mirror of
https://github.com/python-pillow/Pillow.git
synced 2025-07-10 08:12:33 +03:00
Merge pull request #4504 from hugovk/sgi_fixes
Fix buffer overflow in SGI-RLE decoding
This commit is contained in:
commit
2ef59fdbae
BIN
Tests/images/sgi_crash.bin
Normal file
BIN
Tests/images/sgi_crash.bin
Normal file
Binary file not shown.
BIN
Tests/images/sgi_overrun_expandrowF04.bin
Normal file
BIN
Tests/images/sgi_overrun_expandrowF04.bin
Normal file
Binary file not shown.
14
Tests/test_sgi_crash.py
Normal file
14
Tests/test_sgi_crash.py
Normal file
|
@ -0,0 +1,14 @@
|
||||||
|
#!/usr/bin/env python
|
||||||
|
import pytest
|
||||||
|
from PIL import Image
|
||||||
|
|
||||||
|
|
||||||
|
@pytest.mark.parametrize(
|
||||||
|
"test_file",
|
||||||
|
["Tests/images/sgi_overrun_expandrowF04.bin", "Tests/images/sgi_crash.bin"],
|
||||||
|
)
|
||||||
|
def test_crashes(test_file):
|
||||||
|
with open(test_file, "rb") as f:
|
||||||
|
im = Image.open(f)
|
||||||
|
with pytest.raises(IOError):
|
||||||
|
im.load()
|
|
@ -28,6 +28,7 @@ static void read4B(UINT32* dest, UINT8* buf)
|
||||||
static int expandrow(UINT8* dest, UINT8* src, int n, int z, int xsize)
|
static int expandrow(UINT8* dest, UINT8* src, int n, int z, int xsize)
|
||||||
{
|
{
|
||||||
UINT8 pixel, count;
|
UINT8 pixel, count;
|
||||||
|
int x = 0;
|
||||||
|
|
||||||
for (;n > 0; n--)
|
for (;n > 0; n--)
|
||||||
{
|
{
|
||||||
|
@ -37,9 +38,10 @@ static int expandrow(UINT8* dest, UINT8* src, int n, int z, int xsize)
|
||||||
count = pixel & RLE_MAX_RUN;
|
count = pixel & RLE_MAX_RUN;
|
||||||
if (!count)
|
if (!count)
|
||||||
return count;
|
return count;
|
||||||
if (count > xsize) {
|
if (x + count > xsize) {
|
||||||
return -1;
|
return -1;
|
||||||
}
|
}
|
||||||
|
x += count;
|
||||||
if (pixel & RLE_COPY_FLAG) {
|
if (pixel & RLE_COPY_FLAG) {
|
||||||
while(count--) {
|
while(count--) {
|
||||||
*dest = *src++;
|
*dest = *src++;
|
||||||
|
@ -63,6 +65,7 @@ static int expandrow2(UINT8* dest, const UINT8* src, int n, int z, int xsize)
|
||||||
{
|
{
|
||||||
UINT8 pixel, count;
|
UINT8 pixel, count;
|
||||||
|
|
||||||
|
int x = 0;
|
||||||
|
|
||||||
for (;n > 0; n--)
|
for (;n > 0; n--)
|
||||||
{
|
{
|
||||||
|
@ -73,9 +76,10 @@ static int expandrow2(UINT8* dest, const UINT8* src, int n, int z, int xsize)
|
||||||
count = pixel & RLE_MAX_RUN;
|
count = pixel & RLE_MAX_RUN;
|
||||||
if (!count)
|
if (!count)
|
||||||
return count;
|
return count;
|
||||||
if (count > xsize) {
|
if (x + count > xsize) {
|
||||||
return -1;
|
return -1;
|
||||||
}
|
}
|
||||||
|
x += count;
|
||||||
if (pixel & RLE_COPY_FLAG) {
|
if (pixel & RLE_COPY_FLAG) {
|
||||||
while(count--) {
|
while(count--) {
|
||||||
memcpy(dest, src, 2);
|
memcpy(dest, src, 2);
|
||||||
|
|
Loading…
Reference in New Issue
Block a user