Merge branch 'main' into docs-link-exceptions

.github/workflows/test-docker.yml

@@ -51,7 +51,6 @@ jobs:
           debian-11-bullseye-amd64,
           debian-12-bookworm-x86,
           debian-12-bookworm-amd64,
-          fedora-37-amd64,
           fedora-38-amd64,
           gentoo,
           ubuntu-20.04-focal-amd64,

CHANGES.rst

@@ -2,6 +2,12 @@
 Changelog (Pillow)
 ==================
 
+10.2.0 (unreleased)
+-------------------
+
+- Fixed frombytes() for images with a zero dimension #7493
+  [radarhere]
+
 10.1.0 (2023-10-15)
 -------------------
 

Tests/test_image.py

@@ -906,6 +906,13 @@ class TestImage:
         im = Image.new("RGB", size)
         assert im.tobytes() == b""
 
+    @pytest.mark.parametrize("size", ((1, 0), (0, 1), (0, 0)))
+    def test_zero_frombytes(self, size):
+        Image.frombytes("RGB", size, b"")
+
+        im = Image.new("RGB", size)
+        im.frombytes(b"")
+
     def test_has_transparency_data(self):
         for mode in ("1", "L", "P", "RGB"):
             im = Image.new(mode, (1, 1))

docs/installation.rst

@@ -42,6 +42,11 @@ Install Pillow with :command:`pip`::
     python3 -m pip install --upgrade pip
     python3 -m pip install --upgrade Pillow
 
+Optionally, install :pypi:`defusedxml` for Pillow to read XMP data,
+and :pypi:`olefile` for Pillow to read FPX and MIC images::
+
+    python3 -m pip install --upgrade defusedxml olefile
+
 
 .. tab:: Linux
 
@@ -456,8 +461,6 @@ These platforms are built and tested for every change.
 +----------------------------------+----------------------------+---------------------+
 | Debian 12 Bookworm               | 3.11                       | x86, x86-64         |
 +----------------------------------+----------------------------+---------------------+
-| Fedora 37                        | 3.11                       | x86-64              |
-+----------------------------------+----------------------------+---------------------+
 | Fedora 38                        | 3.11                       | x86-64              |
 +----------------------------------+----------------------------+---------------------+
 | Gentoo                           | 3.9                        | x86-64              |

docs/releasenotes/10.0.0.rst

@@ -173,7 +173,7 @@ been processed before Pillow started checking for decompression bombs.
 Added ImageFont.MAX_STRING_LENGTH
 ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
 
-To protect against potential DOS attacks when using arbitrary strings as text
+:cve:`2023-44271`: To protect against potential DOS attacks when using arbitrary strings as text
 input, Pillow will now raise a :py:exc:`ValueError` if the number of characters
 passed into ImageFont methods is over a certain limit,
 :py:data:`PIL.ImageFont.MAX_STRING_LENGTH`.

src/PIL/Image.py

@@ -791,6 +791,9 @@ class Image:
         but loads data into this image instead of creating a new image object.
         """
 
+        if self.width == 0 or self.height == 0:
+            return
+
         # may pass tuple instead of argument list
         if len(args) == 1 and isinstance(args[0], tuple):
             args = args[0]
@@ -2967,15 +2970,16 @@ def frombytes(mode, size, data, decoder_name="raw", *args):
 
     _check_size(size)
 
-    # may pass tuple instead of argument list
-    if len(args) == 1 and isinstance(args[0], tuple):
-        args = args[0]
-
-    if decoder_name == "raw" and args == ():
-        args = mode
-
     im = new(mode, size)
-    im.frombytes(data, decoder_name, args)
+    if im.width != 0 and im.height != 0:
+        # may pass tuple instead of argument list
+        if len(args) == 1 and isinstance(args[0], tuple):
+            args = args[0]
+
+        if decoder_name == "raw" and args == ():
+            args = mode
+
+        im.frombytes(data, decoder_name, args)
     return im