https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=8822

diff --git a/MagickCore/draw.c b/MagickCore/draw.c
index f9d511e4c1ae7acf5be2eb400316eaffa67c9cc0..4d7b849d5abef03f9532c50ba8182feb56df85fa 100644 (file)
--- a/MagickCore/draw.c
+++ b/MagickCore/draw.c
@@ -2216,17 +2216,17 @@ static MagickBooleanType CheckPrimitiveExtent(MVGInfo *mvg_info,
   if (extent <= *mvg_info->extent)
     return(MagickTrue);
   *mvg_info->primitive_info=ResizeQuantumMemory(*mvg_info->primitive_info,
-    extent,sizeof(*mvg_info->primitive_info));
+    extent,sizeof(**mvg_info->primitive_info));
   *mvg_info->extent=extent;
   if (*mvg_info->primitive_info != (PrimitiveInfo *) NULL)
     return(MagickTrue);
   /*
-    Reallocation failed, allocate 1 point to facilitate unwinding.
+    Reallocation failed, allocate a primitive to facilitate unwinding.
   */
   (void) ThrowMagickException(mvg_info->exception,GetMagickModule(),
     ResourceLimitError,"MemoryAllocationFailed","`%s'","");
   *mvg_info->primitive_info=AcquireCriticalMemory(
-    sizeof(*mvg_info->primitive_info));
+    sizeof(**mvg_info->primitive_info));
   *mvg_info->extent=1;
   mvg_info->offset=0;
   return(MagickFalse);