https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=5638

diff --git a/MagickCore/token.c b/MagickCore/token.c
index 2f1bf4c53b82855eb271c06eec150d3b99c6fef8..cef1c00a84fdb7e1eb526fea448987af9ef943fd 100644 (file)
--- a/MagickCore/token.c
+++ b/MagickCore/token.c
@@ -309,8 +309,11 @@ MagickExport void GetNextToken(const char *start,const char **end,
       if (token[offset] == '#')
         offset++;
       i=(ssize_t) strlen(token);
-      (void) CopyMagickString(token,token+offset,MagickPathExtent);
-      token[i-offset-1]='\0';
+      if (i > offset)
+        {
+          (void) CopyMagickString(token,token+offset,MagickPathExtent);
+          token[i-offset-1]='\0';
+        }
     }
   while (isspace((int) ((unsigned char) *p)) != 0)
     p++;