https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=6012

diff --git a/MagickCore/coder.c b/MagickCore/coder.c
index 8d98cd91703f02a64bf037ed5a0d1ba8206193b7..4836fc8124400552e0d63b01eca9383d36024c9a 100644 (file)
--- a/MagickCore/coder.c
+++ b/MagickCore/coder.c
@@ -862,7 +862,7 @@ static MagickBooleanType LoadCoderCache(SplayTreeInfo *cache,const char *xml,
           GetNextToken(q,&q,extent,token);
           if (LocaleCompare(keyword,"file") == 0)
             {
-              if (depth > 200)
+              if (depth > MagickMaxRecursionDepth)
                 (void) ThrowMagickException(exception,GetMagickModule(),
                   ConfigureError,"IncludeNodeNestedTooDeeply","`%s'",token);
               else

diff --git a/MagickCore/color.c b/MagickCore/color.c
index f03d986168c255da0447d6cc04d5ca736bc5749a..0d3603e47a920c9a41f1e719de59ad955ee496b8 100644 (file)
--- a/MagickCore/color.c
+++ b/MagickCore/color.c
@@ -2066,7 +2066,7 @@ static MagickBooleanType LoadColorCache(LinkedListInfo *cache,const char *xml,
           GetNextToken(q,&q,extent,token);
           if (LocaleCompare(keyword,"file") == 0)
             {
-              if (depth > 200)
+              if (depth > MagickMaxRecursionDepth)
                 (void) ThrowMagickException(exception,GetMagickModule(),
                   ConfigureError,"IncludeElementNestedTooDeeply","`%s'",token);
               else

diff --git a/MagickCore/configure.c b/MagickCore/configure.c
index ed44d1310fad3d48829fac8a2aeaf119e42c2d95..e02a0ef068748533fe824812ee62c75c2865937d 100644 (file)
--- a/MagickCore/configure.c
+++ b/MagickCore/configure.c
@@ -1214,7 +1214,7 @@ static MagickBooleanType LoadConfigureCache(LinkedListInfo *cache,
           GetNextToken(q,&q,extent,token);
           if (LocaleCompare(keyword,"file") == 0)
             {
-              if (depth > 200)
+              if (depth > MagickMaxRecursionDepth)
                 (void) ThrowMagickException(exception,GetMagickModule(),
                   ConfigureError,"IncludeElementNestedTooDeeply","`%s'",token);
               else

diff --git a/MagickCore/delegate.c b/MagickCore/delegate.c
index f1bd613e2cda06e5e09e4978eb55e433d24d6ad2..ce13fb52af0479bba155c59956e7ffaabcf49275 100644 (file)
--- a/MagickCore/delegate.c
+++ b/MagickCore/delegate.c
@@ -2060,7 +2060,7 @@ static MagickBooleanType LoadDelegateCache(LinkedListInfo *cache,
           GetNextToken(q,&q,extent,token);
           if (LocaleCompare(keyword,"file") == 0)
             {
-              if (depth > 200)
+              if (depth > MagickMaxRecursionDepth)
                 (void) ThrowMagickException(exception,GetMagickModule(),
                   ConfigureError,"IncludeElementNestedTooDeeply","`%s'",token);
               else

diff --git a/MagickCore/fx.c b/MagickCore/fx.c
index 75cea78a46e687df0888db65b7203e1ff4eee869..684a3ce7805849e8c38989c57bf206635429a048 100644 (file)
--- a/MagickCore/fx.c
+++ b/MagickCore/fx.c
@@ -106,7 +106,7 @@
 #define NotEqualOperator  0xfaU
 #define LogicalAndOperator  0xfbU
 #define LogicalOrOperator  0xfcU
-#define ExponentialNotation 0xfdU
+#define ExponentialNotation  0xfdU
 
 struct _FxInfo
 {
@@ -2109,6 +2109,12 @@ static double FxEvaluateSubexpression(FxInfo *fx_info,
     *p;
 
   *beta=0.0;
+  if (*depth > MagickMaxRecursionDepth)
+    {
+      (void) ThrowMagickException(exception,GetMagickModule(),OptionError,
+        "UnableToParseExpression","`%s'",expression);
+      return(0.0);
+    }
   if (exception->severity >= ErrorException)
     return(0.0);
   while (isspace((int) ((unsigned char) *expression)) != 0)

diff --git a/MagickCore/locale.c b/MagickCore/locale.c
index a41e190e25c1a38a05bd47f06515e0198c9f5b44..61466fc5e8ed5af07e475afcffb108408275b3b2 100644 (file)
--- a/MagickCore/locale.c
+++ b/MagickCore/locale.c
@@ -70,7 +70,6 @@
 #  define MAGICKCORE_LOCALE_SUPPORT
 #endif
 #define LocaleFilename  "locale.xml"
-#define MaxRecursionDepth  200
 \f
 /*
   Static declarations.
@@ -1244,7 +1243,7 @@ static MagickBooleanType LoadLocaleCache(SplayTreeInfo *cache,const char *xml,
             }
           if (LocaleCompare(keyword,"file") == 0)
             {
-              if (depth > 200)
+              if (depth > MagickMaxRecursionDepth)
                 (void) ThrowMagickException(exception,GetMagickModule(),
                   ConfigureError,"IncludeElementNestedTooDeeply","`%s'",token);
               else

