https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=7562

diff --git a/coders/caption.c b/coders/caption.c
index 9ae5fe29ebdc0f81291799a7b089622f94220072..e7026a23ce25d286b9da799708dee4f073b25195 100644 (file)
--- a/coders/caption.c
+++ b/coders/caption.c
@@ -97,7 +97,6 @@ static Image *ReadCAPTIONImage(const ImageInfo *image_info,
   char
     *caption,
     geometry[MagickPathExtent],
-    *property,
     *text;
 
   const char
@@ -141,22 +140,20 @@ static Image *ReadCAPTIONImage(const ImageInfo *image_info,
   */
   option=GetImageOption(image_info,"filename");
   if (option == (const char *) NULL)
-    property=InterpretImageProperties((ImageInfo *) image_info,image,
+    caption=InterpretImageProperties((ImageInfo *) image_info,image,
       image_info->filename,exception);
   else
     if (LocaleNCompare(option,"caption:",8) == 0)
-      property=InterpretImageProperties((ImageInfo *) image_info,image,option+8,
+      caption=InterpretImageProperties((ImageInfo *) image_info,image,option+8,
         exception);
     else
-      property=InterpretImageProperties((ImageInfo *) image_info,image,option,
+      caption=InterpretImageProperties((ImageInfo *) image_info,image,option,
         exception);
-  if (property == (char *) NULL)
+  if (caption == (char *) NULL)
     return(DestroyImageList(image));
-  (void) SetImageProperty(image,"caption",property,exception);
-  property=DestroyString(property);
-  caption=ConstantString(GetImageProperty(image,"caption",exception));
+  (void) SetImageProperty(image,"caption",caption,exception);
   draw_info=CloneDrawInfo(image_info,(DrawInfo *) NULL);
-  width=draw_info->pointsize*strlen(caption);
+  width=(size_t) floor(draw_info->pointsize*strlen(caption)+0.5);
   if (AcquireMagickResource(WidthResource,width) == MagickFalse)
     {
       caption=DestroyString(caption);
@@ -292,8 +289,9 @@ static Image *ReadCAPTIONImage(const ImageInfo *image_info,
   */
   i=FormatMagickCaption(image,draw_info,split,&metrics,&caption,exception);
   (void) CloneString(&draw_info->text,caption);
+  caption=DestroyString(caption);
   (void) FormatLocaleString(geometry,MagickPathExtent,"%+g%+g",MagickMax(
-    draw_info->direction == RightToLeftDirection ? image->columns-
+    draw_info->direction == RightToLeftDirection ? (double) image->columns-
     metrics.bounds.x2 : -metrics.bounds.x1,0.0),draw_info->gravity ==
     UndefinedGravity ? metrics.ascent : 0.0);
   (void) CloneString(&draw_info->geometry,geometry);
@@ -308,7 +306,6 @@ static Image *ReadCAPTIONImage(const ImageInfo *image_info,
       (void) SetImageProperty(image,"caption:pointsize",pointsize,exception);
     }
   draw_info=DestroyDrawInfo(draw_info);
-  caption=DestroyString(caption);
   if (status == MagickFalse)
     {
       image=DestroyImageList(image);

diff --git a/coders/label.c b/coders/label.c
index c6b0294d29b06f4ecbf5c9f2368e5be52fbf0624..523e12b5b177800b5d4adab58a7ea157b38010b9 100644 (file)
--- a/coders/label.c
+++ b/coders/label.c
@@ -92,9 +92,6 @@ static Image *ReadLABELImage(const ImageInfo *image_info,
 {
   char
     geometry[MagickPathExtent],
-    *property;
-
-  const char
     *label;
 
   DrawInfo
@@ -127,17 +124,16 @@ static Image *ReadLABELImage(const ImageInfo *image_info,
   (void) ResetImagePage(image,"0x0+0+0");
   if ((image->columns != 0) && (image->rows != 0))
     (void) SetImageBackgroundColor(image,exception);
-  property=InterpretImageProperties((ImageInfo *) image_info,image,
+  label=InterpretImageProperties((ImageInfo *) image_info,image,
     image_info->filename,exception);
-  if (property == (char *) NULL)
+  if (label == (char *) NULL)
     return(DestroyImageList(image));
-  (void) SetImageProperty(image,"label",property,exception);
-  property=DestroyString(property);
-  label=GetImageProperty(image,"label",exception);
+  (void) SetImageProperty(image,"label",label,exception);
   draw_info=CloneDrawInfo(image_info,(DrawInfo *) NULL);
-  width=draw_info->pointsize*strlen(label);
+  width=(size_t) floor(draw_info->pointsize*strlen(label)+0.5);
   if (AcquireMagickResource(WidthResource,width) == MagickFalse)
     {
+      label=DestroyString(label);
       draw_info=DestroyDrawInfo(draw_info);
       ThrowReaderException(ImageError,"WidthOrHeightExceedsLimit");
     }
@@ -189,6 +185,7 @@ static Image *ReadLABELImage(const ImageInfo *image_info,
         }
         if (status == MagickFalse)
           {
+            label=DestroyString(label);
             draw_info=DestroyDrawInfo(draw_info);
             image=DestroyImageList(image);
             return((Image *) NULL);
@@ -226,6 +223,7 @@ static Image *ReadLABELImage(const ImageInfo *image_info,
             status=GetMultilineTypeMetrics(image,draw_info,&metrics,exception);
           }
       }
+   label=DestroyString(label);
    if (status == MagickFalse)
      {
        draw_info=DestroyDrawInfo(draw_info);