diff --git a/Tests/images/fli_overrun2.bin b/Tests/images/fli_overrun2.bin new file mode 100644 index 000000000..4afdb6f89 Binary files /dev/null and b/Tests/images/fli_overrun2.bin differ diff --git a/Tests/test_image.py b/Tests/test_image.py index 47196a139..cd7621e6b 100644 --- a/Tests/test_image.py +++ b/Tests/test_image.py @@ -598,6 +598,13 @@ class TestImage(PillowTestCase): except IOError as e: self.assertEqual(str(e), "buffer overrun when reading image file") + with Image.open("Tests/images/fli_overrun2.bin") as im: + try: + im.seek(1) + self.assertFail() + except IOError as e: + self.assertEqual(str(e), "buffer overrun when reading image file") + class MockEncoder(object): pass diff --git a/src/libImaging/FliDecode.c b/src/libImaging/FliDecode.c index 5f4485f89..6f48c07d4 100644 --- a/src/libImaging/FliDecode.c +++ b/src/libImaging/FliDecode.c @@ -40,8 +40,7 @@ ImagingFliDecode(Imaging im, ImagingCodecState state, UINT8* buf, Py_ssize_t byt return 0; /* We don't decode anything unless we have a full chunk in the - input buffer (on the other hand, the Python part of the driver - makes sure this is always the case) */ + input buffer */ ptr = buf; @@ -52,6 +51,10 @@ ImagingFliDecode(Imaging im, ImagingCodecState state, UINT8* buf, Py_ssize_t byt /* Make sure this is a frame chunk. The Python driver takes case of other chunk types. */ + if (bytes < 8) { + state->errcode = IMAGING_CODEC_OVERRUN; + return -1; + } if (I16(ptr+4) != 0xF1FA) { state->errcode = IMAGING_CODEC_UNKNOWN; return -1;