https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=10058

diff --git a/MagickCore/token.c b/MagickCore/token.c
index 8c37a854422c323fa8baa8f5a7af3ae5a4981047..2231890ecd2545d04d24da4a3709befa1740016c 100644 (file)
--- a/MagickCore/token.c
+++ b/MagickCore/token.c
@@ -44,6 +44,7 @@
 #include "MagickCore/exception.h"
 #include "MagickCore/exception-private.h"
 #include "MagickCore/image.h"
+#include "MagickCore/image-private.h"
 #include "MagickCore/memory_.h"
 #include "MagickCore/memory-private.h"
 #include "MagickCore/string_.h"
@@ -521,7 +522,7 @@ MagickExport MagickBooleanType GlobExpression(const char *expression,
               match=GlobExpression(expression,target,case_insensitive);
               if (match != MagickFalse)
                 {
-                  expression+=strlen(target);
+                  expression+=MagickMin(strlen(expression),strlen(target));
                   break;
                 }
               p=target;