Commit 8fa8b81f5 for imagemagick.org

commit 8fa8b81f56d2caa4c5379da8f14aa2895e74fd1e
Author: Cristy <urban-warrior@imagemagick.org>
Date:   Sun May 17 17:54:19 2026 -0400

    https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-vgh5-r42g-4j44

diff --git a/MagickCore/draw.c b/MagickCore/draw.c
index 12de6fba9..a2162f6b3 100644
--- a/MagickCore/draw.c
+++ b/MagickCore/draw.c
@@ -2453,7 +2453,28 @@ static SplayTreeInfo *GetMVGMacros(const char *primitive)
   return(macros);
 }

-static inline MagickBooleanType IsPoint(const char *point)
+static inline MagickBooleanType IsValidListChar(int c)
+{
+  if ((c >= '0') && (c <= '9'))
+    return(MagickTrue);
+  switch (c)
+  {
+    case '.':
+    case '+':
+    case '-':
+    case ',':
+    case ' ':
+    case '\t':
+    case '\r':
+    case '\n':
+      break;
+    default:
+      return(MagickFalse);
+  }
+  return(MagickTrue);
+}
+
+static inline MagickBooleanType IsValidPoint(const char *point)
 {
   char
     *p;
@@ -2666,30 +2687,45 @@ static MagickBooleanType RenderMVGContent(Image *image,
             (void) GetNextToken(q,&q,extent,token);
             if (*token == ',')
               (void) GetNextToken(q,&q,extent,token);
+            else
+              if (IsValidListChar((int) ((unsigned char) *token)) == MagickFalse)
+                ThrowPointExpectedException(token,exception);
             affine.ry=GetDrawValue(token,&next_token);
             if (token == next_token)
               ThrowPointExpectedException(token,exception);
             (void) GetNextToken(q,&q,extent,token);
             if (*token == ',')
               (void) GetNextToken(q,&q,extent,token);
+            else
+              if (IsValidListChar((int) ((unsigned char) *token)) == MagickFalse)
+                ThrowPointExpectedException(token,exception);
             affine.rx=GetDrawValue(token,&next_token);
             if (token == next_token)
               ThrowPointExpectedException(token,exception);
             (void) GetNextToken(q,&q,extent,token);
             if (*token == ',')
               (void) GetNextToken(q,&q,extent,token);
+            else
+              if (IsValidListChar((int) ((unsigned char) *token)) == MagickFalse)
+                ThrowPointExpectedException(token,exception);
             affine.sy=GetDrawValue(token,&next_token);
             if (token == next_token)
               ThrowPointExpectedException(token,exception);
             (void) GetNextToken(q,&q,extent,token);
             if (*token == ',')
               (void) GetNextToken(q,&q,extent,token);
+            else
+              if (IsValidListChar((int) ((unsigned char) *token)) == MagickFalse)
+                ThrowPointExpectedException(token,exception);
             affine.tx=GetDrawValue(token,&next_token);
             if (token == next_token)
               ThrowPointExpectedException(token,exception);
             (void) GetNextToken(q,&q,extent,token);
             if (*token == ',')
               (void) GetNextToken(q,&q,extent,token);
+            else
+              if (IsValidListChar((int) ((unsigned char) *token)) == MagickFalse)
+                ThrowPointExpectedException(token,exception);
             affine.ty=GetDrawValue(token,&next_token);
             if (token == next_token)
               ThrowPointExpectedException(token,exception);
@@ -3166,7 +3202,7 @@ static MagickBooleanType RenderMVGContent(Image *image,
         if (LocaleCompare("letter-spacing",keyword) == 0)
           {
             (void) GetNextToken(q,&q,extent,token);
-            if (IsPoint(token) == MagickFalse)
+            if (IsValidPoint(token) == MagickFalse)
               break;
             clone_info=CloneDrawInfo((ImageInfo *) NULL,graphic_context[n]);
             clone_info->text=AcquireString(" ");
@@ -3250,7 +3286,8 @@ static MagickBooleanType RenderMVGContent(Image *image,
             if (graphic_context[n]->fill.alpha != (double) TransparentAlpha)
               {
                 graphic_context[n]->fill.alpha=graphic_context[n]->fill_alpha;
-                graphic_context[n]->stroke.alpha=graphic_context[n]->stroke_alpha;
+                graphic_context[n]->stroke.alpha=
+                  graphic_context[n]->stroke_alpha;
               }
             else
               {
