From 9615da0641009d8b266c037f597365d29f8b03c0 Mon Sep 17 00:00:00 2001
From: Dirk Lemstra <dirk@git.imagemagick.org>
Date: Sat, 24 Mar 2018 21:55:41 +0100
Subject: [PATCH] Added early exits for GetMultilineTypeMetrics.

---
 MagickCore/annotate.c | 45 ++++++++++++++++++++++++++++++++-----------
 1 file changed, 34 insertions(+), 11 deletions(-)

diff --git a/MagickCore/annotate.c b/MagickCore/annotate.c
index 4a63fb94f..1050a72b7 100644
--- a/MagickCore/annotate.c
+++ b/MagickCore/annotate.c
@@ -782,6 +782,10 @@ MagickExport MagickBooleanType GetMultilineTypeMetrics(Image *image,
   register ssize_t
     i;
 
+  size_t
+    height,
+    count;
+
   TypeMetric
     extent;
 
@@ -799,7 +803,7 @@ MagickExport MagickBooleanType GetMultilineTypeMetrics(Image *image,
   /*
     Convert newlines to multiple lines of text.
   */
-  textlist=StringToList(draw_info->text);
+  textlist=StringToStrings(draw_info->text,&count);
   if (textlist == (char **) NULL)
     return(MagickFalse);
   annotate_info->render=MagickFalse;
@@ -812,21 +816,40 @@ MagickExport MagickBooleanType GetMultilineTypeMetrics(Image *image,
   annotate_info->text=textlist[0];
   status=GetTypeMetrics(image,annotate_info,&extent,exception);
   *metrics=extent;
-  for (i=1; textlist[i] != (char *) NULL; i++)
-  {
-    annotate_info->text=textlist[i];
-    status=GetTypeMetrics(image,annotate_info,&extent,exception);
-    if (extent.width > metrics->width)
-      *metrics=extent;
-  }
-  metrics->height=(double) (i*(size_t) (metrics->ascent-metrics->descent+0.5)+
-    (i-1)*draw_info->interline_spacing);
+  height=(count*(size_t) (metrics->ascent-metrics->descent+
+    0.5)+(count-1)*draw_info->interline_spacing);
+  if (AcquireMagickResource(HeightResource,height) == MagickFalse)
+    {
+      (void) ThrowMagickException(exception,GetMagickModule(),ImageError,
+        "WidthOrHeightExceedsLimit","`%s'",image->filename);
+      status=MagickFalse;
+    }
+  else
+    {
+      for (i=1; i < (ssize_t) count; i++)
+      {
+        annotate_info->text=textlist[i];
+        status=GetTypeMetrics(image,annotate_info,&extent,exception);
+        if (status == MagickFalse)
+          break;
+        if (extent.width > metrics->width)
+          *metrics=extent;
+        if (AcquireMagickResource(WidthResource,extent.width) == MagickFalse)
+          {
+            (void) ThrowMagickException(exception,GetMagickModule(),ImageError,
+              "WidthOrHeightExceedsLimit","`%s'",image->filename);
+            status=MagickFalse;
+            break;
+          }
+      }
+      metrics->height=(double) height;
+    }
   /*
     Relinquish resources.
   */
   annotate_info->text=(char *) NULL;
   annotate_info=DestroyDrawInfo(annotate_info);
-  for (i=0; textlist[i] != (char *) NULL; i++)
+  for (i=0; i < (ssize_t) count; i++)
     textlist[i]=DestroyString(textlist[i]);
   textlist=(char **) RelinquishMagickMemory(textlist);
   return(status);
-- 
2.40.0