https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=7915

diff --git a/MagickCore/draw.c b/MagickCore/draw.c
index 3e229e9fc3306ee923acaed398f29ca7bb5818f6..13ae5509ef41161b0601874eeb5176f3223d517a 100644 (file)
--- a/MagickCore/draw.c
+++ b/MagickCore/draw.c
@@ -747,7 +747,7 @@ static PathInfo *ConvertPrimitiveToPath(const PrimitiveInfo *primitive_info)
       break;
   }
   for (i=0; primitive_info[i].primitive != UndefinedPrimitive; i++) ;
-  path_info=(PathInfo *) AcquireQuantumMemory((size_t) (2UL*i+3UL),
+  path_info=(PathInfo *) AcquireQuantumMemory((size_t) (2UL*i+4UL),
     sizeof(*path_info));
   if (path_info == (PathInfo *) NULL)
     return((PathInfo *) NULL);