https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=9782

diff --git a/MagickCore/list.c b/MagickCore/list.c
index 2646d6b7c3908f6832283fd6c344a1baa21ca997..f8ad193997c7aad872b6f0e358ee50312e95ff54 100644 (file)
--- a/MagickCore/list.c
+++ b/MagickCore/list.c
@@ -213,17 +213,17 @@ MagickExport Image *CloneImages(const Image *images,const char *scenes,
     *clone_images,
     *image;
 
-  long
-    first,
-    last,
-    step;
-
   register ssize_t
     i;
 
   size_t
     length;
 
+  ssize_t
+    first,
+    last,
+    step;
+
   assert(images != (const Image *) NULL);
   assert(images->signature == MagickCoreSignature);
   assert(scenes != (char *) NULL);
@@ -238,19 +238,20 @@ MagickExport Image *CloneImages(const Image *images,const char *scenes,
   {
     while ((isspace((int) ((unsigned char) *p)) != 0) || (*p == ','))
       p++;
-    first=strtol(p,&p,10);
+    first=(ssize_t) strtol(p,&p,10);
     if (first < 0)
-      first+=(long) length;
+      first+=(ssize_t) length;
     last=first;
     while (isspace((int) ((unsigned char) *p)) != 0)
       p++;
     if (*p == '-')
       {
-        last=strtol(p+1,&p,10);
+        last=(ssize_t) strtol(p+1,&p,10);
         if (last < 0)
-          last+=(long) length;
+          last+=(ssize_t) length;
       }
-    for (step=first > last ? -1 : 1; first != (last+step); first+=step)
+    step=(ssize_t) (first > last ? -1 : 1);
+    for ( ; first != (last+step); first+=step)
     {
       i=0;
       for (next=images; next != (Image *) NULL; next=GetNextImageInList(next))