From a736d2d913aaf23ecad2e52e1d46981503e67071 Mon Sep 17 00:00:00 2001
From: Cristy <urban-warrior@imagemagick.org>
Date: Wed, 2 May 2018 17:46:17 -0400
Subject: [PATCH] ...

---
 MagickCore/draw.c | 78 ++++++++++++++++++++++++++++++++++++-----------
 1 file changed, 61 insertions(+), 17 deletions(-)

diff --git a/MagickCore/draw.c b/MagickCore/draw.c
index 4df5e0bfc..d76af91d2 100644
--- a/MagickCore/draw.c
+++ b/MagickCore/draw.c
@@ -1809,7 +1809,7 @@ static inline MagickBooleanType IsPoint(const char *point)
 }
 
 static size_t ReckonEllipseCoordinates(const PointInfo radii,
-  const PointInfo degrees)
+  const PointInfo arc)
 {
   double
     delta,
@@ -1828,9 +1828,9 @@ static size_t ReckonEllipseCoordinates(const PointInfo radii,
   step=MagickPI/8.0;
   if ((delta >= 0.0) && (delta < (MagickPI/8.0)))
     step=MagickPI/(4.0*(MagickPI*PerceptibleReciprocal(delta)/2.0));
-  angle.x=DegreesToRadians(degrees.x);
-  y=degrees.y;
-  while (y < degrees.x)
+  angle.x=DegreesToRadians(arc.x);
+  y=arc.y;
+  while (y < arc.x)
     y+=360.0;
   angle.y=DegreesToRadians(y);
   return((size_t) floor((angle.y-angle.x)/step+0.5)+3);
@@ -3412,6 +3412,16 @@ MagickExport MagickBooleanType DrawImage(Image *image,const DrawInfo *draw_info,
             status=MagickFalse;
             break;
           }
+        if ((primitive_info[j+1].point.x-primitive_info[j].point.x) < 0.0)
+          {
+            status=MagickFalse;
+            break;
+          }
+        if ((primitive_info[j+1].point.y-primitive_info[j].point.y) < 0.0)
+          {
+            status=MagickFalse;
+            break;
+          }
         TraceRectangle(primitive_info+j,primitive_info[j].point,
           primitive_info[j+1].point);
         i=(ssize_t) (j+primitive_info[j].coordinates);
@@ -3424,6 +3434,22 @@ MagickExport MagickBooleanType DrawImage(Image *image,const DrawInfo *draw_info,
             status=MagickFalse;
             break;
           }
+        if ((primitive_info[j+2].point.x < 0.0) || 
+            (primitive_info[j+2].point.y < 0.0))
+          {
+            status=MagickFalse;
+            break;
+          }
+        if ((primitive_info[j+1].point.x-primitive_info[j].point.x) < 0.0)
+          {
+            status=MagickFalse;
+            break;
+          }
+        if ((primitive_info[j+1].point.y-primitive_info[j].point.y) < 0.0)
+          {
+            status=MagickFalse;
+            break;
+          }
         TraceRoundRectangle(primitive_info+j,primitive_info[j].point,
           primitive_info[j+1].point,primitive_info[j+2].point);
         i=(ssize_t) (j+primitive_info[j].coordinates);
@@ -3448,6 +3474,12 @@ MagickExport MagickBooleanType DrawImage(Image *image,const DrawInfo *draw_info,
             status=MagickFalse;
             break;
           }
+        if ((primitive_info[j+1].point.x < 0.0) ||
+            (primitive_info[j+1].point.y < 0.0))
+          {
+            status=MagickFalse;
+            break;
+          }
         TraceEllipse(primitive_info+j,primitive_info[j].point,
           primitive_info[j+1].point,primitive_info[j+2].point);
         i=(ssize_t) (j+primitive_info[j].coordinates);
@@ -3466,9 +3498,21 @@ MagickExport MagickBooleanType DrawImage(Image *image,const DrawInfo *draw_info,
         break;
       }
       case PolylinePrimitive:
+      {
+        if (primitive_info[j].coordinates < 1)
+          {
+            status=MagickFalse;
+            break;
+          }
         break;
+      }
       case PolygonPrimitive:
       {
+        if (primitive_info[j].coordinates < 3)
+          {
+            status=MagickFalse;
+            break;
+          }
         primitive_info[i]=primitive_info[j];
         primitive_info[i].coordinates=0;
         primitive_info[j].coordinates++;
@@ -5473,13 +5517,13 @@ static void TraceArc(PrimitiveInfo *primitive_info,const PointInfo start,
 {
   PointInfo
     center,
-    radii;
+    radius;
 
   center.x=0.5*(end.x+start.x);
   center.y=0.5*(end.y+start.y);
-  radii.x=fabs(center.x-start.x);
-  radii.y=fabs(center.y-start.y);
-  TraceEllipse(primitive_info,center,radii,degrees);
+  radius.x=fabs(center.x-start.x);
+  radius.y=fabs(center.y-start.y);
+  TraceEllipse(primitive_info,center,radius,degrees);
 }
 
 static void TraceArcPath(PrimitiveInfo *primitive_info,const PointInfo start,
@@ -5729,8 +5773,8 @@ static void TraceCircle(PrimitiveInfo *primitive_info,const PointInfo start,
   TraceEllipse(primitive_info,start,offset,degrees);
 }
 
-static void TraceEllipse(PrimitiveInfo *primitive_info,const PointInfo start,
-  const PointInfo radii,const PointInfo degrees)
+static void TraceEllipse(PrimitiveInfo *primitive_info,const PointInfo center,
+  const PointInfo radii,const PointInfo arc)
 {
   double
     delta,
@@ -5757,20 +5801,20 @@ static void TraceEllipse(PrimitiveInfo *primitive_info,const PointInfo start,
   step=MagickPI/8.0;
   if ((delta >= 0.0) && (delta < (MagickPI/8.0)))
     step=MagickPI/(4.0*(MagickPI*PerceptibleReciprocal(delta)/2.0));
-  angle.x=DegreesToRadians(degrees.x);
-  y=degrees.y;
-  while (y < degrees.x)
+  angle.x=DegreesToRadians(arc.x);
+  y=arc.y;
+  while (y < arc.x)
     y+=360.0;
   angle.y=DegreesToRadians(y);
   for (p=primitive_info; angle.x < angle.y; angle.x+=step)
   {
-    point.x=cos(fmod(angle.x,DegreesToRadians(360.0)))*radii.x+start.x;
-    point.y=sin(fmod(angle.x,DegreesToRadians(360.0)))*radii.y+start.y;
+    point.x=cos(fmod(angle.x,DegreesToRadians(360.0)))*radii.x+center.x;
+    point.y=sin(fmod(angle.x,DegreesToRadians(360.0)))*radii.y+center.y;
     TracePoint(p,point);
     p+=p->coordinates;
   }
-  point.x=cos(fmod(angle.y,DegreesToRadians(360.0)))*radii.x+start.x;
-  point.y=sin(fmod(angle.y,DegreesToRadians(360.0)))*radii.y+start.y;
+  point.x=cos(fmod(angle.y,DegreesToRadians(360.0)))*radii.x+center.x;
+  point.y=sin(fmod(angle.y,DegreesToRadians(360.0)))*radii.y+center.y;
   TracePoint(p,point);
   p+=p->coordinates;
   primitive_info->coordinates=(size_t) (p-primitive_info);
-- 
2.40.0