https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=6952

diff --git a/MagickCore/draw.c b/MagickCore/draw.c
index 2120f479cbc2ff354e7542a8722b1945118bad46..fd87bb20a4f30b788c92298ce685b57ebdd51a6e 100644 (file)
--- a/MagickCore/draw.c
+++ b/MagickCore/draw.c
@@ -1676,12 +1676,14 @@ static size_t EllipsePoints(const PrimitiveInfo *primitive_info,
   /*
     Ellipses are just short segmented polys.
   */
-  if ((fabs(stop.x) < DrawEpsilon) || (fabs(stop.y) < DrawEpsilon))
+  if ((fabs(stop.x) < DrawEpsilon) && (fabs(stop.y) < DrawEpsilon))
     return(1);
   delta=2.0/MagickMax(stop.x,stop.y);
   step=MagickPI/8.0;
   if ((delta >= 0.0) && (delta < (MagickPI/8.0)))
     step=MagickPI/(4*(MagickPI/delta/2+0.5));
+  if (step < 0.0000001)
+    step=0.0000001;
   angle.x=DegreesToRadians(degrees.x);
   y=degrees.y;
   while (y < degrees.x)
@@ -5498,7 +5500,7 @@ static void TraceEllipse(PrimitiveInfo *primitive_info,const PointInfo start,
   /*
     Ellipses are just short segmented polys.
   */
-  if ((fabs(stop.x) < DrawEpsilon) || (fabs(stop.y) < DrawEpsilon))
+  if ((fabs(stop.x) < DrawEpsilon) && (fabs(stop.y) < DrawEpsilon))
     {
       TracePoint(primitive_info,start);
       return;
@@ -5507,6 +5509,8 @@ static void TraceEllipse(PrimitiveInfo *primitive_info,const PointInfo start,
   step=MagickPI/8.0;
   if ((delta >= 0.0) && (delta < (MagickPI/8.0)))
     step=MagickPI/(4*(MagickPI/delta/2+0.5));
+  if (step < 0.0000001)
+    step=0.0000001;
   angle.x=DegreesToRadians(degrees.x);
   y=degrees.y;
   while (y < degrees.x)

diff --git a/configure b/configure
index 33968a89b54e6b91cb0a9e32f7eb0d4f2fb57c87..70c75a9b086a87615669ca7826e7042104c6dc3b 100755 (executable)
--- a/configure
+++ b/configure
@@ -4550,7 +4550,7 @@ MAGICK_PATCHLEVEL_VERSION=27
 
 MAGICK_VERSION=7.0.7-27
 
-MAGICK_GIT_REVISION=23345:05c39cf4e:20180312
+MAGICK_GIT_REVISION=23380:472bb6d76:20180316
 
 
 # Substitute library versioning