diff --git a/MagickCore/log.c b/MagickCore/log.c
index 46ea1770c9176c21984c28899e2cd5d6f84c8caa..8f39713f4288bc32b96bb81a1d26824f8f204c60 100644 (file)
--- a/MagickCore/log.c
+++ b/MagickCore/log.c
@@ -1510,7 +1510,7 @@ static MagickBooleanType LoadLogCache(LinkedListInfo *cache,const char *xml,
           GetNextToken(q,&q,extent,token);
           if (LocaleCompare(keyword,"file") == 0)
             {
-              if (depth > 200)
+              if (depth > MagickMaxRecursionDepth)
                 (void) ThrowMagickException(exception,GetMagickModule(),
                   ConfigureError,"IncludeElementNestedTooDeeply","`%s'",token);
               else

diff --git a/MagickCore/magic.c b/MagickCore/magic.c
index ce3635e73082b79a1b43e65c05b50c6fd0ade06d..01e5587e646419cc2d1b39b863eed82696a2ee04 100644 (file)
--- a/MagickCore/magic.c
+++ b/MagickCore/magic.c
@@ -895,7 +895,7 @@ static MagickBooleanType LoadMagicCache(LinkedListInfo *cache,const char *xml,
           GetNextToken(q,&q,extent,token);
           if (LocaleCompare(keyword,"file") == 0)
             {
-              if (depth > 200)
+              if (depth > MagickMaxRecursionDepth)
                 (void) ThrowMagickException(exception,GetMagickModule(),
                   ConfigureError,"IncludeElementNestedTooDeeply","`%s'",token);
               else

diff --git a/MagickCore/mime.c b/MagickCore/mime.c
index 3a9837f4cbd355ec428284206127a67bf9a581fa..0416bc038077d432ca0fc99feb0b119e8b987f78 100644 (file)
--- a/MagickCore/mime.c
+++ b/MagickCore/mime.c
@@ -825,7 +825,7 @@ static MagickBooleanType LoadMimeCache(LinkedListInfo *cache,const char *xml,
     attribute=GetXMLTreeAttribute(include,"file");
     if (attribute != (const char *) NULL)
       {
-        if (depth > 200)
+        if (depth > MagickMaxRecursionDepth)
           (void) ThrowMagickException(exception,GetMagickModule(),
             ConfigureError,"IncludeElementNestedTooDeeply","`%s'",filename);
         else

diff --git a/MagickCore/policy.c b/MagickCore/policy.c
index 7e5ed11fc6c5dee180f90006f92da95e744c0f9b..29ae0df55fe3a646f448f4b31ce4861bfe544ea8 100644 (file)
--- a/MagickCore/policy.c
+++ b/MagickCore/policy.c
@@ -834,7 +834,7 @@ static MagickBooleanType LoadPolicyCache(LinkedListInfo *cache,const char *xml,
           GetNextToken(q,&q,extent,token);
           if (LocaleCompare(keyword,"file") == 0)
             {
-              if (depth > 200)
+              if (depth > MagickMaxRecursionDepth)
                 (void) ThrowMagickException(exception,GetMagickModule(),
                   ConfigureError,"IncludeElementNestedTooDeeply","`%s'",token);
               else

diff --git a/MagickCore/studio.h b/MagickCore/studio.h
index 4b10618365f91e69d5ac49c102c21cad5e0276fc..291f2cfdb7947133dbf7e7e2bd1f6988a821222a 100644 (file)
--- a/MagickCore/studio.h
+++ b/MagickCore/studio.h
@@ -336,6 +336,7 @@ extern int vsnprintf(char *,size_t,const char *,va_list);
 /*
   Magick defines.
 */
+#define MagickMaxRecursionDepth  1024
 #define Swap(x,y) ((x)^=(y), (y)^=(x), (x)^=(y))
 #if defined(_MSC_VER)
 # define DisableMSCWarning(nr) __pragma(warning(push)) \

diff --git a/MagickCore/type.c b/MagickCore/type.c
index 2592f16d7d8742af65f9ce6866cd2d5542b7f422..ff02a7e181dbe8572d9e262a3485d6b801e9eff4 100644 (file)
--- a/MagickCore/type.c
+++ b/MagickCore/type.c
@@ -1138,7 +1138,7 @@ static MagickBooleanType LoadTypeCache(SplayTreeInfo *cache,const char *xml,
           GetNextToken(q,&q,extent,token);
           if (LocaleCompare(keyword,"file") == 0)
             {
-              if (depth > 200)
+              if (depth > MagickMaxRecursionDepth)
                 (void) ThrowMagickException(exception,GetMagickModule(),
                   ConfigureError,"IncludeNodeNestedTooDeeply","`%s'",token);
               else