https://github.com/ImageMagick/ImageMagick/issues/539

diff --git a/MagickCore/token.c b/MagickCore/token.c
index aa423a204cd4b51bc01a8d50182c0732ba95bcae..cb72711f2de0706559c2b844a1dea6bc66925856 100644 (file)
--- a/MagickCore/token.c
+++ b/MagickCore/token.c
@@ -181,9 +181,13 @@ MagickExport void GetNextToken(const char *start,const char **end,
   register ssize_t
     i;
 
+  size_t
+    length;
+
   assert(start != (const char *) NULL);
   assert(token != (char *) NULL);
   i=0;
+  length=strlen(start);
   p=start;
   while ((isspace((int) ((unsigned char) *p)) != 0) && (*p != '\0'))
     p++;
@@ -219,6 +223,8 @@ MagickExport void GetNextToken(const char *start,const char **end,
             }
         if (i < (ssize_t) (extent-1))
           token[i++]=(*p);
+        if ((p-start) >= length)
+          break;
       }
       break;
     }
@@ -241,8 +247,12 @@ MagickExport void GetNextToken(const char *start,const char **end,
       if ((p != q) && (*p != ','))
         {
           for ( ; (p < q) && (*p != ','); p++)
+          {
             if (i < (ssize_t) (extent-1))
               token[i++]=(*p);
+            if ((p-start) >= length)
+              break;
+          }
           if (*p == '%')
             if (i < (ssize_t) (extent-1))
               token[i++]=(*p++);
@@ -273,7 +283,11 @@ MagickExport void GetNextToken(const char *start,const char **end,
               token[i++]=(*p);
             if ((*p == ')') && (*(p-1) != '\\'))
               break;
+            if ((p-start) >= length)
+              break;
           }
+        if ((p-start) >= length)
+          break;
       }
       break;
     }