Merge pull request #6242 from radarhere/ppm_maxval

Tests/test_file_ppm.py

@@ -145,6 +145,19 @@ def test_truncated_file(tmp_path):
             im.load()
 
 
+@pytest.mark.parametrize("maxval", (0, 65536))
+def test_invalid_maxval(maxval, tmp_path):
+    path = str(tmp_path / "temp.ppm")
+    with open(path, "w") as f:
+        f.write("P6\n3 1 " + str(maxval))
+
+    with pytest.raises(ValueError) as e:
+        with Image.open(path):
+            pass
+
+    assert str(e.value) == "maxval must be greater than 0 and less than 65536"
+
+
 def test_neg_ppm():
     # Storage.c accepted negative values for xsize, ysize.  the
     # internal open_ppm function didn't check for sanity but it

src/PIL/PpmImagePlugin.py

@@ -116,6 +116,10 @@ class PpmImageFile(ImageFile.ImageFile):
                     break
             elif ix == 2:  # token is maxval
                 maxval = token
+                if not 0 < maxval < 65536:
+                    raise ValueError(
+                        "maxval must be greater than 0 and less than 65536"
+                    )
                 if maxval > 255 and mode == "L":
                     self.mode = "I"