Sign Up
Log In
Log In
or
Sign Up
Places
All Projects
Status Monitor
Collapse sidebar
Cloud:OpenStack:Newton
python-Pillow
0010-Crop-decompression.patch
Overview
Repositories
Revisions
Requests
Users
Attributes
Meta
File 0010-Crop-decompression.patch of Package python-Pillow
From c70977aad7196104c975fd89fe0e3f621fa1a84b Mon Sep 17 00:00:00 2001 From: wiredfool <eric-github@soroos.net> Date: Fri, 17 Feb 2017 07:07:14 -0800 Subject: [PATCH 1/2] added decompression bomb check to crop --- PIL/Image.py | 18 +++++++++++++++++- Tests/test_decompression_bomb.py | 23 +++++++++++++++++++---- 2 files changed, 36 insertions(+), 5 deletions(-) diff --git a/PIL/Image.py b/PIL/Image.py index c22ab3955d..9910d21623 100644 --- a/PIL/Image.py +++ b/PIL/Image.py @@ -1021,6 +1021,20 @@ def crop(self, box=None): if box is None: return self.copy() + return self._new(self._crop(self.im, box)) + + def _crop(self, im, box): + """ + Returns a rectangular region from the core image object im. + + This is equivalent to calling im.crop((x0, y0, x1, y1)), but + includes additional sanity checks. + + :param im: a core image object + :param box: The crop rectangle, as a (left, upper, right, lower)-tuple. + :returns: A core image object. + """ + x0, y0, x1, y1 = map(int, map(round, box)) if x1 < x0: @@ -1028,8 +1042,10 @@ def crop(self, box=None): if y1 < y0: y1 = y0 - return self._new(self.im.crop(( x0, y0, x1, y1))) + _decompression_bomb_check((x1, y1)) + return im.crop((x0, y0, x1, y1)) + def draft(self, mode, size): """ Configures the image file loader so it returns a version of the diff --git a/Tests/test_decompression_bomb.py b/Tests/test_decompression_bomb.py index 675005d3f0..5598fd9c87 100644 --- a/Tests/test_decompression_bomb.py +++ b/Tests/test_decompression_bomb.py @@ -1,4 +1,4 @@ -from helper import unittest, PillowTestCase +from helper import unittest, PillowTestCase, hopper from PIL import Image @@ -35,9 +35,24 @@ def test_warning(self): self.assertEqual(Image.MAX_IMAGE_PIXELS, 10) # Act / Assert - self.assert_warning( - Image.DecompressionBombWarning, - lambda: Image.open(TEST_FILE)) + self.assert_warning(Image.DecompressionBombWarning, + lambda: Image.open(TEST_FILE)) + +class TestDecompressionCrop(PillowTestCase): + + def setUp(self): + self.src = hopper() + Image.MAX_IMAGE_PIXELS = self.src.size[1] * self.src.size[0] + + def tearDown(self): + Image.MAX_IMAGE_PIXELS = ORIGINAL_LIMIT + + def testEnlargeCrop(self): + # Crops can extend the extents, therefore we should have the + # same decompression bomb warnings on them. + box = (0, 0, self.src.size[0] * 2, self.src.size[1] * 2) + self.assert_warning(Image.DecompressionBombWarning, + lambda: self.src.crop(box)) if __name__ == '__main__': unittest.main() From 228c5bb292bb72b87bc4d5fc6826a94b47f2edbd Mon Sep 17 00:00:00 2001 From: wiredfool <eric-github@soroos.net> Date: Fri, 17 Feb 2017 07:18:18 -0800 Subject: [PATCH 2/2] using the decompression bomb _crop filter --- PIL/GifImagePlugin.py | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/PIL/GifImagePlugin.py b/PIL/GifImagePlugin.py index b20fdd452d..75158809d3 100644 --- a/PIL/GifImagePlugin.py +++ b/PIL/GifImagePlugin.py @@ -214,7 +214,7 @@ def _seek(self, frame): # only dispose the extent in this frame if self.dispose: - self.dispose = self.dispose.crop(self.dispose_extent) + self.dispose = self._crop(self.dispose, self.dispose_extent) except (AttributeError, KeyError): pass @@ -237,7 +237,7 @@ def load_end(self): if self._prev_im and self.disposal_method == 1: # we do this by pasting the updated area onto the previous # frame which we then use as the current image content - updated = self.im.crop(self.dispose_extent) + updated = self._crop(self.im, self.dispose_extent) self._prev_im.paste(updated, self.dispose_extent, updated.convert('RGBA')) self.im = self._prev_im
Locations
Projects
Search
Status Monitor
Help
OpenBuildService.org
Documentation
API Documentation
Code of Conduct
Contact
Support
@OBShq
Terms
openSUSE Build Service is sponsored by
The Open Build Service is an
openSUSE project
.
Sign Up
Log In
Places
Places
All Projects
Status Monitor