File ImageMagick-cve-2016-5240.patch of Package ImageMagick-6.7.8.9

diff -up ImageMagick-6.7.8-9/magick/draw.c.svg-endless-loop ImageMagick-6.7.8-9/magick/draw.c
--- ImageMagick-6.7.8-9/magick/draw.c.svg-endless-loop	2012-07-30 14:28:56.000000000 +0200
+++ ImageMagick-6.7.8-9/magick/draw.c	2016-06-03 13:54:20.337142553 +0200
@@ -1569,7 +1569,7 @@ static MagickBooleanType DrawDashPolygon
   status=MagickTrue;
   maximum_length=0.0;
   total_length=0.0;
-  for (i=1; i < (ssize_t) number_vertices; i++)
+  for (i=1; (i < (ssize_t) number_vertices) && (length >= 0.0); i++)
   {
     dx=primitive_info[i].point.x-primitive_info[i-1].point.x;
     dy=primitive_info[i].point.y-primitive_info[i-1].point.y;
@@ -1581,7 +1581,7 @@ static MagickBooleanType DrawDashPolygon
           n=0;
         length=scale*(draw_info->dash_pattern[n]+(n == 0 ? -0.5 : 0.5));
       }
-    for (total_length=0.0; (total_length+length) <= maximum_length; )
+    for (total_length=0.0; (length >= 0.0) && (total_length+length) <= maximum_length; )
     {
       total_length+=length;
       if ((n & 0x01) != 0)
@@ -2561,9 +2561,7 @@ MagickExport MagickBooleanType DrawImage
           }
         if (LocaleCompare("stroke-dasharray",keyword) == 0)
           {
-            if (graphic_context[n]->dash_pattern != (double *) NULL)
-              graphic_context[n]->dash_pattern=(double *)
-                RelinquishMagickMemory(graphic_context[n]->dash_pattern);
+            graphic_context[n]->dash_pattern = RelinquishMagickMemory(graphic_context[n]->dash_pattern);
             if (IsPoint(q) != MagickFalse)
               {
                 const char
@@ -2596,7 +2594,14 @@ MagickExport MagickBooleanType DrawImage
                     GetMagickToken(q,&q,token);
                   graphic_context[n]->dash_pattern[j]=StringToDouble(token,
                     (char **) NULL);
+                  if (graphic_context[n]->dash_pattern[j] < 0.0)
+                    status=MagickFalse;
                 }
+                if (status == MagickFalse)
+                  {
+                    graphic_context[n]->dash_pattern = RelinquishMagickMemory(graphic_context[n]->dash_pattern);
+                    break;
+                  }
                 if ((x & 0x01) != 0)
                   for ( ; j < (2*x); j++)
                     graphic_context[n]->dash_pattern[j]=