https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=8772

diff --git a/MagickCore/draw.c b/MagickCore/draw.c
index 7df88176271ab5d763a199856e0a699795c645ee..9ba669d6b0bd3a9ab7ef9d4696958454c4fa16ee 100644 (file)
--- a/MagickCore/draw.c
+++ b/MagickCore/draw.c
@@ -6222,7 +6222,10 @@ static size_t TracePath(MVGInfo *mvg_info,const char *path,
           GetNextToken(p,&p,MagickPathExtent,token);
           if (*token == ',')
             GetNextToken(p,&p,MagickPathExtent,token);
-          sweep=StringToLong(token) != 0 ? MagickTrue : MagickFalse;
+          sweep=fabs(StringToDouble(token&next_token)) < DrawEpsilon ?
+            MagickFalse : MagickTrue;
+          if (token == next_token)
+            ThrowPointExpectedException(token,exception);
           GetNextToken(p,&p,MagickPathExtent,token);
           if (*token == ',')
             GetNextToken(p,&p,MagickPathExtent,token);