From 88d0e6080a8d0e2fcea28b884e55e11751ef01c3 Mon Sep 17 00:00:00 2001 From: wiredfool Date: Fri, 31 Jan 2014 21:33:24 -0800 Subject: [PATCH] Fixed DOS with invalid BMP size entries --- PIL/BmpImagePlugin.py | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/PIL/BmpImagePlugin.py b/PIL/BmpImagePlugin.py index 86b74ff28..436ca5dce 100644 --- a/PIL/BmpImagePlugin.py +++ b/PIL/BmpImagePlugin.py @@ -99,6 +99,10 @@ class BmpImageFile(ImageFile.ImageFile): else: raise IOError("Unsupported BMP header type (%d)" % len(s)) + if (self.size[0]*self.size[1]) > 2**31: + # Prevent DOS for > 2gb images + raise IOError("Unsupported BMP Size: (%dx%d)" % self.size) + if not colors: colors = 1 << bits