From: Cristy <urban-warrior@imagemagick.org>
Date: Mon, 21 May 2018 11:13:26 +0000 (-0400)
Subject: Tighter checks for primitive extents
X-Git-Tag: 7.0.7-35~4
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=4ee3aeb8e61ec2af35ef7c3c3c6843c9afd4a298;p=imagemagick

Tighter checks for primitive extents
---

diff --git a/MagickCore/draw.c b/MagickCore/draw.c
index cb14743bc..f4d6a805a 100644
--- a/MagickCore/draw.c
+++ b/MagickCore/draw.c
@@ -6120,9 +6120,6 @@ static size_t TracePath(MVGInfo *mvg_info,const char *path,
       break;
     last_attribute=attribute;
     attribute=(int) (*p++);
-    if (((size_t) (mvg_info->offset+4096) > *mvg_info->extent) &&
-        (CheckPrimitiveExtent(mvg_info,4096) != MagickFalse))
-      q=(*mvg_info->primitive_info)+mvg_info->offset;
     switch (attribute)
     {
       case 'a':
@@ -6248,6 +6245,9 @@ static size_t TracePath(MVGInfo *mvg_info,const char *path,
           if (token == next_token)
             ThrowPointExpectedException(token,exception);
           point.x=(double) (attribute == (int) 'H' ? x: point.x+x);
+          if (((size_t) (mvg_info->offset+4096) > *mvg_info->extent) &&
+              (CheckPrimitiveExtent(mvg_info,4096) != MagickFalse))
+            q=(*mvg_info->primitive_info)+mvg_info->offset;
           TracePoint(q,point);
           mvg_info->offset+=q->coordinates;
           q+=q->coordinates;
@@ -6280,6 +6280,9 @@ static size_t TracePath(MVGInfo *mvg_info,const char *path,
             ThrowPointExpectedException(token,exception);
           point.x=(double) (attribute == (int) 'L' ? x : point.x+x);
           point.y=(double) (attribute == (int) 'L' ? y : point.y+y);
+          if (((size_t) (mvg_info->offset+4096) > *mvg_info->extent) &&
+              (CheckPrimitiveExtent(mvg_info,4096) != MagickFalse))
+            q=(*mvg_info->primitive_info)+mvg_info->offset;
           TracePoint(q,point);
           mvg_info->offset+=q->coordinates;
           q+=q->coordinates;
@@ -6322,6 +6325,9 @@ static size_t TracePath(MVGInfo *mvg_info,const char *path,
           if (i == 0)
             start=point;
           i++;
+          if (((size_t) (mvg_info->offset+4096) > *mvg_info->extent) &&
+              (CheckPrimitiveExtent(mvg_info,4096) != MagickFalse))
+            q=(*mvg_info->primitive_info)+mvg_info->offset;
           TracePoint(q,point);
           mvg_info->offset+=q->coordinates;
           q+=q->coordinates;
@@ -6492,6 +6498,9 @@ static size_t TracePath(MVGInfo *mvg_info,const char *path,
           if (token == next_token)
             ThrowPointExpectedException(token,exception);
           point.y=(double) (attribute == (int) 'V' ? y : point.y+y);
+          if (((size_t) (mvg_info->offset+4096) > *mvg_info->extent) &&
+              (CheckPrimitiveExtent(mvg_info,4096) != MagickFalse))
+            q=(*mvg_info->primitive_info)+mvg_info->offset;
           TracePoint(q,point);
           mvg_info->offset+=q->coordinates;
           q+=q->coordinates;
@@ -6509,6 +6518,9 @@ static size_t TracePath(MVGInfo *mvg_info,const char *path,
           Close path.
         */
         point=start;
+        if (((size_t) (mvg_info->offset+4096) > *mvg_info->extent) &&
+            (CheckPrimitiveExtent(mvg_info,4096) != MagickFalse))
+          q=(*mvg_info->primitive_info)+mvg_info->offset;
         TracePoint(q,point);
         mvg_info->offset+=q->coordinates;
         q+=q->coordinates;