python-pillow/Pillow
1
1
Fork 0
mirror of https://github.com/python-pillow/Pillow.git synced 2024-12-26 18:06:18 +03:00
Code Issues Packages Projects Releases Wiki Activity

fixes crash-74d2

Browse Source
This commit is contained in:
Eric Soroos 2021-03-31 21:04:59 +02:00
parent 4044ecc1fb
commit 45530d5ce1
3 changed files with 18 additions and 12 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

BIN
Tests/images/crash-74d2a78403a5a59db1fb0a2b8735ac068a75f6e3.tif Normal file
View File

Binary file not shown.

2
Tests/test_tiff_crashes.py
View File

@ -33,6 +33,8 @@ from .helper import on_ci
"Tests/images/crash-86214e58da443d2b80820cff9677a38a33dcbbca.tif", "Tests/images/crash-86214e58da443d2b80820cff9677a38a33dcbbca.tif",
"Tests/images/crash-f46f5b2f43c370fe65706c11449f567ecc345e74.tif", "Tests/images/crash-f46f5b2f43c370fe65706c11449f567ecc345e74.tif",
"Tests/images/crash-63b1dffefc8c075ddc606c0a2f5fdc15ece78863.tif", "Tests/images/crash-63b1dffefc8c075ddc606c0a2f5fdc15ece78863.tif",
"Tests/images/crash-74d2a78403a5a59db1fb0a2b8735ac068a75f6e3.tif",
], ],
) )
@pytest.mark.filterwarnings("ignore:Possibly corrupt EXIF data") @pytest.mark.filterwarnings("ignore:Possibly corrupt EXIF data")

28
src/libImaging/TiffDecode.c
View File

@ -265,7 +265,7 @@ _decodeAsRGBA(Imaging im, ImagingCodecState state, TIFF *tiff) {
ret = TIFFGetFieldDefaulted(tiff, TIFFTAG_ROWSPERSTRIP, &rows_per_block); ret = TIFFGetFieldDefaulted(tiff, TIFFTAG_ROWSPERSTRIP, &rows_per_block);
} }
if (ret != 1) { if (ret != 1 || rows_per_block==(UINT32)(-1)) {
rows_per_block = state->ysize; rows_per_block = state->ysize;
} }
@ -281,17 +281,6 @@ _decodeAsRGBA(Imaging im, ImagingCodecState state, TIFF *tiff) {
img.req_orientation = ORIENTATION_TOPLEFT; img.req_orientation = ORIENTATION_TOPLEFT;
img.col_offset = 0; img.col_offset = 0;
if (state->xsize != img.width || state->ysize != img.height) {
TRACE(
("Inconsistent Image Error: %d =? %d, %d =? %d",
state->xsize,
img.width,
state->ysize,
img.height));
state->errcode = IMAGING_CODEC_BROKEN;
goto decodergba_err;
}
/* overflow check for row byte size */ /* overflow check for row byte size */
if (INT_MAX / 4 < img.width) { if (INT_MAX / 4 < img.width) {
state->errcode = IMAGING_CODEC_MEMORY; state->errcode = IMAGING_CODEC_MEMORY;
@ -559,6 +548,7 @@ ImagingLibTiffDecode(
uint16 planarconfig = 0; uint16 planarconfig = 0;
int planes = 1; int planes = 1;
ImagingShuffler unpackers[4]; ImagingShuffler unpackers[4];
UINT32 img_width, img_height;
memset(unpackers, 0, sizeof(ImagingShuffler) * 4); memset(unpackers, 0, sizeof(ImagingShuffler) * 4);
@ -655,6 +645,20 @@ ImagingLibTiffDecode(
} }
} }
TIFFGetField(tiff, TIFFTAG_IMAGEWIDTH, &img_width);
TIFFGetField(tiff, TIFFTAG_IMAGELENGTH, &img_height);
if (state->xsize != img_width || state->ysize != img_height) {
TRACE(
("Inconsistent Image Error: %d =? %d, %d =? %d",
state->xsize,
img_width,
state->ysize,
img_height));
state->errcode = IMAGING_CODEC_BROKEN;
goto decode_err;
}
TIFFGetField(tiff, TIFFTAG_PHOTOMETRIC, &photometric); TIFFGetField(tiff, TIFFTAG_PHOTOMETRIC, &photometric);
TIFFGetField(tiff, TIFFTAG_COMPRESSION, &compression); TIFFGetField(tiff, TIFFTAG_COMPRESSION, &compression);