File 006-Catch-PCX-P-mode-buffer-overrun.patch of Package python-Pillow

Overview Repositories Revisions Requests Users Attributes Meta

File 006-Catch-PCX-P-mode-buffer-overrun.patch of Package python-Pillow

From 93b22b846e0269ee9594ff71a72bec02d2bea8fd Mon Sep 17 00:00:00 2001
From: Andrew Murray <radarhere@users.noreply.github.com>
Date: Sat, 21 Dec 2019 18:38:22 +1100
Subject: [PATCH] Catch PCX P mode buffer overrun

---
 Tests/test_image.py           |   7 ++++++-
 src/libImaging/PcxDecode.c    |   3 +++
 2 files changed, 9 insertions(+), 1 deletion(-)

diff --git a/Tests/test_image.py b/Tests/test_image.py
index cd7621e6b6..33657d56cf 100644
--- a/Tests/test_image.py
+++ b/Tests/test_image.py
@@ -413,7 +413,11 @@ def test_radial_gradient(self):
             self.assert_image_equal(im, target)
 
     def test_overrun(self):
-        for file in ["fli_overrun.bin", "pcx_overrun.bin"]:
+        for file in [
+            "fli_overrun.bin",
+            "pcx_overrun.bin",
+            "pcx_overrun2.bin",
+        ]:
             im = Image.open(os.path.join("Tests/images", file))
             try:
                 im.load()
diff --git a/libImaging/PcxDecode.c b/libImaging/PcxDecode.c
index 67dcc1e085..9e9504ce5f 100644
--- a/libImaging/PcxDecode.c
+++ b/libImaging/PcxDecode.c
@@ -25,6 +25,9 @@ ImagingPcxDecode(Imaging im, ImagingCodecState state, UINT8* buf, Py_ssize_t byt
     if (strcmp(im->mode, "1") == 0 && state->xsize > state->bytes * 8) {
         state->errcode = IMAGING_CODEC_OVERRUN;
         return -1;
+    } else if (strcmp(im->mode, "P") == 0 && state->xsize > state->bytes) {
+        state->errcode = IMAGING_CODEC_OVERRUN;
+        return -1;
     }
 
     ptr = buf;

Places

File 006-Catch-PCX-P-mode-buffer-overrun.patch of Package python-Pillow

Places