From: Cristy <urban-warrior@imagemagick.org>
Date: Wed, 11 Apr 2018 22:38:39 +0000 (-0400)
Subject: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=7562
X-Git-Tag: 7.0.7-29~135
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=b5e2a88aa06ba324822ff26e0192d158279fdc4a;p=imagemagick

https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=7562
---

diff --git a/coders/caption.c b/coders/caption.c
index 9ae5fe29e..e7026a23c 100644
--- a/coders/caption.c
+++ b/coders/caption.c
@@ -97,7 +97,6 @@ static Image *ReadCAPTIONImage(const ImageInfo *image_info,
   char
     *caption,
     geometry[MagickPathExtent],
-    *property,
     *text;
 
   const char
@@ -141,22 +140,20 @@ static Image *ReadCAPTIONImage(const ImageInfo *image_info,
   */
   option=GetImageOption(image_info,"filename");
   if (option == (const char *) NULL)
-    property=InterpretImageProperties((ImageInfo *) image_info,image,
+    caption=InterpretImageProperties((ImageInfo *) image_info,image,
       image_info->filename,exception);
   else
     if (LocaleNCompare(option,"caption:",8) == 0)
-      property=InterpretImageProperties((ImageInfo *) image_info,image,option+8,
+      caption=InterpretImageProperties((ImageInfo *) image_info,image,option+8,
         exception);
     else
-      property=InterpretImageProperties((ImageInfo *) image_info,image,option,
+      caption=InterpretImageProperties((ImageInfo *) image_info,image,option,
         exception);
-  if (property == (char *) NULL)
+  if (caption == (char *) NULL)
     return(DestroyImageList(image));
-  (void) SetImageProperty(image,"caption",property,exception);
-  property=DestroyString(property);
-  caption=ConstantString(GetImageProperty(image,"caption",exception));
+  (void) SetImageProperty(image,"caption",caption,exception);
   draw_info=CloneDrawInfo(image_info,(DrawInfo *) NULL);
-  width=draw_info->pointsize*strlen(caption);
+  width=(size_t) floor(draw_info->pointsize*strlen(caption)+0.5);
   if (AcquireMagickResource(WidthResource,width) == MagickFalse)
     {
       caption=DestroyString(caption);
@@ -292,8 +289,9 @@ static Image *ReadCAPTIONImage(const ImageInfo *image_info,
   */
   i=FormatMagickCaption(image,draw_info,split,&metrics,&caption,exception);
   (void) CloneString(&draw_info->text,caption);
+  caption=DestroyString(caption);
   (void) FormatLocaleString(geometry,MagickPathExtent,"%+g%+g",MagickMax(
-    draw_info->direction == RightToLeftDirection ? image->columns-
+    draw_info->direction == RightToLeftDirection ? (double) image->columns-
     metrics.bounds.x2 : -metrics.bounds.x1,0.0),draw_info->gravity ==
     UndefinedGravity ? metrics.ascent : 0.0);
   (void) CloneString(&draw_info->geometry,geometry);
@@ -308,7 +306,6 @@ static Image *ReadCAPTIONImage(const ImageInfo *image_info,
       (void) SetImageProperty(image,"caption:pointsize",pointsize,exception);
     }
   draw_info=DestroyDrawInfo(draw_info);
-  caption=DestroyString(caption);
   if (status == MagickFalse)
     {
       image=DestroyImageList(image);
diff --git a/coders/label.c b/coders/label.c
index c6b0294d2..523e12b5b 100644
--- a/coders/label.c
+++ b/coders/label.c
@@ -92,9 +92,6 @@ static Image *ReadLABELImage(const ImageInfo *image_info,
 {
   char
     geometry[MagickPathExtent],
-    *property;
-
-  const char
     *label;
 
   DrawInfo
@@ -127,17 +124,16 @@ static Image *ReadLABELImage(const ImageInfo *image_info,
   (void) ResetImagePage(image,"0x0+0+0");
   if ((image->columns != 0) && (image->rows != 0))
     (void) SetImageBackgroundColor(image,exception);
-  property=InterpretImageProperties((ImageInfo *) image_info,image,
+  label=InterpretImageProperties((ImageInfo *) image_info,image,
     image_info->filename,exception);
-  if (property == (char *) NULL)
+  if (label == (char *) NULL)
     return(DestroyImageList(image));
-  (void) SetImageProperty(image,"label",property,exception);
-  property=DestroyString(property);
-  label=GetImageProperty(image,"label",exception);
+  (void) SetImageProperty(image,"label",label,exception);
   draw_info=CloneDrawInfo(image_info,(DrawInfo *) NULL);
-  width=draw_info->pointsize*strlen(label);
+  width=(size_t) floor(draw_info->pointsize*strlen(label)+0.5);
   if (AcquireMagickResource(WidthResource,width) == MagickFalse)
     {
+      label=DestroyString(label);
       draw_info=DestroyDrawInfo(draw_info);
       ThrowReaderException(ImageError,"WidthOrHeightExceedsLimit");
     }
@@ -189,6 +185,7 @@ static Image *ReadLABELImage(const ImageInfo *image_info,
         }
         if (status == MagickFalse)
           {
+            label=DestroyString(label);
             draw_info=DestroyDrawInfo(draw_info);
             image=DestroyImageList(image);
             return((Image *) NULL);
@@ -226,6 +223,7 @@ static Image *ReadLABELImage(const ImageInfo *image_info,
             status=GetMultilineTypeMetrics(image,draw_info,&metrics,exception);
           }
       }
+   label=DestroyString(label);
    if (status == MagickFalse)
      {
        draw_info=DestroyDrawInfo(draw_info);