python-pillow/Pillow
1
1
Fork 0
mirror of https://github.com/python-pillow/Pillow.git synced 2024-12-25 17:36:18 +03:00
Code Issues Packages Projects Releases Wiki Activity

Memory error in Storage.c when accepting negative image size arguments

Browse Source
This commit is contained in:
wiredfool 2016-09-25 10:44:22 +01:00
parent 8693afc502
commit 5d8a0be45a
3 changed files with 16 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

BIN
Tests/images/negative_size.ppm Executable file
View File

Binary file not shown.

12
Tests/test_file_ppm.py
View File

@ -44,5 +44,17 @@ class TestFilePpm(PillowTestCase):
self.assertRaises(ValueError, lambda: Image.open(path)) self.assertRaises(ValueError, lambda: Image.open(path))
def test_neg_ppm(self):
"""test_neg_ppm
Storage.c accepted negative values for xsize, ysize.
open_ppm is a core debugging item that doesn't check any parameters for
sanity.
"""
with self.assertRaises(ValueError):
Image.core.open_ppm('Tests/images/negative_size.ppm')
if __name__ == '__main__': if __name__ == '__main__':
unittest.main() unittest.main()

4
libImaging/Storage.c
View File

@ -406,6 +406,10 @@ ImagingNew(const char* mode, int xsize, int ysize)
} else } else
bytes = strlen(mode); /* close enough */ bytes = strlen(mode); /* close enough */
if (xsize < 0 || ysize < 0) {
return (Imaging) ImagingError_ValueError("bad image size");
}
if ((int64_t) xsize * (int64_t) ysize <= THRESHOLD / bytes) { if ((int64_t) xsize * (int64_t) ysize <= THRESHOLD / bytes) {
im = ImagingNewBlock(mode, xsize, ysize); im = ImagingNewBlock(mode, xsize, ysize);
if (im) if (im)