...

diff --git a/MagickCore/effect.c b/MagickCore/effect.c
index e83dcef96be845bf2bcfe259eaf766da8bb0ac60..8e5443aed2da6993429199597d350621a866cf8a 100644 (file)
--- a/MagickCore/effect.c
+++ b/MagickCore/effect.c
@@ -895,7 +895,7 @@ static void Hull(const Image *image,const ssize_t x_offset,
   assert(g != (Quantum *) NULL);
   p=f+(columns+2);
   q=g+(columns+2);
-  r=p+(y_offset*(columns+2)+x_offset);
+  r=p+(y_offset*((ssize_t) columns+2)+x_offset);
 #if defined(MAGICKCORE_OPENMP_SUPPORT)
   #pragma omp parallel for schedule(static) \
     magick_number_threads(image,image,rows,1)
@@ -931,8 +931,8 @@ static void Hull(const Image *image,const ssize_t x_offset,
   }
   p=f+(columns+2);
   q=g+(columns+2);
-  r=q+(y_offset*(columns+2)+x_offset);
-  s=q-(y_offset*(columns+2)+x_offset);
+  r=q+(y_offset*((ssize_t) columns+2)+x_offset);
+  s=q-(y_offset*((ssize_t) columns+2)+x_offset);
 #if defined(MAGICKCORE_OPENMP_SUPPORT)
   #pragma omp parallel for schedule(static) \
     magick_number_threads(image,image,rows,1)

diff --git a/MagickCore/xml-tree.c b/MagickCore/xml-tree.c
index 3597b826df3bd93841c4a8dc11f39f7538693808..1abeeb4f0921378e66f3668c8cafb1d6200e50c2 100644 (file)
--- a/MagickCore/xml-tree.c
+++ b/MagickCore/xml-tree.c
@@ -1403,8 +1403,6 @@ static char *ParseEntities(char *xml,char **entities,int state)
       if (*xml == '\n')
         (void) memmove(xml,xml+1,strlen(xml));
     }
-  if (*xml == '\0')
-    return(ConstantString(xml));
   for (xml=p; ; )
   {
     while ((*xml != '\0') && (*xml != '&') && ((*xml != '%') ||
@@ -1486,13 +1484,16 @@ static char *ParseEntities(char *xml,char **entities,int state)
                     offset=(ssize_t) (xml-p);
                     extent=(size_t) (offset+length+strlen(entity));
                     if (p != q)
-                      p=(char *) ResizeQuantumMemory(p,extent,sizeof(*p));
+                      {
+                        p=(char *) ResizeQuantumMemory(p,extent+1,sizeof(*p));
+                        p[extent]='\0';
+                      }
                     else
                       {
                         char
                           *extent_xml;
 
-                        extent_xml=(char *) AcquireQuantumMemory(extent,
+                        extent_xml=(char *) AcquireQuantumMemory(extent+1,
                           sizeof(*extent_xml));
                         if (extent_xml != (char *) NULL)
                           {