From: Cristy <urban-warrior@imagemagick.org>
Date: Sat, 18 Aug 2018 00:19:35 +0000 (-0400)
Subject: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=9942
X-Git-Tag: 7.0.8-11~70
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=893ae6faf76e86c421814dd2a2d21ce745a4a45f;p=imagemagick

https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=9942
---

diff --git a/MagickCore/draw.c b/MagickCore/draw.c
index 12d645610..bbb84448f 100644
--- a/MagickCore/draw.c
+++ b/MagickCore/draw.c
@@ -5291,7 +5291,8 @@ MagickExport MagickBooleanType DrawPrimitive(Image *image,
         composite_geometry[MagickPathExtent];
 
       Image
-        *composite_image;
+        *composite_image,
+        *composite_images;
 
       ImageInfo
         *clone_info;
@@ -5307,20 +5308,22 @@ MagickExport MagickBooleanType DrawPrimitive(Image *image,
         break;
       clone_info=AcquireImageInfo();
       if (LocaleNCompare(primitive_info->text,"data:",5) == 0)
-        composite_image=ReadInlineImage(clone_info,primitive_info->text,
+        composite_images=ReadInlineImage(clone_info,primitive_info->text,
           exception);
       else
         {
           (void) CopyMagickString(clone_info->filename,primitive_info->text,
             MagickPathExtent);
-          composite_image=ReadImage(clone_info,exception);
+          composite_images=ReadImage(clone_info,exception);
         }
       clone_info=DestroyImageInfo(clone_info);
-      if (composite_image == (Image *) NULL)
+      if (composite_images == (Image *) NULL)
         {
           status=0;
           break;
         }
+      composite_image=RemoveFirstImageFromList(&composite_images);
+      composite_images=DestroyImageList(composite_images);
       (void) SetImageProgressMonitor(composite_image,(MagickProgressMonitor)
         NULL,(void *) NULL);
       x1=(ssize_t) ceil(primitive_info[1].point.x-0.5);