From 511aed922aed5d8a4d060f70f01bf9400d52cea6 Mon Sep 17 00:00:00 2001 From: Andrew Murray Date: Sat, 5 Oct 2019 09:10:29 +1000 Subject: [PATCH] Fixed freeing unallocated pointer when resizing with height too large --- Tests/test_image_resample.py | 14 +++++++++----- src/libImaging/Resample.c | 2 -- 2 files changed, 9 insertions(+), 7 deletions(-) diff --git a/Tests/test_image_resample.py b/Tests/test_image_resample.py index 7d1dc009d..854a64d01 100644 --- a/Tests/test_image_resample.py +++ b/Tests/test_image_resample.py @@ -11,11 +11,15 @@ class TestImagingResampleVulnerability(PillowTestCase): # see https://github.com/python-pillow/Pillow/issues/1710 def test_overflow(self): im = hopper("L") - xsize = 0x100000008 // 4 - ysize = 1000 # unimportant - with self.assertRaises(MemoryError): - # any resampling filter will do here - im.im.resize((xsize, ysize), Image.BILINEAR) + size_too_large = 0x100000008 // 4 + size_normal = 1000 # unimportant + for xsize, ysize in ( + (size_too_large, size_normal), + (size_normal, size_too_large), + ): + with self.assertRaises(MemoryError): + # any resampling filter will do here + im.im.resize((xsize, ysize), Image.BILINEAR) def test_invalid_size(self): im = hopper() diff --git a/src/libImaging/Resample.c b/src/libImaging/Resample.c index 4a98e8477..d1a89e2ce 100644 --- a/src/libImaging/Resample.c +++ b/src/libImaging/Resample.c @@ -627,8 +627,6 @@ ImagingResampleInner(Imaging imIn, int xsize, int ysize, if ( ! ksize_vert) { free(bounds_horiz); free(kk_horiz); - free(bounds_vert); - free(kk_vert); return NULL; }