981a6
+      (void) snprintf(string+(p-format),length-(p-format),p,value);
f981a6
+      *q=c;
f981a6
+      (void) ConcatenateMagickString(string,q,length);
f981a6
+      if (*(q-1) == '%')
f981a6
+        p++;
f981a6
+      else
f981a6
+        break;
f981a6
+    }
f981a6
+  }
f981a6
+  return (long)strlen(string);
dd0c60
+}
dd0c60
+
dd0c60
+/*
dd0c60
+%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
dd0c60
+%                                                                             %
dd0c60
+%                                                                             %
dd0c60
+%                                                                             %
dd0c60
 %  F o r m a t M a g i c k S t r i n g                                        %
dd0c60
 %                                                                             %
dd0c60
 %                                                                             %
dd0c60
--- ImageMagick-6.2.5/magick/display.c.format-string-again	2005-10-24 20:23:14.000000000 -0400
dd0c60
+++ ImageMagick-6.2.5/magick/display.c	2006-01-23 09:15:40.000000000 -0500
dd0c60
@@ -1989,7 +1989,7 @@
dd0c60
               /*
dd0c60
                 Form filename for multi-part images.
dd0c60
               */
dd0c60
-              (void) FormatMagickString(filename,MaxTextExtent,
dd0c60
+              (void) FormatMagickStringNumeric(filename,MaxTextExtent,
dd0c60
                 image_info->filename,scene);
dd0c60
               if (LocaleCompare(filename,image_info->filename) == 0)
dd0c60
                 (void) FormatMagickString(filename,MaxTextExtent,"%s.%lu",