https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=7922

diff --git a/MagickCore/colormap-private.h b/MagickCore/colormap-private.h
index e49dfecda7236fe242dc7ae5c353fd0d373367f9..6fff7c45dcc0c3b2b9d9972a6fa0454229a4e3ce 100644 (file)
--- a/MagickCore/colormap-private.h
+++ b/MagickCore/colormap-private.h
@@ -31,8 +31,9 @@ static inline ssize_t ConstrainColormapIndex(Image *image,const ssize_t index,
 {
   if ((index < 0) || (index >= (ssize_t) image->colors))
     {
-      (void) ThrowMagickException(exception,GetMagickModule(),CorruptImageError,
-        "InvalidColormapIndex","`%s'",image->filename);
+      if (exception->severity != CorruptImageError)
+        (void) ThrowMagickException(exception,GetMagickModule(),
+          CorruptImageError,"InvalidColormapIndex","`%s'",image->filename);
       return(0);
     }
   return((ssize_t) index);
@@ -43,8 +44,9 @@ static inline void ValidateColormapValue(Image *image,
 { 
   if ((index < 0) || (index >= (ssize_t) image->colors))
     {
-      (void) ThrowMagickException(exception,GetMagickModule(),CorruptImageError,
-        "InvalidColormapIndex","`%s'",image->filename);
+      if (exception->severity != CorruptImageError)
+        (void) ThrowMagickException(exception,GetMagickModule(),
+          CorruptImageError,"InvalidColormapIndex","`%s'",image->filename);
       *target=(Quantum) 0;
     }
   else

diff --git a/MagickCore/exception.c b/MagickCore/exception.c
index 5c4e2a147ae9bb41b5ea2fd3cc28445fd41001ba..46ec2d1014767d04a49ca4e296873397e5ece9f3 100644 (file)
--- a/MagickCore/exception.c
+++ b/MagickCore/exception.c
@@ -54,6 +54,11 @@
 #include "MagickCore/utility.h"
 #include "MagickCore/utility-private.h"
 \f
+/*
+  Define declarations.
+*/
+#define MaxExceptionList  64
+\f
 /*
   Forward declarations.
 */
@@ -421,9 +426,10 @@ MagickExport ExceptionInfo *DestroyExceptionInfo(ExceptionInfo *exception)
         exception->exceptions=(void *) DestroyLinkedList((LinkedListInfo *)
           exception->exceptions,DestroyExceptionElement);
     }
-  else if (exception->exceptions != (void *) NULL)
-    ClearLinkedList((LinkedListInfo *) exception->exceptions,
-      DestroyExceptionElement);
+  else
+    if (exception->exceptions != (void *) NULL)
+      ClearLinkedList((LinkedListInfo *) exception->exceptions,
+        DestroyExceptionElement);
   relinquish=exception->relinquish;
   UnlockSemaphoreInfo(exception->semaphore);
   if (relinquish != MagickFalse)
@@ -925,7 +931,7 @@ MagickExport MagickBooleanType ThrowException(ExceptionInfo *exception,
   assert(exception->signature == MagickCoreSignature);
   LockSemaphoreInfo(exception->semaphore);
   exceptions=(LinkedListInfo *) exception->exceptions;
-  if (GetNumberOfElementsInLinkedList(exceptions) > MagickMaxRecursionDepth)
+  if (GetNumberOfElementsInLinkedList(exceptions) > MaxExceptionList)
     {
       UnlockSemaphoreInfo(exception->semaphore);
       return(MagickTrue);
@@ -959,7 +965,7 @@ MagickExport MagickBooleanType ThrowException(ExceptionInfo *exception,
       exception->description=p->description;
     }
   UnlockSemaphoreInfo(exception->semaphore);
-  if (GetNumberOfElementsInLinkedList(exceptions) == MagickMaxRecursionDepth)
+  if (GetNumberOfElementsInLinkedList(exceptions) == MaxExceptionList)
     (void) ThrowMagickException(exception,GetMagickModule(),ResourceLimitError,
       "TooManyExceptions","(exception processing is suspended)");
   return(MagickTrue);