https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=10202

diff --git a/MagickCore/draw.c b/MagickCore/draw.c
index da190b018a7a123a3a599ea6aa4c05d75c2e2555..4ff763cc81cc78a4d671ad5a36032086cfd5d4d2 100644 (file)
--- a/MagickCore/draw.c
+++ b/MagickCore/draw.c
@@ -2244,7 +2244,7 @@ static MagickBooleanType CheckPrimitiveExtent(MVGInfo *mvg_info,
   if (~extent >= pad)
     {
       extent+=4096;
-      if (~extent >= 4096)
+      if ((~extent >= 4096) && (extent <= GetMaxMemoryRequest()))
         {
           if (extent <= *mvg_info->extent)
             return(MagickTrue);
@@ -2263,6 +2263,9 @@ static MagickBooleanType CheckPrimitiveExtent(MVGInfo *mvg_info,
   */
   (void) ThrowMagickException(mvg_info->exception,GetMagickModule(),
     ResourceLimitError,"MemoryAllocationFailed","`%s'","");
+  if (*mvg_info->primitive_info != (PrimitiveInfo *) NULL)
+    *mvg_info->primitive_info=(PrimitiveInfo *) 
+      RelinquishMagickMemory(*mvg_info->primitive_info);
   *mvg_info->primitive_info=AcquireCriticalMemory(4*
     sizeof(**mvg_info->primitive_info));
   (void) memset(*mvg_info->primitive_info,0,sizeof(**mvg_info->primitive_info));