From: Dirk Lemstra <dirk@git.imagemagick.org>
Date: Sat, 24 Mar 2018 20:55:41 +0000 (+0100)
Subject: Added early exits for GetMultilineTypeMetrics.
X-Git-Tag: 7.0.7-28~11
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=9615da0641009d8b266c037f597365d29f8b03c0;p=imagemagick

Added early exits for GetMultilineTypeMetrics.
---

diff --git a/MagickCore/annotate.c b/MagickCore/annotate.c
index 4a63fb94f..1050a72b7 100644
--- a/MagickCore/annotate.c
+++ b/MagickCore/annotate.c
@@ -782,6 +782,10 @@ MagickExport MagickBooleanType GetMultilineTypeMetrics(Image *image,
   register ssize_t
     i;
 
+  size_t
+    height,
+    count;
+
   TypeMetric
     extent;
 
@@ -799,7 +803,7 @@ MagickExport MagickBooleanType GetMultilineTypeMetrics(Image *image,
   /*
     Convert newlines to multiple lines of text.
   */
-  textlist=StringToList(draw_info->text);
+  textlist=StringToStrings(draw_info->text,&count);
   if (textlist == (char **) NULL)
     return(MagickFalse);
   annotate_info->render=MagickFalse;
@@ -812,21 +816,40 @@ MagickExport MagickBooleanType GetMultilineTypeMetrics(Image *image,
   annotate_info->text=textlist[0];
   status=GetTypeMetrics(image,annotate_info,&extent,exception);
   *metrics=extent;
-  for (i=1; textlist[i] != (char *) NULL; i++)
-  {
-    annotate_info->text=textlist[i];
-    status=GetTypeMetrics(image,annotate_info,&extent,exception);
-    if (extent.width > metrics->width)
-      *metrics=extent;
-  }
-  metrics->height=(double) (i*(size_t) (metrics->ascent-metrics->descent+0.5)+
-    (i-1)*draw_info->interline_spacing);
+  height=(count*(size_t) (metrics->ascent-metrics->descent+
+    0.5)+(count-1)*draw_info->interline_spacing);
+  if (AcquireMagickResource(HeightResource,height) == MagickFalse)
+    {
+      (void) ThrowMagickException(exception,GetMagickModule(),ImageError,
+        "WidthOrHeightExceedsLimit","`%s'",image->filename);
+      status=MagickFalse;
+    }
+  else
+    {
+      for (i=1; i < (ssize_t) count; i++)
+      {
+        annotate_info->text=textlist[i];
+        status=GetTypeMetrics(image,annotate_info,&extent,exception);
+        if (status == MagickFalse)
+          break;
+        if (extent.width > metrics->width)
+          *metrics=extent;
+        if (AcquireMagickResource(WidthResource,extent.width) == MagickFalse)
+          {
+            (void) ThrowMagickException(exception,GetMagickModule(),ImageError,
+              "WidthOrHeightExceedsLimit","`%s'",image->filename);
+            status=MagickFalse;
+            break;
+          }
+      }
+      metrics->height=(double) height;
+    }
   /*
     Relinquish resources.
   */
   annotate_info->text=(char *) NULL;
   annotate_info=DestroyDrawInfo(annotate_info);
-  for (i=0; textlist[i] != (char *) NULL; i++)
+  for (i=0; i < (ssize_t) count; i++)
     textlist[i]=DestroyString(textlist[i]);
   textlist=(char **) RelinquishMagickMemory(textlist);
   return(status);