https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=5765

diff --git a/MagickCore/cache.c b/MagickCore/cache.c
index 89368056f5441fcd0db65539780c910e68881080..21bcf4efe366e5105f0104317e3f05e0a56ec4b1 100644 (file)
--- a/MagickCore/cache.c
+++ b/MagickCore/cache.c
@@ -1580,6 +1580,9 @@ static Cache GetImagePixelCache(Image *image,const MagickBooleanType clone,
     destroy,
     status;
 
+  MagickSizeType
+    length;
+
   static MagickSizeType
     cache_timelimit = MagickResourceInfinity,
     cpu_throttle = MagickResourceInfinity,
@@ -1606,6 +1609,13 @@ static Cache GetImagePixelCache(Image *image,const MagickBooleanType clone,
 #endif
       ThrowFatalException(ResourceLimitFatalError,"TimeLimitExceeded");
     }
+  length=GetImageListLength(image);
+  if (AcquireMagickResource(ListLengthResource,length) == MagickFalse)
+    {
+      (void) ThrowMagickException(exception,GetMagickModule(),ImageError,
+        "ListLengthExceedsLimit","`%s'",image->filename);
+      return((Cache) NULL);
+    }
   LockSemaphoreInfo(image->semaphore);
   assert(image->cache != (Cache) NULL);
   cache_info=(CacheInfo *) image->cache;
@@ -3485,9 +3495,6 @@ static MagickBooleanType OpenPixelCache(Image *image,const MapMode mode,
     ThrowBinaryException(CacheError,"NoPixelsDefinedInCache",image->filename);
   cache_info=(CacheInfo *) image->cache;
   assert(cache_info->signature == MagickCoreSignature);
-  length=GetImageListLength(image);
-  if (AcquireMagickResource(ListLengthResource,length) == MagickFalse)
-    ThrowBinaryException(ImageError,"ListLengthExceedsLimit",image->filename);
   if ((AcquireMagickResource(WidthResource,image->columns) == MagickFalse) ||
       (AcquireMagickResource(HeightResource,image->rows) == MagickFalse))
     ThrowBinaryException(ImageError,"WidthOrHeightExceedsLimit",

diff --git a/MagickCore/resource.c b/MagickCore/resource.c
index 09352f330d3d2965d01c37b094175523a49c3d89..9df603853b79191d36e1182d5ba78455107d5ce1 100644 (file)
--- a/MagickCore/resource.c
+++ b/MagickCore/resource.c
@@ -1365,6 +1365,7 @@ MagickPrivate MagickBooleanType ResourceComponentGenesis(void)
         100.0));
       limit=DestroyString(limit);
     }
+  (void) SetMagickResourceLimit(ListLengthResource,MagickResourceInfinity);
   limit=GetEnvironmentValue("MAGICK_LIST_LENGTH_LIMIT");
   if (limit != (char *) NULL)
     {