...

diff --git a/MagickCore/draw.c b/MagickCore/draw.c
index 9eae09db7d85896246c6b735bea69dc495f2132d..0e91cf4b44750f74e7a561e0f5286a817ba860c4 100644 (file)
--- a/MagickCore/draw.c
+++ b/MagickCore/draw.c
@@ -2240,19 +2240,22 @@ static MagickBooleanType CheckPrimitiveExtent(MVGInfo *mvg_info,
   /*
     Check if there is enough storage for drawing pimitives.
   */
-  extent=(size_t) mvg_info->offset;
-  if ((HeapOverflowSanityCheck(extent,pad) != MagickFalse) &&
-      (HeapOverflowSanityCheck(extent+pad,4096) != MagickFalse))
+  extent=(size_t) mvg_info->offset+pad;
+  if (~extent >= pad)
     {
-      extent+=pad+4096;
-      if (extent <= *mvg_info->extent)
-        return(MagickTrue);
-      *mvg_info->primitive_info=ResizeQuantumMemory(*mvg_info->primitive_info,
-        extent,sizeof(**mvg_info->primitive_info));
-      if (*mvg_info->primitive_info != (PrimitiveInfo *) NULL)
+      extent+=4096;
+      if (~extent >= 4096)
         {
-          *mvg_info->extent=extent;
-          return(MagickTrue);
+          if (extent <= *mvg_info->extent)
+            return(MagickTrue);
+          *mvg_info->primitive_info=ResizeQuantumMemory(
+            *mvg_info->primitive_info,extent,
+            sizeof(**mvg_info->primitive_info));
+          if (*mvg_info->primitive_info != (PrimitiveInfo *) NULL)
+            {
+              *mvg_info->extent=extent;
+              return(MagickTrue);
+            }
         }
     }
   /*
@@ -2260,7 +2263,7 @@ static MagickBooleanType CheckPrimitiveExtent(MVGInfo *mvg_info,
   */
   (void) ThrowMagickException(mvg_info->exception,GetMagickModule(),
     ResourceLimitError,"MemoryAllocationFailed","`%s'","");
-  *mvg_info->primitive_info=AcquireCriticalMemory(
+  *mvg_info->primitive_info=AcquireCriticalMemory(4*
     sizeof(**mvg_info->primitive_info));
   (void) memset(*mvg_info->primitive_info,0,sizeof(**mvg_info->primitive_info));
   *mvg_info->extent=1;