Handle packets that cross scan lines

Tests/test_file_tga.py

@@ -97,6 +97,11 @@ def test_id_field_rle():
         assert im.size == (199, 199)
 
 
+def test_cross_scan_line():
+    with Image.open("Tests/images/cross_scan_line.tga") as im:
+        assert_image_equal_tofile(im, "Tests/images/cross_scan_line.png")
+
+
 def test_save(tmp_path):
     test_file = "Tests/images/tga_id_field.tga"
     with Image.open(test_file) as im:

src/libImaging/TgaRleDecode.c

@@ -20,6 +20,8 @@ int
 ImagingTgaRleDecode(Imaging im, ImagingCodecState state, UINT8 *buf, Py_ssize_t bytes) {
     int n, depth;
     UINT8 *ptr;
+    UINT8 extra_data = 0;
+    int extra_bytes = 0;
 
     ptr = buf;
 
@@ -72,8 +74,10 @@ ImagingTgaRleDecode(Imaging im, ImagingCodecState state, UINT8 *buf, Py_ssize_t
             }
 
             if (state->x + n > state->bytes) {
-                state->errcode = IMAGING_CODEC_OVERRUN;
-                return -1;
+                extra_bytes = n; /* full value */
+                n = state->bytes - state->x;
+                extra_bytes -= n;
+                extra_data = ptr[1];
             }
 
             memcpy(state->buffer + state->x, ptr + 1, n);
@@ -82,6 +86,7 @@ ImagingTgaRleDecode(Imaging im, ImagingCodecState state, UINT8 *buf, Py_ssize_t
             bytes -= 1 + n;
         }
 
+        for (;;) {
             state->x += n;
 
             if (state->x >= state->bytes) {
@@ -101,6 +106,24 @@ ImagingTgaRleDecode(Imaging im, ImagingCodecState state, UINT8 *buf, Py_ssize_t
                     return -1;
                 }
             }
+
+            if (extra_bytes == 0) {
+                break;
+            }
+
+            if (state->x > 0) {
+                break;  // assert
+            }
+
+            if (extra_bytes >= state->bytes) {
+                n = state->bytes;
+            } else {
+                n = extra_bytes;
+            }
+            memcpy(state->buffer + state->x, ptr, n);
+            ptr += n;
+            extra_bytes -= n;
+        }
     }
 
     return ptr - buf;