@@ -3413,18 +3450,27 @@ static MagickBooleanType RenderMVGContent(Image *image,
                 (void) GetNextToken(q,&q,extent,token);
                 if (*token == ',')
                   (void) GetNextToken(q,&q,extent,token);
+                else
+                  if (IsValidListChar((int) ((unsigned char) *token)) == MagickFalse)
+                    ThrowPointExpectedException(token,exception);
                 segment.y1=GetDrawValue(token,&next_token);
                 if (token == next_token)
                   ThrowPointExpectedException(token,exception);
                 (void) GetNextToken(q,&q,extent,token);
                 if (*token == ',')
                   (void) GetNextToken(q,&q,extent,token);
+                else
+                  if (IsValidListChar((int) ((unsigned char) *token)) == MagickFalse)
+                    ThrowPointExpectedException(token,exception);
                 segment.x2=GetDrawValue(token,&next_token);
                 if (token == next_token)
                   ThrowPointExpectedException(token,exception);
                 (void) GetNextToken(q,&q,extent,token);
                 if (*token == ',')
                   (void) GetNextToken(q,&q,extent,token);
+                else
+                  if (IsValidListChar((int) ((unsigned char) *token)) == MagickFalse)
+                    ThrowPointExpectedException(token,exception);
                 segment.y2=GetDrawValue(token,&next_token);
                 if (token == next_token)
                   ThrowPointExpectedException(token,exception);
@@ -3433,6 +3479,9 @@ static MagickBooleanType RenderMVGContent(Image *image,
                     (void) GetNextToken(q,&q,extent,token);
                     if (*token == ',')
                       (void) GetNextToken(q,&q,extent,token);
+                    else
+                      if (IsValidListChar((int) ((unsigned char) *token)) == MagickFalse)
+                        ThrowPointExpectedException(token,exception);
                   }
                 for (p=q; *q != '\0'; )
                 {
@@ -3533,6 +3582,9 @@ static MagickBooleanType RenderMVGContent(Image *image,
                 (void) GetNextToken(q,&q,extent,token);
                 if (*token == ',')
                   (void) GetNextToken(q,&q,extent,token);
+                else
+                  if (IsValidListChar((int) ((unsigned char) *token)) == MagickFalse)
+                    ThrowPointExpectedException(token,exception);
                 region.y=CastDoubleToSsizeT(ceil(GetDrawValue(token,
                   &next_token)-0.5));
                 if (token == next_token)
@@ -3540,6 +3592,9 @@ static MagickBooleanType RenderMVGContent(Image *image,
                 (void) GetNextToken(q,&q,extent,token);
                 if (*token == ',')
                   (void) GetNextToken(q,&q,extent,token);
+                else
+                  if (IsValidListChar((int) ((unsigned char) *token)) == MagickFalse)
+                    ThrowPointExpectedException(token,exception);
                 region.width=CastDoubleToSizeT(floor(GetDrawValue(token,
                   &next_token)+0.5));
                 if (token == next_token)
@@ -3547,6 +3602,9 @@ static MagickBooleanType RenderMVGContent(Image *image,
                 (void) GetNextToken(q,&q,extent,token);
                 if (*token == ',')
                   (void) GetNextToken(q,&q,extent,token);
+                else
+                  if (IsValidListChar((int) ((unsigned char) *token)) == MagickFalse)
+                    ThrowPointExpectedException(token,exception);
                 region.height=CastDoubleToSizeT(GetDrawValue(token,
                   &next_token)+0.5);
                 if (token == next_token)
@@ -3633,6 +3691,9 @@ static MagickBooleanType RenderMVGContent(Image *image,
             (void) GetNextToken(q,&q,extent,token);
             if (*token == ',')
               (void) GetNextToken(q,&q,extent,token);
+            else
+              if (IsValidListChar((int) ((unsigned char) *token)) == MagickFalse)
+                ThrowPointExpectedException(token,exception);
             affine.sy=GetDrawValue(token,&next_token);
             if (token == next_token)
               ThrowPointExpectedException(token,exception);
