diff --git a/PIL/TiffImagePlugin.py b/PIL/TiffImagePlugin.py index a84d01755..9d1877868 100644 --- a/PIL/TiffImagePlugin.py +++ b/PIL/TiffImagePlugin.py @@ -404,6 +404,8 @@ class ImageFileDirectory_v2(collections.MutableMapping): if info.length == 1: if legacy_api and self.tagtype[tag] in [5, 10]: values = values, + if len(values) != 1: + raise TypeError("A tag was malformed") dest[tag], = values else: dest[tag] = values diff --git a/Tests/images/malformed.tiff b/Tests/images/malformed.tiff new file mode 100644 index 000000000..3f6a50c59 Binary files /dev/null and b/Tests/images/malformed.tiff differ diff --git a/Tests/test_file_tiff.py b/Tests/test_file_tiff.py index 308783fb3..3265bb97e 100644 --- a/Tests/test_file_tiff.py +++ b/Tests/test_file_tiff.py @@ -107,6 +107,11 @@ class TestFileTiff(PillowTestCase): self.assertRaises(SyntaxError, lambda: TiffImagePlugin.TiffImageFile(invalid_file)) + def test_malformed_value(self): + malformed_file = "Tests/images/malformed.tiff" + + self.assertRaises(IOError, lambda: Image.open(malformed_file)) + def test_bad_exif(self): i = Image.open('Tests/images/hopper_bad_exif.jpg') try: