The same code is repeated in blob.c. Here is a more complete fix.
--- ImageMagick-6.2.5/magick/image.c.format-string-again 2005-10-22 12:17:39.000000000 -0400 +++ ImageMagick-6.2.5/magick/image.c 2006-01-04 11:37:30.000000000 -0500 @@ -2861,8 +2861,16 @@ char format[MaxTextExtent]; + /* Extract first numeric format specifier */ (void) CopyMagickString(format,p,MaxTextExtent); + if (q-p+1 < MaxTextExtent) + format[q-p+1]='\0'; + /* Expand format */ (void) FormatMagickString(p,MaxTextExtent,format,image_info->scene); + /* Copy rest of string verbatim without further expansion */ + (void) ConcatenateMagickString(filename, + image_info->filename+(q-filename)+1, + MaxTextExtent); break; } } --- ImageMagick-6.2.5/magick/blob.c.format-string-again 2006-01-04 11:36:02.000000000 -0500 +++ ImageMagick-6.2.5/magick/blob.c 2006-01-04 11:37:32.000000000 -0500 @@ -2135,8 +2135,17 @@ char format[MaxTextExtent]; + /* Extract first numeric format specifier */ (void) CopyMagickString(format,p,MaxTextExtent); + if (q-p+1 < MaxTextExtent) + format[q-p+1]='\0'; + /* Expand format */ (void) FormatMagickString(p,MaxTextExtent,format,image->scene); + /* Copy rest of string verbatim without further expansion */ + (void) ConcatenateMagickString(filename, + image_info->filename+(q-filename)+1, + MaxTextExtent); + break; } }