https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=9360

diff --git a/MagickCore/draw.c b/MagickCore/draw.c
index e469057787721de5eaec88d2a7f3f0f6d961b560..29aad764db7dfe41e15e734111f4f8d082c227d7 100644 (file)
--- a/MagickCore/draw.c
+++ b/MagickCore/draw.c
@@ -2293,6 +2293,7 @@ static SplayTreeInfo *GetMVGMacros(const char *primitive)
             */
             GetNextToken(q,&q,extent,token);
             start=q;
+            end=q;
             (void) CopyMagickString(name,token,MagickPathExtent);
             n=0;
             for (p=q; *q != '\0'; )
@@ -2316,7 +2317,7 @@ static SplayTreeInfo *GetMVGMacros(const char *primitive)
                 }
               if (LocaleCompare(token,"push") == 0)
                 n++;
-              if (n < 0)
+              if ((n < 0) && (end > start))
                 {
                   char
                     *macro;