@@ -3729,7 +3790,7 @@ static MagickBooleanType RenderMVGContent(Image *image,
             if (graphic_context[n]->dash_pattern != (double *) NULL)
               graphic_context[n]->dash_pattern=(double *)
                 RelinquishMagickMemory(graphic_context[n]->dash_pattern);
-            if (IsPoint(q) != MagickFalse)
+            if (IsValidPoint(q) != MagickFalse)
               {
                 const char
                   *r;
@@ -3738,11 +3799,17 @@ static MagickBooleanType RenderMVGContent(Image *image,
                 (void) GetNextToken(r,&r,extent,token);
                 if (*token == ',')
                   (void) GetNextToken(r,&r,extent,token);
-                for (x=0; IsPoint(token) != MagickFalse; x++)
+                else
+                  if (IsValidListChar((int) ((unsigned char) *token)) == MagickFalse)
+                    ThrowPointExpectedException(token,exception);
+                for (x=0; IsValidPoint(token) != MagickFalse; x++)
                 {
                   (void) GetNextToken(r,&r,extent,token);
                   if (*token == ',')
                     (void) GetNextToken(r,&r,extent,token);
+                  else
+                    if (IsValidListChar((int) ((unsigned char) *token)) == MagickFalse)
+                      ThrowPointExpectedException(token,exception);
                 }
                 graphic_context[n]->dash_pattern=(double *)
                   AcquireQuantumMemory((size_t) (2*x+2),
@@ -3762,6 +3829,9 @@ static MagickBooleanType RenderMVGContent(Image *image,
                   (void) GetNextToken(q,&q,extent,token);
                   if (*token == ',')
                     (void) GetNextToken(q,&q,extent,token);
+                  else
+                    if (IsValidListChar((int) ((unsigned char) *token)) == MagickFalse)
+                      ThrowPointExpectedException(token,exception);
                   graphic_context[n]->dash_pattern[j]=GetDrawValue(token,
                     &next_token);
                   if (token == next_token)
@@ -3925,6 +3995,9 @@ static MagickBooleanType RenderMVGContent(Image *image,
             (void) GetNextToken(q,&q,extent,token);
             if (*token == ',')
               (void) GetNextToken(q,&q,extent,token);
+            else
+              if (IsValidListChar((int) ((unsigned char) *token)) == MagickFalse)
+                ThrowPointExpectedException(token,exception);
             affine.ty=GetDrawValue(token,&next_token);
             if (token == next_token)
               ThrowPointExpectedException(token,exception);
@@ -3972,6 +4045,9 @@ static MagickBooleanType RenderMVGContent(Image *image,
             (void) GetNextToken(q,&q,extent,token);
             if (*token == ',')
               (void) GetNextToken(q,&q,extent,token);
+            else
+              if (IsValidListChar((int) ((unsigned char) *token)) == MagickFalse)
+                ThrowPointExpectedException(token,exception);
             graphic_context[n]->viewbox.y=CastDoubleToSsizeT(
               ceil(GetDrawValue(token,&next_token)-0.5));
             if (token == next_token)
@@ -3979,6 +4055,9 @@ static MagickBooleanType RenderMVGContent(Image *image,
             (void) GetNextToken(q,&q,extent,token);
             if (*token == ',')
               (void) GetNextToken(q,&q,extent,token);
+            else
+              if (IsValidListChar((int) ((unsigned char) *token)) == MagickFalse)
+                ThrowPointExpectedException(token,exception);
             graphic_context[n]->viewbox.width=CastDoubleToSizeT(floor(
               GetDrawValue(token,&next_token)+0.5));
             if (token == next_token)
@@ -3986,6 +4065,9 @@ static MagickBooleanType RenderMVGContent(Image *image,
             (void) GetNextToken(q,&q,extent,token);
             if (*token == ',')
               (void) GetNextToken(q,&q,extent,token);
+            else
+              if (IsValidListChar((int) ((unsigned char) *token)) == MagickFalse)
+                ThrowPointExpectedException(token,exception);
             graphic_context[n]->viewbox.height=CastDoubleToSizeT(floor(
               GetDrawValue(token,&next_token)+0.5));
             if (token == next_token)
@@ -4075,7 +4157,7 @@ static MagickBooleanType RenderMVGContent(Image *image,
       /*
         Define points.
