From: Cristy <urban-warrior@imagemagick.org>
Date: Thu, 9 Aug 2018 23:27:25 +0000 (-0400)
Subject: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=9782
X-Git-Tag: 7.0.8-10~17
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=6633224fd8b0ac4af50cb0d937df4ece77c933ee;p=imagemagick

https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=9782
---

diff --git a/MagickCore/list.c b/MagickCore/list.c
index 2646d6b7c..f8ad19399 100644
--- a/MagickCore/list.c
+++ b/MagickCore/list.c
@@ -213,17 +213,17 @@ MagickExport Image *CloneImages(const Image *images,const char *scenes,
     *clone_images,
     *image;
 
-  long
-    first,
-    last,
-    step;
-
   register ssize_t
     i;
 
   size_t
     length;
 
+  ssize_t
+    first,
+    last,
+    step;
+
   assert(images != (const Image *) NULL);
   assert(images->signature == MagickCoreSignature);
   assert(scenes != (char *) NULL);
@@ -238,19 +238,20 @@ MagickExport Image *CloneImages(const Image *images,const char *scenes,
   {
     while ((isspace((int) ((unsigned char) *p)) != 0) || (*p == ','))
       p++;
-    first=strtol(p,&p,10);
+    first=(ssize_t) strtol(p,&p,10);
     if (first < 0)
-      first+=(long) length;
+      first+=(ssize_t) length;
     last=first;
     while (isspace((int) ((unsigned char) *p)) != 0)
       p++;
     if (*p == '-')
       {
-        last=strtol(p+1,&p,10);
+        last=(ssize_t) strtol(p+1,&p,10);
         if (last < 0)
-          last+=(long) length;
+          last+=(ssize_t) length;
       }
-    for (step=first > last ? -1 : 1; first != (last+step); first+=step)
+    step=(ssize_t) (first > last ? -1 : 1);
+    for ( ; first != (last+step); first+=step)
     {
       i=0;
       for (next=images; next != (Image *) NULL; next=GetNextImageInList(next))