From: Cristy <urban-warrior@imagemagick.org>
Date: Fri, 16 Mar 2018 01:20:26 +0000 (-0400)
Subject: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=6932
X-Git-Tag: 7.0.7-27~46
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=472bb6d76177c5320e7ffa6943c2b02dd3157e12;p=imagemagick

https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=6932
---

diff --git a/MagickCore/draw.c b/MagickCore/draw.c
index 04fb4a76c..2120f479c 100644
--- a/MagickCore/draw.c
+++ b/MagickCore/draw.c
@@ -1520,7 +1520,7 @@ static MagickBooleanType DrawDashPolygon(const DrawInfo *draw_info,
   for (i=0; primitive_info[i].primitive != UndefinedPrimitive; i++) ;
   number_vertices=(size_t) i;
   dash_polygon=(PrimitiveInfo *) AcquireQuantumMemory((size_t)
-    (2UL*(number_vertices+2UL)+1UL),sizeof(*dash_polygon));
+    (2UL*(number_vertices+3UL)+1UL),sizeof(*dash_polygon));
   if (dash_polygon == (PrimitiveInfo *) NULL)
     return(MagickFalse);
   clone_info=CloneDrawInfo((ImageInfo *) NULL,draw_info);