diff --git a/PIL/TiffImagePlugin.py b/PIL/TiffImagePlugin.py index f89c5b784..41bb26d42 100644 --- a/PIL/TiffImagePlugin.py +++ b/PIL/TiffImagePlugin.py @@ -426,6 +426,11 @@ class ImageFileDirectory(collections.MutableMapping): for i in range(i16(fp.read(2))): ifd = fp.read(12) + if len(ifd) != 12: + warnings.warn("Possibly corrupt EXIF data. " + "Expecting to read 12 bytes but only got %d." + % (len(ifd))) + continue tag, typ = i16(ifd), i16(ifd, 2) @@ -476,7 +481,14 @@ class ImageFileDirectory(collections.MutableMapping): else: print("- value:", self[tag]) - self.next = i32(fp.read(4)) + ifd = fp.read(4) + if len(ifd) != 4: + warnings.warn("Possibly corrupt EXIF data. " + "Expecting to read 4 bytes but only got %d." + % (len(ifd))) + return + + self.next = i32(ifd) # save primitives diff --git a/Tests/images/hopper_bad_exif.jpg b/Tests/images/hopper_bad_exif.jpg new file mode 100644 index 000000000..4cfeea1dc Binary files /dev/null and b/Tests/images/hopper_bad_exif.jpg differ diff --git a/Tests/test_file_tiff.py b/Tests/test_file_tiff.py index c51f46a04..745412324 100644 --- a/Tests/test_file_tiff.py +++ b/Tests/test_file_tiff.py @@ -3,6 +3,8 @@ from helper import unittest, PillowTestCase, hopper, py3 from PIL import Image, TiffImagePlugin +import struct + class TestFileTiff(PillowTestCase): @@ -77,6 +79,12 @@ class TestFileTiff(PillowTestCase): im._setup() self.assertEqual(im.info['dpi'], (72., 72.)) + def test_bad_exif(self): + try: + Image.open('Tests/images/hopper_bad_exif.jpg')._getexif() + except struct.error: + self.fail("Bad EXIF data should not pass incorrect values to _binary unpack") + def test_little_endian(self): im = Image.open('Tests/images/16bit.cropped.tif') self.assertEqual(im.getpixel((0, 0)), 480)