       */
-      if (IsPoint(q) == MagickFalse)
+      if (IsValidPoint(q) == MagickFalse)
         break;
       (void) GetNextToken(q,&q,extent,token);
       point.x=GetDrawValue(token,&next_token);
@@ -4084,6 +4166,9 @@ static MagickBooleanType RenderMVGContent(Image *image,
       (void) GetNextToken(q,&q,extent,token);
       if (*token == ',')
         (void) GetNextToken(q,&q,extent,token);
+      else
+        if (IsValidListChar((int) ((unsigned char) *token)) == MagickFalse)
+          ThrowPointExpectedException(token,exception);
       point.y=GetDrawValue(token,&next_token);
       if (token == next_token)
         ThrowPointExpectedException(token,exception);
@@ -6695,40 +6780,64 @@ static ssize_t TracePath(MVGInfo *mvg_info,const char *path,
           (void) GetNextToken(p,&p,MagickPathExtent,token);
           if (*token == ',')
             (void) GetNextToken(p,&p,MagickPathExtent,token);
+          else
+            if (IsValidListChar((int) ((unsigned char) *token)) == MagickFalse)
+              ThrowPointExpectedException(token,exception);
           arc.x=GetDrawValue(token,&next_token);
           if (token == next_token)
             ThrowPointExpectedException(token,exception);
           (void) GetNextToken(p,&p,MagickPathExtent,token);
           if (*token == ',')
             (void) GetNextToken(p,&p,MagickPathExtent,token);
+          else
+            if (IsValidListChar((int) ((unsigned char) *token)) == MagickFalse)
+              ThrowPointExpectedException(token,exception);
           arc.y=GetDrawValue(token,&next_token);
           if (token == next_token)
             ThrowPointExpectedException(token,exception);
           (void) GetNextToken(p,&p,MagickPathExtent,token);
           if (*token == ',')
             (void) GetNextToken(p,&p,MagickPathExtent,token);
+          else
+            if (IsValidListChar((int) ((unsigned char) *token)) == MagickFalse)
+              ThrowPointExpectedException(token,exception);
           angle=GetDrawValue(token,&next_token);
           if (token == next_token)
             ThrowPointExpectedException(token,exception);
           (void) GetNextToken(p,&p,MagickPathExtent,token);
           if (*token == ',')
             (void) GetNextToken(p,&p,MagickPathExtent,token);
+          else
+            if (IsValidListChar((int) ((unsigned char) *token)) == MagickFalse)
+              ThrowPointExpectedException(token,exception);
           large_arc=StringToLong(token) != 0 ? MagickTrue : MagickFalse;
           (void) GetNextToken(p,&p,MagickPathExtent,token);
           if (*token == ',')
             (void) GetNextToken(p,&p,MagickPathExtent,token);
+          else
+            if (IsValidListChar((int) ((unsigned char) *token)) == MagickFalse)
+              ThrowPointExpectedException(token,exception);
           sweep=StringToLong(token) != 0 ? MagickTrue : MagickFalse;
           if (*token == ',')
             (void) GetNextToken(p,&p,MagickPathExtent,token);
+          else
+            if (IsValidListChar((int) ((unsigned char) *token)) == MagickFalse)
+              ThrowPointExpectedException(token,exception);
           (void) GetNextToken(p,&p,MagickPathExtent,token);
           if (*token == ',')
             (void) GetNextToken(p,&p,MagickPathExtent,token);
+          else
+            if (IsValidListChar((int) ((unsigned char) *token)) == MagickFalse)
+              ThrowPointExpectedException(token,exception);
           x=GetDrawValue(token,&next_token);
           if (token == next_token)
             ThrowPointExpectedException(token,exception);
           (void) GetNextToken(p,&p,MagickPathExtent,token);
           if (*token == ',')
             (void) GetNextToken(p,&p,MagickPathExtent,token);
+          else
+            if (IsValidListChar((int) ((unsigned char) *token)) == MagickFalse)
+              ThrowPointExpectedException(token,exception);
           y=GetDrawValue(token,&next_token);
           if (token == next_token)
             ThrowPointExpectedException(token,exception);
@@ -6744,7 +6853,7 @@ static ssize_t TracePath(MVGInfo *mvg_info,const char *path,
             p++;
           if (*p == ',')
             p++;
-        } while (IsPoint(p) != MagickFalse);
+        } while (IsValidPoint(p) != MagickFalse);
         break;
       }
       case 'c':
@@ -6761,12 +6870,18 @@ static ssize_t TracePath(MVGInfo *mvg_info,const char *path,
             (void) GetNextToken(p,&p,MagickPathExtent,token);
             if (*token == ',')
               (void) GetNextToken(p,&p,MagickPathExtent,token);
