Merge pull request #1256 from radarhere/2.8.x

Fixed Tiff handling of bad EXIF data

PIL/TiffImagePlugin.py

@@ -426,6 +426,11 @@ class ImageFileDirectory(collections.MutableMapping):
         for i in range(i16(fp.read(2))):
 
             ifd = fp.read(12)
+            if len(ifd) != 12:
+                warnings.warn("Possibly corrupt EXIF data.  "
+                              "Expecting to read 12 bytes but only got %d."
+                              % (len(ifd)))
+                continue
 
             tag, typ = i16(ifd), i16(ifd, 2)
 
@@ -476,7 +481,14 @@ class ImageFileDirectory(collections.MutableMapping):
                 else:
                     print("- value:", self[tag])
 
-        self.next = i32(fp.read(4))
+        ifd = fp.read(4)
+        if len(ifd) != 4:
+            warnings.warn("Possibly corrupt EXIF data.  "
+                          "Expecting to read 4 bytes but only got %d."
+                          % (len(ifd)))
+            return
+
+        self.next = i32(ifd)
 
     # save primitives
 

Tests/test_file_tiff.py

@@ -3,6 +3,8 @@ from helper import unittest, PillowTestCase, hopper, py3
 
 from PIL import Image, TiffImagePlugin
 
+import struct
+
 
 class TestFileTiff(PillowTestCase):
 
@@ -77,6 +79,12 @@ class TestFileTiff(PillowTestCase):
         im._setup()
         self.assertEqual(im.info['dpi'], (72., 72.))
 
+    def test_bad_exif(self):
+        try:
+            Image.open('Tests/images/hopper_bad_exif.jpg')._getexif()
+        except struct.error:
+            self.fail("Bad EXIF data should not pass incorrect values to _binary unpack")
+
     def test_little_endian(self):
         im = Image.open('Tests/images/16bit.cropped.tif')
         self.assertEqual(im.getpixel((0, 0)), 480)