https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=8682

diff --git a/MagickCore/draw.c b/MagickCore/draw.c
index 3e3267a12c9eec6ecec2cf81d2009dcb98b741fa..1ed0b400181b9ac249794cb7578d012154f2df3a 100644 (file)
--- a/MagickCore/draw.c
+++ b/MagickCore/draw.c
@@ -2359,6 +2359,7 @@ MagickExport MagickBooleanType DrawImage(Image *image,const DrawInfo *draw_info,
 
   double
     angle,
+    coordinates,
     factor,
     primitive_extent;
 
@@ -2368,9 +2369,6 @@ MagickExport MagickBooleanType DrawImage(Image *image,const DrawInfo *draw_info,
   MagickBooleanType
     proceed;
 
-  MagickSizeType
-    coordinates;
-
   MagickStatusType
     status;
 
@@ -3850,7 +3848,7 @@ MagickExport MagickBooleanType DrawImage(Image *image,const DrawInfo *draw_info,
     /*
       Speculate how many points our primitive might consume.
     */
-    coordinates=primitive_info[j].coordinates;
+    coordinates=(double) primitive_info[j].coordinates;
     switch (primitive_type)
     {
       case RectanglePrimitive:
@@ -3882,7 +3880,7 @@ MagickExport MagickBooleanType DrawImage(Image *image,const DrawInfo *draw_info,
             status=MagickFalse;
             break;
           }
-        coordinates=(BezierQuantum*primitive_info[j].coordinates);
+        coordinates=(double) (BezierQuantum*primitive_info[j].coordinates);
         break;
       }
       case PathPrimitive:
@@ -3925,8 +3923,7 @@ MagickExport MagickBooleanType DrawImage(Image *image,const DrawInfo *draw_info,
         alpha=bounds.x2-bounds.x1;
         beta=bounds.y2-bounds.y1;
         radius=hypot(alpha,beta);
-        coordinates=(MagickSizeType) (2*(ceil(MagickPI*radius))+6*
-          BezierQuantum+360);
+        coordinates=2.0*(ceil(MagickPI*radius))+6*BezierQuantum+360.0;
         break;
       }
       default:
@@ -3934,8 +3931,8 @@ MagickExport MagickBooleanType DrawImage(Image *image,const DrawInfo *draw_info,
     }
     if (coordinates > MaxBezierCoordinates)
       {
-        (void) ThrowMagickException(exception,GetMagickModule(),DrawError,
-          "TooManyBezierCoordinates","`%s'",token);
+        (void) ThrowMagickException(exception,GetMagickModule(),
+          ResourceLimitError,"MemoryAllocationFailed","`%s'",token);
         status=MagickFalse;
       }
     if (status == MagickFalse)
@@ -4102,8 +4099,8 @@ MagickExport MagickBooleanType DrawImage(Image *image,const DrawInfo *draw_info,
       }
       case PathPrimitive:
       {
-        coordinates=TracePath(&mvg_info,token,exception);
-        if (coordinates == 0)
+        coordinates=(double) TracePath(&mvg_info,token,exception);
+        if (coordinates == 0.0)
           {
             status=MagickFalse;
             break;