python-pillow/Pillow
1
1
Fork 0
mirror of https://github.com/python-pillow/Pillow.git synced 2025-05-05 08:23:42 +03:00
Code Issues Packages Projects Releases Wiki Activity

Fixed freeing unallocated pointer when resizing with height too large

Browse Source
This commit is contained in:
Andrew Murray 2019-10-05 09:10:29 +10:00
parent bb1fc75e55
commit 511aed922a
2 changed files with 9 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
Tests/test_image_resample.py
View File

@ -11,8 +11,12 @@ class TestImagingResampleVulnerability(PillowTestCase):
# see https://github.com/python-pillow/Pillow/issues/1710 # see https://github.com/python-pillow/Pillow/issues/1710
def test_overflow(self): def test_overflow(self):
im = hopper("L") im = hopper("L")
xsize = 0x100000008 // 4 size_too_large = 0x100000008 // 4
ysize = 1000 # unimportant size_normal = 1000 # unimportant
for xsize, ysize in (
(size_too_large, size_normal),
(size_normal, size_too_large),
):
with self.assertRaises(MemoryError): with self.assertRaises(MemoryError):
# any resampling filter will do here # any resampling filter will do here
im.im.resize((xsize, ysize), Image.BILINEAR) im.im.resize((xsize, ysize), Image.BILINEAR)

2
src/libImaging/Resample.c
View File

@ -627,8 +627,6 @@ ImagingResampleInner(Imaging imIn, int xsize, int ysize,
if ( ! ksize_vert) { if ( ! ksize_vert) {
free(bounds_horiz); free(bounds_horiz);
free(kk_horiz); free(kk_horiz);
free(bounds_vert);
free(kk_vert);
return NULL; return NULL;
} }