https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=7163

diff --git a/MagickCore/fx.c b/MagickCore/fx.c
index ab05a5953b7e961521e41acba977d73bb30e4291..2aeab5e028d41fa0fb413a019a84f6a131e20785 100644 (file)
--- a/MagickCore/fx.c
+++ b/MagickCore/fx.c
@@ -1255,7 +1255,6 @@ static double FxGetSymbol(FxInfo *fx_info,const PixelChannel channel,
 {
   char
     *q,
-    subexpression[MagickPathExtent],
     symbol[MagickPathExtent];
 
   const char
@@ -1292,6 +1291,10 @@ static double FxGetSymbol(FxInfo *fx_info,const PixelChannel channel,
   point.y=(double) y;
   if (isalpha((int) ((unsigned char) *(p+1))) == 0)
     {
+      char
+        *subexpression;
+
+      subexpression=AcquireString(expression);
       if (strchr("suv",(int) *p) != (char *) NULL)
         {
           switch (*p)
@@ -1390,6 +1393,7 @@ static double FxGetSymbol(FxInfo *fx_info,const PixelChannel channel,
           if (*p == '.')
             p++;
         }
+      subexpression=DestroyString(subexpression);
     }
   length=GetImageListLength(fx_info->images);
   while (i < 0)