https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=6196

diff --git a/MagickCore/string.c b/MagickCore/string.c
index 9a0853dab4b2c5a87328d3d015b8c2a3d9f5321d..cafe63c26434d3e4e46c70196c996749ed21baa9 100644 (file)
--- a/MagickCore/string.c
+++ b/MagickCore/string.c
@@ -191,6 +191,7 @@ MagickExport StringInfo *AcquireStringInfo(const size_t length)
       string_info->length+MagickPathExtent,sizeof(*string_info->datum));
   if (string_info->datum == (unsigned char *) NULL)
     ThrowFatalException(ResourceLimitFatalError,"MemoryAllocationFailed");
+  (void) memset(string_info->datum,0,length+MagickPathExtent);
   return(string_info);
 }
 \f
@@ -237,8 +238,7 @@ MagickExport StringInfo *BlobToStringInfo(const void *blob,const size_t length)
     }
   if (blob != (const void *) NULL)
     (void) memcpy(string_info->datum,blob,length);
-  else
-    (void) memset(string_info->datum,0,length);
+  (void) memset(string_info->datum+length,0,MagickPathExtent);
   return(string_info);
 }
 \f
@@ -254,7 +254,7 @@ MagickExport StringInfo *BlobToStringInfo(const void *blob,const size_t length)
 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
 %
 %  CloneString() replaces or frees the destination string to make it
-%  a clone of the input string plus MagickPathExtent more space so the string 
+%  a clone of the input string plus MagickPathExtent more space so the string
 %  may be worked on.
 %
 %  If source is a NULL pointer the destination string will be freed and set to
@@ -1566,7 +1566,7 @@ MagickExport void PrintStringInfo(FILE *file,const char *id,
       break;
     p++;
   }
-  (void) FormatLocaleFile(file,"%s(%.20g): ",id,(double) string_info->length);
+  (void) FormatLocaleFile(file,"%s(%.20g):\n",id,(double) string_info->length);
   if (i == string_info->length)
     {
       for (i=0; i < string_info->length; i++)
@@ -1668,15 +1668,15 @@ MagickExport char *SanitizeString(const char *source)
 
   const char
     *q;
-  
+
   register char
     *p;
-  
+
   static char
     whitelist[] =
       "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789 "
       "$-_.+!*'(),{}|\\^~[]`\"><#%;/?:@&=";
-  
+
   sanitize_source=AcquireString(source);
   p=sanitize_source;
   q=sanitize_source+strlen(sanitize_source);