https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=14240

diff --git a/MagickCore/profile.c b/MagickCore/profile.c
index f5c98f4e56c754e96da2160f73a70f5e65374709..a82f32e16c0704023d1152e4ac14862a217c5b6b 100644 (file)
--- a/MagickCore/profile.c
+++ b/MagickCore/profile.c
@@ -1705,28 +1705,51 @@ static void GetProfilesFromResourceBlock(Image *image,
   }
 }
 
+#if defined(MAGICKCORE_XML_DELEGATE)
 static MagickBooleanType ValidateXMPProfile(const StringInfo *profile)
 {
-#if defined(MAGICKCORE_XML_DELEGATE)
-  {
-    xmlDocPtr
-      document;
-    
-    /*
-      Parse XML profile.
-    */
-    document=xmlReadMemory((const char *) GetStringInfoDatum(profile),(int)
-      GetStringInfoLength(profile),"xmp.xml",NULL,XML_PARSE_NOERROR |
-      XML_PARSE_NOWARNING);
-    if (document == (xmlDocPtr) NULL)
-      return(MagickFalse);
-    xmlFreeDoc(document);
-    return(MagickTrue);
-  }
-#else
+  xmlDocPtr
+    document;
+
+  /*
+    Parse XML profile.
+  */
+  document=xmlReadMemory((const char *) GetStringInfoDatum(profile),(int)
+    GetStringInfoLength(profile),"xmp.xml",NULL,XML_PARSE_NOERROR |
+    XML_PARSE_NOWARNING);
+  if (document == (xmlDocPtr) NULL)
+    return(MagickFalse);
+  xmlFreeDoc(document);
   return(MagickTrue);
-#endif
 }
+#else
+static unsigned char *FindNeedleInHaystack(unsigned char *haystack,
+  const char *needle)
+{
+  size_t
+    length;
+
+  unsigned char
+    *c;
+
+  length=strlen(needle);
+  for (c=haystack; *c != '\0'; c++)
+    if (LocaleNCompare((const char *) c,needle,length) == 0)
+      return(c);
+  return((unsigned char *) NULL);
+}
+
+static MagickBooleanType ValidateXMPProfile(const StringInfo *profile)
+{
+  unsigned char
+    *p;
+
+  p=FindNeedleInHaystack(GetStringInfoDatum(profile),"x:xmpmeta");
+  if (p == (unsigned char *) NULL)
+    p=FindNeedleInHaystack(GetStringInfoDatum(profile),"rdf:RDF");
+  return(p == (unsigned char *) NULL ? MagickFalse : MagickTrue);
+}
+#endif
 
 static MagickBooleanType SetImageProfileInternal(Image *image,const char *name,
   const StringInfo *profile,const MagickBooleanType recursive,

diff --git a/MagickCore/xml-tree.c b/MagickCore/xml-tree.c
index 1f0d684da5bbbaa9747389b90402354e6b6929c0..ce4a42ebee36c6ca9a11af9b493840ead4012b04 100644 (file)
--- a/MagickCore/xml-tree.c
+++ b/MagickCore/xml-tree.c
@@ -1494,8 +1494,7 @@ static char *ParseEntities(char *xml,char **entities,int state)
                           sizeof(*extent_xml));
                         if (extent_xml != (char *) NULL)
                           {
-                            memset(extent_xml,0,extent*
-                              sizeof(*extent_xml));
+                            memset(extent_xml,0,extent*sizeof(*extent_xml));
                             (void) CopyMagickString(extent_xml,p,extent*
                               sizeof(*extent_xml));
                           }