https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=11444

diff --git a/MagickCore/token.c b/MagickCore/token.c
index 6ce4ed198c81cece81d2188b4a89d2e5ade5bff2..9cafcc2d31aa44b6f077e8a90192247ccd827732 100644 (file)
--- a/MagickCore/token.c
+++ b/MagickCore/token.c
@@ -284,13 +284,17 @@ MagickExport void GetNextToken(const char *start,const char **end,
         if (*p == '>')
           break;
         if (*p == '(')
-          for (p++; *p != '\0'; p++)
           {
-            if (i < (ssize_t) (extent-1))
-              token[i++]=(*p);
-            if ((*p == ')') && (*(p-1) != '\\'))
-              break;
-            if ((size_t) (p-start) >= (extent-1))
+            for (p++; *p != '\0'; p++)
+            {
+              if (i < (ssize_t) (extent-1))
+                token[i++]=(*p);
+              if ((*p == ')') && (*(p-1) != '\\'))
+                break;
+              if ((size_t) (p-start) >= (extent-1))
+                break;
+            }
+            if (*p == '\0')
               break;
           }
         if ((size_t) (p-start) >= (extent-1))