python-pillow/Pillow
1
1
Fork 0
mirror of https://github.com/python-pillow/Pillow.git synced 2024-09-21 03:18:57 +03:00
Code Issues Packages Projects Releases Wiki Activity

Incorrect error code checking in TiffDecode.c

Browse Source 
* since Pillow 8.1.0
* CVE-2021-25289
This commit is contained in:
Eric Soroos 2021-01-03 21:35:32 +01:00 committed by Andrew Murray
parent e5839216a5
commit 3fee28eb94
4 changed files with 3 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

BIN
Tests/images/crash-0e16d3bfb83be87356d026d66919deaefca44dac.tif Normal file
View File

Binary file not shown.

BIN
Tests/images/crash-1152ec2d1a1a71395b6f2ce6721c38924d025bf3.tif Normal file
View File

Binary file not shown.

2
Tests/test_tiff_crashes.py
View File

@ -24,6 +24,8 @@ from .helper import on_ci
"Tests/images/crash_1.tif", "Tests/images/crash_1.tif",
"Tests/images/crash_2.tif", "Tests/images/crash_2.tif",
"Tests/images/crash-2020-10-test.tif", "Tests/images/crash-2020-10-test.tif",
"Tests/images/crash-1152ec2d1a1a71395b6f2ce6721c38924d025bf3.tif",
"Tests/images/crash-0e16d3bfb83be87356d026d66919deaefca44dac.tif",
], ],
) )
@pytest.mark.filterwarnings("ignore:Possibly corrupt EXIF data") @pytest.mark.filterwarnings("ignore:Possibly corrupt EXIF data")

3
src/libImaging/TiffDecode.c
View File

@ -282,8 +282,7 @@ _decodeStripYCbCr(Imaging im, ImagingCodecState state, TIFF *tiff) {
img.row_offset = state->y; img.row_offset = state->y;
rows_to_read = min(rows_per_strip, img.height - state->y); rows_to_read = min(rows_per_strip, img.height - state->y);
if (TIFFRGBAImageGet(&img, (UINT32 *)state->buffer, img.width, rows_to_read) == if (!TIFFRGBAImageGet(&img, (UINT32 *)state->buffer, img.width, rows_to_read)) {
-1) {
TRACE(("Decode Error, y: %d\n", state->y)); TRACE(("Decode Error, y: %d\n", state->y));
state->errcode = IMAGING_CODEC_BROKEN; state->errcode = IMAGING_CODEC_BROKEN;
goto decodeycbcr_err; goto decodeycbcr_err;