From 6d19b8adeff16674e62bd1e0aed95f29ff1932fb Mon Sep 17 00:00:00 2001 From: Andrew Murray Date: Sat, 26 Jul 2025 21:58:41 +1000 Subject: [PATCH] Do not allow negative offset with memory mapping --- Tests/test_imagefile.py | 5 +++++ src/PIL/ImageFile.py | 3 +++ 2 files changed, 8 insertions(+) diff --git a/Tests/test_imagefile.py b/Tests/test_imagefile.py index d4dfb1b6d..7dfb3abf9 100644 --- a/Tests/test_imagefile.py +++ b/Tests/test_imagefile.py @@ -164,6 +164,11 @@ class TestImageFile: with pytest.raises(OSError): p.close() + def test_negative_offset(self) -> None: + with Image.open("Tests/images/raw_negative_stride.bin") as im: + with pytest.raises(ValueError, match="Tile offset cannot be negative"): + im.load() + def test_no_format(self) -> None: buf = BytesIO(b"\x00" * 255) diff --git a/src/PIL/ImageFile.py b/src/PIL/ImageFile.py index e33b846d4..a1d98bd51 100644 --- a/src/PIL/ImageFile.py +++ b/src/PIL/ImageFile.py @@ -313,6 +313,9 @@ class ImageFile(Image.Image): and args[0] == self.mode and args[0] in Image._MAPMODES ): + if offset < 0: + msg = "Tile offset cannot be negative" + raise ValueError(msg) try: # use mmap, if possible import mmap