https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=6904

diff --git a/MagickCore/string.c b/MagickCore/string.c
index 6cd3c5991daf6b4105b3c81671913e7e1d2c901c..d2d15bc93ba4523282ed38e3d10f4718372fe876 100644 (file)
--- a/MagickCore/string.c
+++ b/MagickCore/string.c
@@ -2409,8 +2409,8 @@ MagickExport char **StringToList(const char *text)
         for (q=p; *q != '\0'; q++)
           if ((*q == '\r') || (*q == '\n'))
             break;
-        textlist[i]=(char *) AcquireQuantumMemory((size_t) (q-p)+
-          MagickPathExtent,sizeof(**textlist));
+        textlist[i]=(char *) AcquireQuantumMemory((size_t) (q-p)+1,
+          sizeof(**textlist));
         if (textlist[i] == (char *) NULL)
           ThrowFatalException(ResourceLimitFatalError,"UnableToConvertText");
         (void) memcpy(textlist[i],p,(size_t) (q-p));