python-pillow/Pillow
1
1
Fork 0
mirror of https://github.com/python-pillow/Pillow.git synced 2025-01-12 18:26:17 +03:00
Code Issues Packages Projects Releases Wiki Activity

Skip additional data if past end of row

Browse Source
This commit is contained in:
Andrew Murray 2022-03-02 11:55:18 +11:00
parent 0ace3fcd26
commit 11f1ba3540
3 changed files with 13 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

BIN
Tests/images/hopper_rle8_row_overflow.bmp Normal file
View File

Binary file not shown.
Side by Side

After

Width:  |  Height:  |  Size: 26 KiB

5
Tests/test_file_bmp.py
View File

@ -134,6 +134,11 @@ def test_rle8():
with Image.open("Tests/images/hopper_rle8.bmp") as im:
assert_image_similar_tofile(im.convert("RGB"), "Tests/images/hopper.bmp", 12)
# This test image has been manually hexedited
# to have rows with too much data
with Image.open("Tests/images/hopper_rle8_row_overflow.bmp") as im:
assert_image_similar_tofile(im.convert("RGB"), "Tests/images/hopper.bmp", 12)
def test_offset():
# This image has been hexedited

8
src/PIL/BmpImagePlugin.py
View File

@ -281,17 +281,23 @@ class BmpRleDecoder(ImageFile.PyDecoder):
def decode(self, buffer):
data = bytearray()
x = 0
while True:
num_pixels = self.fd.read(1)[0]
byte = self.fd.read(1)
if num_pixels:
# encoded mode
if x + num_pixels > self.state.xsize:
# Too much data for row
num_pixels = max(0, self.state.xsize - x)
data += byte * num_pixels
x += num_pixels
else:
if byte[0] == 0:
# end of line
while len(data) % self.state.xsize != 0:
data += b"\x00"
x = 0
elif byte[0] == 1:
# end of bitmap
break
@ -299,9 +305,11 @@ class BmpRleDecoder(ImageFile.PyDecoder):
# delta
right, up = self.fd.read(2)
data += b"\x00" * (right + up * self.state.xsize)
x = len(data) % self.state.xsize
else:
# absolute mode
data += self.fd.read(byte[0])
x += byte[0]
# align to 16-bit word boundary
if self.fd.tell() % 2 != 0: