python-pillow/Pillow
1
1
Fork 0
mirror of https://github.com/python-pillow/Pillow.git synced 2025-08-20 12:14:46 +03:00
Code Issues Packages Projects Releases Wiki Activity

Use snprintf instead of sprintf

Browse Source 
This is fix for CVE-2021-34552

(cherry picked from commit 518ee3722a)
This commit is contained in:
wooken 2022-02-14 13:41:08 -08:00
parent 04db0b815b
commit 59770927ce
2 changed files with 19 additions and 11 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
CHANGES.rst
View File

@ -2,6 +2,12 @@
Changelog (Pillow) Changelog (Pillow)
================== ==================
6.2.2.3 (2022-02-14)
--------------------
- Use snprintf instead of sprintf. CVE-2021-34552
[wooken]
6.2.2.2 (date TBD) 6.2.2.2 (date TBD)
------------------ ------------------

20
src/libImaging/Convert.c
View File

@ -1618,17 +1618,15 @@ convert(Imaging imOut, Imaging imIn, const char *mode,
break; break;
} }
if (!convert) if (!convert) {
#ifdef notdef #ifdef notdef
return (Imaging) ImagingError_ValueError("conversion not supported"); return (Imaging) ImagingError_ValueError("conversion not supported");
#else #else
{ static char buf[100];
static char buf[256]; snprintf(buf, 100, "conversion from %.10s to %.10s not supported", imIn->mode, mode);
/* FIXME: may overflow if mode is too large */
sprintf(buf, "conversion from %s to %s not supported", imIn->mode, mode);
return (Imaging)ImagingError_ValueError(buf); return (Imaging)ImagingError_ValueError(buf);
}
#endif #endif
}
imOut = ImagingNew2Dirty(mode, imOut, imIn); imOut = ImagingNew2Dirty(mode, imOut, imIn);
if (!imOut) if (!imOut)
@ -1681,9 +1679,13 @@ ImagingConvertTransparent(Imaging imIn, const char *mode,
} }
#else #else
{ {
static char buf[256]; static char buf[100];
/* FIXME: may overflow if mode is too large */ snprintf(
sprintf(buf, "conversion from %s to %s not supported in convert_transparent", imIn->mode, mode); buf,
100,
"conversion from %.10s to %.10s not supported in convert_transparent",
imIn->mode,
mode);
return (Imaging)ImagingError_ValueError(buf); return (Imaging)ImagingError_ValueError(buf);
} }
#endif #endif