python-pillow/Pillow
1
1
Fork 0
mirror of https://github.com/python-pillow/Pillow.git synced 2025-07-27 08:30:05 +03:00
Code Issues Packages Projects Releases Wiki Activity

Fix buffer overflow for BcnEncode

Browse Source
This commit is contained in:
Eric Soroos 2025-05-02 11:50:26 +02:00 committed by Andrew Murray
parent 1788ab7887
commit 466d228135
2 changed files with 18 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

15
Tests/test_file_dds.py
View File

@ -511,3 +511,18 @@ def test_save_dx10_bc5(tmp_path: Path) -> None:
im = hopper("L")
with pytest.raises(OSError, match="only RGB mode can be written as BC5"):
im.save(out, pixel_format="BC5")
@pytest.mark.parametrize(
"pixel_format, mode",
(
('DXT1', 'RGBA'),
('DXT3', 'RGBA'),
('BC2', 'RGBA'),
('BC3', 'RGBA'),
('BC5', 'RGB'),
),
)
def test_save_large_file(tmp_path: Path, pixel_format: str, mode: str) -> None:
with hopper(mode).resize((440,440)) as im:
# should not error in valgrind
im.save(tmp_path / 'img.dds', 'DDS', pixel_format=pixel_format)

3
src/libImaging/BcnEncode.c
View File

@ -258,6 +258,9 @@ ImagingBcnEncode(Imaging im, ImagingCodecState state, UINT8 *buf, int bytes) {
UINT8 *dst = buf;
for (;;) {
if (dst + 8 >= bytes + buf) {
break;
}
if (n == 5) {
encode_bc3_alpha(im, state, dst, 0);
dst += 8;