https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=6853

diff --git a/MagickCore/draw.c b/MagickCore/draw.c
index 7417ab85876ac9ac5490b47c9d5d78e90f20cf7f..165ff1c8e65b00561c16c9984b30cc4b091b105c 100644 (file)
--- a/MagickCore/draw.c
+++ b/MagickCore/draw.c
@@ -1676,7 +1676,7 @@ static size_t EllipsePoints(const PrimitiveInfo *primitive_info,
   /*
     Ellipses are just short segmented polys.
   */
-  if ((fabs(stop.x) < DrawEpsilon) && (fabs(stop.y) < DrawEpsilon))
+  if ((fabs(stop.x) < DrawEpsilon) || (fabs(stop.y) < DrawEpsilon))
     return(1);
   delta=2.0/MagickMax(stop.x,stop.y);
   step=MagickPI/8.0;
@@ -5498,7 +5498,7 @@ static void TraceEllipse(PrimitiveInfo *primitive_info,const PointInfo start,
   /*
     Ellipses are just short segmented polys.
   */
-  if ((fabs(stop.x) < DrawEpsilon) && (fabs(stop.y) < DrawEpsilon))
+  if ((fabs(stop.x) < DrawEpsilon) || (fabs(stop.y) < DrawEpsilon))
     {
       TracePoint(primitive_info,start);
       return;