CVE-2019-17540/imagemagick: fixing commits for IM6

add link to commit which introduced vulnerable code.

vulnerable code was introduced very recently. it is very unlikely
that any Debian release is affected.

these fixing commits are quite messy, in any case I do not recommend
to cherry pick them.