https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=6078

diff --git a/MagickCore/cache.c b/MagickCore/cache.c
index 21bcf4efe366e5105f0104317e3f05e0a56ec4b1..1b030a0d3af8ded20bb0073be2f966b8bb14b7c0 100644 (file)
--- a/MagickCore/cache.c
+++ b/MagickCore/cache.c
@@ -1612,8 +1612,8 @@ static Cache GetImagePixelCache(Image *image,const MagickBooleanType clone,
   length=GetImageListLength(image);
   if (AcquireMagickResource(ListLengthResource,length) == MagickFalse)
     {
-      (void) ThrowMagickException(exception,GetMagickModule(),ImageError,
-        "ListLengthExceedsLimit","`%s'",image->filename);
+      (void) ThrowMagickException(exception,GetMagickModule(),
+        ResourceLimitError,"ListLengthExceedsLimit","`%s'",image->filename);
       return((Cache) NULL);
     }
   LockSemaphoreInfo(image->semaphore);

diff --git a/coders/xcf.c b/coders/xcf.c
index c45d78bbe621628d8621e50e4c627dd90bebe15d..a257b2fa8b5d7b799307b7f567d113ab75df91b9 100644 (file)
--- a/coders/xcf.c
+++ b/coders/xcf.c
@@ -57,6 +57,7 @@
 #include "MagickCore/property.h"
 #include "MagickCore/quantize.h"
 #include "MagickCore/quantum-private.h"
+#include "MagickCore/resource_.h"
 #include "MagickCore/static.h"
 #include "MagickCore/string_.h"
 #include "MagickCore/module.h"
@@ -1315,6 +1316,8 @@ static Image *ReadXCFImage(const ImageInfo *image_info,ExceptionInfo *exception)
             break;
           }
     } while (foundAllLayers == MagickFalse);
+    if (AcquireMagickResource(ListLengthResource,number_layers) == MagickFalse)
+      ThrowReaderException(ResourceLimitError,"ListLengthExceedsLimit");
     doc_info.number_layers=number_layers;
     offset=SeekBlob(image,oldPos,SEEK_SET); /* restore the position! */
     if (offset < 0)

diff --git a/config/english.xml b/config/english.xml
index 81bec765103ffc2c459072446dbab1c4e0e6a684..23041d51c91ac55dd377f102a0b092d42476fb8c 100644 (file)
--- a/config/english.xml
+++ b/config/english.xml
@@ -515,9 +515,6 @@
         <message name="LeftAndRightImageSizesDiffer">
           left and right image sizes differ
         </message>
-        <message name="ListLengthExceedsLimit">
-          list length exceeds limit
-        </message>
         <message name="NegativeOrZeroImageSize">
           negative or zero image size
         </message>
@@ -1015,12 +1012,15 @@
     <resource>
       <limit>
         <error>
-          <message name="PixelCacheAllocationFailed">
-            pixel cache allocation failed
+          <message name="ListLengthExceedsLimit">
+            list length exceeds limit
           </message>
           <message name="MemoryAllocationFailed">
             memory allocation failed
           </message>
+          <message name="PixelCacheAllocationFailed">
+            pixel cache allocation failed
+          </message>
           <message name="TooManyObjects">
             too many objects
           </message>

diff --git a/config/francais.xml b/config/francais.xml
index 5e94ab57f6716e6184cf387ea524defd2bf2eeb4..3ce9c076f47f9e82c413138b25b91072b2dc54a2 100644 (file)
--- a/config/francais.xml
+++ b/config/francais.xml
@@ -525,9 +525,6 @@
         <message name="LeftAndRightImageSizesDiffer">
           différences dans les tailles des images gauche et droite
         </message>
-        <message name="ListLengthExceedsLimit">
-          list length exceeds limit
-        </message>
         <message name="NegativeOrZeroImageSize">
           Taille d'image négative ou nulle
         </message>
@@ -1006,12 +1003,15 @@
     <resource>
       <limit>
         <error>
-          <message name="PixelCacheAllocationFailed">
-            Échec allocation du cache pixel
+          <message name="ListLengthExceedsLimit">
+            list length exceeds limit
           </message>
           <message name="MemoryAllocationFailed">
             Échec allocation mémoire
           </message>
+          <message name="PixelCacheAllocationFailed">
+            Échec allocation du cache pixel
+          </message>
           <message name="TooManyObjects">
             too many objects
           </message>