+            else
+              if (IsValidListChar((int) ((unsigned char) *token)) == MagickFalse)
+                ThrowPointExpectedException(token,exception);
             x=GetDrawValue(token,&next_token);
             if (token == next_token)
               ThrowPointExpectedException(token,exception);
             (void) GetNextToken(p,&p,MagickPathExtent,token);
             if (*token == ',')
               (void) GetNextToken(p,&p,MagickPathExtent,token);
+            else
+              if (IsValidListChar((int) ((unsigned char) *token)) == MagickFalse)
+                ThrowPointExpectedException(token,exception);
             y=GetDrawValue(token,&next_token);
             if (token == next_token)
               ThrowPointExpectedException(token,exception);
@@ -6786,7 +6901,7 @@ static ssize_t TracePath(MVGInfo *mvg_info,const char *path,
             p++;
           if (*p == ',')
             p++;
-        } while (IsPoint(p) != MagickFalse);
+        } while (IsValidPoint(p) != MagickFalse);
         break;
       }
       case 'H':
@@ -6797,6 +6912,9 @@ static ssize_t TracePath(MVGInfo *mvg_info,const char *path,
           (void) GetNextToken(p,&p,MagickPathExtent,token);
           if (*token == ',')
             (void) GetNextToken(p,&p,MagickPathExtent,token);
+          else
+            if (IsValidListChar((int) ((unsigned char) *token)) == MagickFalse)
+              ThrowPointExpectedException(token,exception);
           x=GetDrawValue(token,&next_token);
           if (token == next_token)
             ThrowPointExpectedException(token,exception);
@@ -6812,7 +6930,7 @@ static ssize_t TracePath(MVGInfo *mvg_info,const char *path,
             p++;
           if (*p == ',')
             p++;
-        } while (IsPoint(p) != MagickFalse);
+        } while (IsValidPoint(p) != MagickFalse);
         break;
       }
       case 'l':
@@ -6826,12 +6944,18 @@ static ssize_t TracePath(MVGInfo *mvg_info,const char *path,
           (void) GetNextToken(p,&p,MagickPathExtent,token);
           if (*token == ',')
             (void) GetNextToken(p,&p,MagickPathExtent,token);
+          else
+            if (IsValidListChar((int) ((unsigned char) *token)) == MagickFalse)
+              ThrowPointExpectedException(token,exception);
           x=GetDrawValue(token,&next_token);
           if (token == next_token)
             ThrowPointExpectedException(token,exception);
           (void) GetNextToken(p,&p,MagickPathExtent,token);
           if (*token == ',')
             (void) GetNextToken(p,&p,MagickPathExtent,token);
+          else
+            if (IsValidListChar((int) ((unsigned char) *token)) == MagickFalse)
+              ThrowPointExpectedException(token,exception);
           y=GetDrawValue(token,&next_token);
           if (token == next_token)
             ThrowPointExpectedException(token,exception);
@@ -6848,7 +6972,7 @@ static ssize_t TracePath(MVGInfo *mvg_info,const char *path,
             p++;
           if (*p == ',')
             p++;
-        } while (IsPoint(p) != MagickFalse);
+        } while (IsValidPoint(p) != MagickFalse);
         break;
       }
       case 'M':
@@ -6871,12 +6995,18 @@ static ssize_t TracePath(MVGInfo *mvg_info,const char *path,
           (void) GetNextToken(p,&p,MagickPathExtent,token);
           if (*token == ',')
             (void) GetNextToken(p,&p,MagickPathExtent,token);
+          else
+            if (IsValidListChar((int) ((unsigned char) *token)) == MagickFalse)
+              ThrowPointExpectedException(token,exception);
           x=GetDrawValue(token,&next_token);
           if (token == next_token)
             ThrowPointExpectedException(token,exception);
           (void) GetNextToken(p,&p,MagickPathExtent,token);
           if (*token == ',')
             (void) GetNextToken(p,&p,MagickPathExtent,token);
+          else
+            if (IsValidListChar((int) ((unsigned char) *token)) == MagickFalse)
+              ThrowPointExpectedException(token,exception);
           y=GetDrawValue(token,&next_token);
           if (token == next_token)
             ThrowPointExpectedException(token,exception);
@@ -6896,7 +7026,7 @@ static ssize_t TracePath(MVGInfo *mvg_info,const char *path,
             p++;
           if (*p == ',')
             p++;
-        } while (IsPoint(p) != MagickFalse);
+        } while (IsValidPoint(p) != MagickFalse);
         break;
       }
       case 'q':
@@ -6913,12 +7043,18 @@ static ssize_t TracePath(MVGInfo *mvg_info,const char *path,
             (void) GetNextToken(p,&p,MagickPathExtent,token);
