python-pillow/Pillow
1
1
Fork 0
mirror of https://github.com/python-pillow/Pillow.git synced 2025-06-18 20:13:32 +03:00
Code Issues Packages Projects Releases Wiki Activity

Added DecompressionBombError on 2 x pixels of warning, ref #2410

Browse Source
This commit is contained in:
wiredfool 2017-06-21 02:52:18 -07:00
parent 865bc45d72
commit 1a1a2ed001
2 changed files with 20 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
PIL/Image.py
View File

@ -36,6 +36,8 @@ logger = logging.getLogger(__name__)
class DecompressionBombWarning(RuntimeWarning): class DecompressionBombWarning(RuntimeWarning):
pass pass
class DecompressionBombError(Exception):
pass
class _imaging_not_installed(object): class _imaging_not_installed(object):
# module placeholder # module placeholder
@ -2379,6 +2381,12 @@ def _decompression_bomb_check(size):
pixels = size[0] * size[1] pixels = size[0] * size[1]
if pixels > 2 * MAX_IMAGE_PIXELS:
raise DecompressionBombError(
"Image size (%d pixels) exceeds limit of %d pixels, "
"could be decompression bomb DOS attack." %
(pixels, 2* MAX_IMAGE_PIXELS))
if pixels > MAX_IMAGE_PIXELS: if pixels > MAX_IMAGE_PIXELS:
warnings.warn( warnings.warn(
"Image size (%d pixels) exceeds limit of %d pixels, " "Image size (%d pixels) exceeds limit of %d pixels, "

17
Tests/test_decompression_bomb.py
View File

@ -29,15 +29,21 @@ class TestDecompressionBomb(PillowTestCase):
Image.open(TEST_FILE) Image.open(TEST_FILE)
def test_warning(self): def test_warning(self):
# Arrange # Set limit to trigger warning on the test file
# Set limit to a low, easily testable value Image.MAX_IMAGE_PIXELS = 128 * 128 -1
Image.MAX_IMAGE_PIXELS = 10 self.assertEqual(Image.MAX_IMAGE_PIXELS, 128 * 128 - 1)
self.assertEqual(Image.MAX_IMAGE_PIXELS, 10)
# Act / Assert
self.assert_warning(Image.DecompressionBombWarning, self.assert_warning(Image.DecompressionBombWarning,
lambda: Image.open(TEST_FILE)) lambda: Image.open(TEST_FILE))
def test_exception(self):
# Set limit to trigger exception on the test file
Image.MAX_IMAGE_PIXELS = 64 * 128 -1
self.assertEqual(Image.MAX_IMAGE_PIXELS, 64 * 128 - 1)
self.assertRaises(Image.DecompressionBombError,
lambda: Image.open(TEST_FILE))
class TestDecompressionCrop(PillowTestCase): class TestDecompressionCrop(PillowTestCase):
def setUp(self): def setUp(self):
@ -54,5 +60,6 @@ class TestDecompressionCrop(PillowTestCase):
self.assert_warning(Image.DecompressionBombWarning, self.assert_warning(Image.DecompressionBombWarning,
lambda: self.src.crop(box)) lambda: self.src.crop(box))
if __name__ == '__main__': if __name__ == '__main__':
unittest.main() unittest.main()