https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=8383

diff --git a/MagickCore/draw.c b/MagickCore/draw.c
index 51d4b267066fbd12593d6b3165fbf97d66e032d5..132ad5c3a06879952ab61cffcb1ed89a195bcd6d 100644 (file)
--- a/MagickCore/draw.c
+++ b/MagickCore/draw.c
@@ -3852,10 +3852,11 @@ MagickExport MagickBooleanType DrawImage(Image *image,const DrawInfo *draw_info,
               t++;
               continue;
             }
-          if (strspn(t,"AaCcQqSsTt") != 0)
-            coordinates+=(6*BezierQuantum)+360;
           coordinates++;
         }
+        for (s=token; *s != '\0'; s++)
+          if (strspn(s,"AaCcQqSsTt") != 0)
+            coordinates+=(20*BezierQuantum)+360;
         break;
       }
       case CirclePrimitive: