https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=6425

diff --git a/MagickCore/exception.c b/MagickCore/exception.c
index bf669e96f7d9024ff1cb79b4a12d6da974471c88..9017f383aabcf0555ed41d728a574b934565bc53 100644 (file)
--- a/MagickCore/exception.c
+++ b/MagickCore/exception.c
@@ -73,11 +73,6 @@ static void
 /*
   Global declarations.
 */
-#define MaxExceptions  32
-\f
-/*
-  Global declarations.
-*/
 static ErrorHandler
   error_handler = DefaultErrorHandler;
 
@@ -195,6 +190,9 @@ MagickExport void ClearMagickException(ExceptionInfo *exception)
 */
 MagickExport void CatchException(ExceptionInfo *exception)
 {
+  LinkedListInfo
+    *exceptions;
+
   register const ExceptionInfo
     *p;
 
@@ -206,27 +204,18 @@ MagickExport void CatchException(ExceptionInfo *exception)
   if (exception->exceptions  == (void *) NULL)
     return;
   LockSemaphoreInfo(exception->semaphore);
-  ResetLinkedListIterator((LinkedListInfo *) exception->exceptions);
-  p=(const ExceptionInfo *) GetNextValueInLinkedList((LinkedListInfo *)
-    exception->exceptions);
+  exceptions=(LinkedListInfo *) exception->exceptions;
+  ResetLinkedListIterator(exceptions);
+  p=(const ExceptionInfo *) GetNextValueInLinkedList(exceptions);
   for (i=0; p != (const ExceptionInfo *) NULL; i++)
   {
-    if (i < MaxExceptions)
-      {
-        if ((p->severity >= WarningException) && (p->severity < ErrorException))
-          MagickWarning(p->severity,p->reason,p->description);
-        if ((p->severity >= ErrorException) &&
-            (p->severity < FatalErrorException))
-          MagickError(p->severity,p->reason,p->description);
-      }
-    else
-      if (i == MaxExceptions)
-        MagickError(ResourceLimitError,"too many exceptions",
-          "exception processing is suspended");
+    if ((p->severity >= WarningException) && (p->severity < ErrorException))
+      MagickWarning(p->severity,p->reason,p->description);
+    if ((p->severity >= ErrorException) && (p->severity < FatalErrorException))
+      MagickError(p->severity,p->reason,p->description);
     if (p->severity >= FatalErrorException)
       MagickFatalError(p->severity,p->reason,p->description);
-    p=(const ExceptionInfo *) GetNextValueInLinkedList((LinkedListInfo *)
-      exception->exceptions);
+    p=(const ExceptionInfo *) GetNextValueInLinkedList(exceptions);
   }
   UnlockSemaphoreInfo(exception->semaphore);
   ClearMagickException(exception);
@@ -926,14 +915,22 @@ MagickExport WarningHandler SetWarningHandler(WarningHandler handler)
 MagickExport MagickBooleanType ThrowException(ExceptionInfo *exception,
   const ExceptionType severity,const char *reason,const char *description)
 {
+  LinkedListInfo
+    *exceptions;
+
   register ExceptionInfo
     *p;
 
   assert(exception != (ExceptionInfo *) NULL);
   assert(exception->signature == MagickCoreSignature);
   LockSemaphoreInfo(exception->semaphore);
-  p=(ExceptionInfo *) GetLastValueInLinkedList((LinkedListInfo *)
-    exception->exceptions);
+  exceptions=(LinkedListInfo *) exception->exceptions;
+  if (GetNumberOfElementsInLinkedList(exceptions) > MagickMaxRecursionDepth)
+    {
+      UnlockSemaphoreInfo(exception->semaphore);
+      return(MagickTrue);
+    }
+  p=(ExceptionInfo *) GetLastValueInLinkedList(exceptions);
   if ((p != (ExceptionInfo *) NULL) && (p->severity == severity) &&
       (LocaleCompare(exception->reason,reason) == 0) &&
       (LocaleCompare(exception->description,description) == 0))
@@ -954,7 +951,7 @@ MagickExport MagickBooleanType ThrowException(ExceptionInfo *exception,
   if (description != (const char *) NULL)
     p->description=ConstantString(description);
   p->signature=MagickCoreSignature;
-  (void) AppendValueToLinkedList((LinkedListInfo *) exception->exceptions,p);
+  (void) AppendValueToLinkedList(exceptions,p);
   if (p->severity >= exception->severity)
     {
       exception->severity=p->severity;
@@ -962,6 +959,9 @@ MagickExport MagickBooleanType ThrowException(ExceptionInfo *exception,
       exception->description=p->description;
     }
   UnlockSemaphoreInfo(exception->semaphore);
+  if (GetNumberOfElementsInLinkedList(exceptions) == MagickMaxRecursionDepth)
+    (void) ThrowMagickException(exception,GetMagickModule(),ResourceLimitError,
+      "TooManyExceptions","(exception processing is suspended)");
   return(MagickTrue);
 }
 \f

diff --git a/config/english.xml b/config/english.xml
index 23041d51c91ac55dd377f102a0b092d42476fb8c..e31d5df18e7056823d732830cb9d24b8a1eab01e 100644 (file)
--- a/config/english.xml
+++ b/config/english.xml
@@ -1021,6 +1021,9 @@
           <message name="PixelCacheAllocationFailed">
             pixel cache allocation failed
           </message>
+          <message name="TooManyExceptions">
+            too man exceptions
+          </message>
           <message name="TooManyObjects">
             too many objects
           </message>

diff --git a/config/francais.xml b/config/francais.xml
index 3ce9c076f47f9e82c413138b25b91072b2dc54a2..bd51fe56408f3d800ddb32f4e78f0db9a95772bf 100644 (file)
--- a/config/francais.xml
+++ b/config/francais.xml
@@ -1012,6 +1012,9 @@
           <message name="PixelCacheAllocationFailed">
             Échec allocation du cache pixel
           </message>
+          <message name="TooManyExceptions">
+            too man exceptions
+          </message>
           <message name="TooManyObjects">
             too many objects
           </message>