Limit size even if one dimension is zero

This commit is contained in:
Andrew Murray 2023-06-28 11:43:05 +10:00
parent 4834f80c08
commit 8437d98f7f
4 changed files with 11 additions and 2 deletions

BIN
Tests/images/zero_width.gif Normal file

Binary file not shown.

After

Width:  |  Height:  |  Size: 44 B

View File

@ -64,6 +64,15 @@ class TestDecompressionBomb:
with pytest.raises(Image.DecompressionBombError): with pytest.raises(Image.DecompressionBombError):
im.seek(1) im.seek(1)
def test_exception_gif_zero_width(self):
# Set limit to trigger exception on the test file
Image.MAX_IMAGE_PIXELS = 4 * 64 * 128
assert Image.MAX_IMAGE_PIXELS == 4 * 64 * 128
with pytest.raises(Image.DecompressionBombError):
with Image.open("Tests/images/zero_width.gif"):
pass
def test_exception_bmp(self): def test_exception_bmp(self):
with pytest.raises(Image.DecompressionBombError): with pytest.raises(Image.DecompressionBombError):
with Image.open("Tests/images/bmp/b/reallybig.bmp"): with Image.open("Tests/images/bmp/b/reallybig.bmp"):

View File

@ -3141,7 +3141,7 @@ def _decompression_bomb_check(size):
if MAX_IMAGE_PIXELS is None: if MAX_IMAGE_PIXELS is None:
return return
pixels = size[0] * size[1] pixels = max(1, size[0]) * max(1, size[1])
if pixels > 2 * MAX_IMAGE_PIXELS: if pixels > 2 * MAX_IMAGE_PIXELS:
msg = ( msg = (

View File

@ -880,7 +880,7 @@ font_render(FontObject *self, PyObject *args) {
width += stroke_width * 2 + ceil(x_start); width += stroke_width * 2 + ceil(x_start);
height += stroke_width * 2 + ceil(y_start); height += stroke_width * 2 + ceil(y_start);
if (max_image_pixels != Py_None) { if (max_image_pixels != Py_None) {
if ((long long)width * height > PyLong_AsLongLong(max_image_pixels) * 2) { if ((long long)(width > 1 ? width : 1) * (height > 1 ? height : 1) > PyLong_AsLongLong(max_image_pixels) * 2) {
PyMem_Del(glyph_info); PyMem_Del(glyph_info);
return Py_BuildValue("O(ii)(ii)", Py_None, width, height, 0, 0); return Py_BuildValue("O(ii)(ii)", Py_None, width, height, 0, 0);
} }