             if (*token == ',')
               (void) GetNextToken(p,&p,MagickPathExtent,token);
+            else
+              if (IsValidListChar((int) ((unsigned char) *token)) == MagickFalse)
+                ThrowPointExpectedException(token,exception);
             x=GetDrawValue(token,&next_token);
             if (token == next_token)
               ThrowPointExpectedException(token,exception);
             (void) GetNextToken(p,&p,MagickPathExtent,token);
             if (*token == ',')
               (void) GetNextToken(p,&p,MagickPathExtent,token);
+            else
+              if (IsValidListChar((int) ((unsigned char) *token)) == MagickFalse)
+                ThrowPointExpectedException(token,exception);
             y=GetDrawValue(token,&next_token);
             if (token == next_token)
               ThrowPointExpectedException(token,exception);
@@ -6940,7 +7076,7 @@ static ssize_t TracePath(MVGInfo *mvg_info,const char *path,
             p++;
           if (*p == ',')
             p++;
-        } while (IsPoint(p) != MagickFalse);
+        } while (IsValidPoint(p) != MagickFalse);
         break;
       }
       case 's':
@@ -6959,12 +7095,18 @@ static ssize_t TracePath(MVGInfo *mvg_info,const char *path,
             (void) GetNextToken(p,&p,MagickPathExtent,token);
             if (*token == ',')
               (void) GetNextToken(p,&p,MagickPathExtent,token);
+            else
+              if (IsValidListChar((int) ((unsigned char) *token)) == MagickFalse)
+                ThrowPointExpectedException(token,exception);
             x=GetDrawValue(token,&next_token);
             if (token == next_token)
               ThrowPointExpectedException(token,exception);
             (void) GetNextToken(p,&p,MagickPathExtent,token);
             if (*token == ',')
               (void) GetNextToken(p,&p,MagickPathExtent,token);
+            else
+              if (IsValidListChar((int) ((unsigned char) *token)) == MagickFalse)
+                ThrowPointExpectedException(token,exception);
             y=GetDrawValue(token,&next_token);
             if (token == next_token)
               ThrowPointExpectedException(token,exception);
@@ -6992,7 +7134,7 @@ static ssize_t TracePath(MVGInfo *mvg_info,const char *path,
             p++;
           if (*p == ',')
             p++;
-        } while (IsPoint(p) != MagickFalse);
+        } while (IsValidPoint(p) != MagickFalse);
         break;
       }
       case 't':
@@ -7011,12 +7153,18 @@ static ssize_t TracePath(MVGInfo *mvg_info,const char *path,
             (void) GetNextToken(p,&p,MagickPathExtent,token);
             if (*token == ',')
               (void) GetNextToken(p,&p,MagickPathExtent,token);
+            else
+              if (IsValidListChar((int) ((unsigned char) *token)) == MagickFalse)
+                ThrowPointExpectedException(token,exception);
             x=GetDrawValue(token,&next_token);
             if (token == next_token)
               ThrowPointExpectedException(token,exception);
             (void) GetNextToken(p,&p,MagickPathExtent,token);
             if (*token == ',')
               (void) GetNextToken(p,&p,MagickPathExtent,token);
+            else
+              if (IsValidListChar((int) ((unsigned char) *token)) == MagickFalse)
+                ThrowPointExpectedException(token,exception);
             y=GetDrawValue(token,&next_token);
             if (token == next_token)
               ThrowPointExpectedException(token,exception);
@@ -7044,7 +7192,7 @@ static ssize_t TracePath(MVGInfo *mvg_info,const char *path,
             p++;
           if (*p == ',')
             p++;
-        } while (IsPoint(p) != MagickFalse);
+        } while (IsValidPoint(p) != MagickFalse);
         break;
       }
       case 'v':
@@ -7058,6 +7206,9 @@ static ssize_t TracePath(MVGInfo *mvg_info,const char *path,
           (void) GetNextToken(p,&p,MagickPathExtent,token);
           if (*token == ',')
             (void) GetNextToken(p,&p,MagickPathExtent,token);
+          else
+            if (IsValidListChar((int) ((unsigned char) *token)) == MagickFalse)
+              ThrowPointExpectedException(token,exception);
           y=GetDrawValue(token,&next_token);
           if (token == next_token)
             ThrowPointExpectedException(token,exception);
@@ -7073,7 +7224,7 @@ static ssize_t TracePath(MVGInfo *mvg_info,const char *path,
             p++;
           if (*p == ',')
             p++;
-        } while (IsPoint(p) != MagickFalse);
+        } while (IsValidPoint(p) != MagickFalse);
         break;
       }
       case 'z':