https://mail.google.com/mail/#inbox/162426a98e65ed90

diff --git a/MagickCore/draw.c b/MagickCore/draw.c
index 0c78a06fc2a02ac11ffec32ebaa88b8fda6efe9a..24bf95b5fcc026f0d6aa52a55b41c9d6d7e94182 100644 (file)
--- a/MagickCore/draw.c
+++ b/MagickCore/draw.c
@@ -1521,7 +1521,7 @@ static MagickBooleanType DrawDashPolygon(const DrawInfo *draw_info,
   for (i=0; primitive_info[i].primitive != UndefinedPrimitive; i++) ;
   number_vertices=(size_t) i;
   dash_polygon=(PrimitiveInfo *) AcquireQuantumMemory((size_t)
-    (2UL*(number_vertices+3UL)+1UL),sizeof(*dash_polygon));
+    (2UL*(number_vertices+3UL)+3UL),sizeof(*dash_polygon));
   if (dash_polygon == (PrimitiveInfo *) NULL)
     return(MagickFalse);
   clone_info=CloneDrawInfo((ImageInfo *) NULL,draw_info);