Merge pull request #5473 from radarhere/tiff_seek

Do not allow TIFF to seek to a past frame

Tests/test_file_tiff.py

@@ -298,6 +298,19 @@ class TestFileTiff:
             assert im.size == (20, 20)
             assert im.convert("RGB").getpixel((0, 0)) == (0, 0, 255)
 
+    def test_frame_order(self):
+        # A frame can't progress to itself after reading
+        with Image.open("Tests/images/multipage_single_frame_loop.tiff") as im:
+            assert im.n_frames == 1
+
+        # A frame can't progress to a frame that has already been read
+        with Image.open("Tests/images/multipage_multiple_frame_loop.tiff") as im:
+            assert im.n_frames == 2
+
+        # Frames don't have to be in sequence
+        with Image.open("Tests/images/multipage_out_of_order.tiff") as im:
+            assert im.n_frames == 3
+
     def test___str__(self):
         filename = "Tests/images/pil136.tiff"
         with Image.open(filename) as im:

src/PIL/TiffImagePlugin.py

@@ -1079,7 +1079,12 @@ class TiffImageFile(ImageFile.ImageFile):
             self._frame_pos.append(self.__next)
             logger.debug("Loading tags, location: %s" % self.fp.tell())
             self.tag_v2.load(self.fp)
-            self.__next = self.tag_v2.next
+            if self.tag_v2.next in self._frame_pos:
+                # This IFD has already been processed
+                # Declare this to be the end of the image
+                self.__next = 0
+            else:
+                self.__next = self.tag_v2.next
             if self.__next == 0:
                 self._n_frames = frame + 1
             if len(self._frame_pos) == 1: