python-pillow/Pillow
1
1
Fork 0
mirror of https://github.com/python-pillow/Pillow.git synced 2024-12-26 01:46:18 +03:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #4116 from radarhere/memory

Browse Source 
Fixed freeing unallocated pointer when resizing with height too large
This commit is contained in:
Hugo van Kemenade 2019-11-13 20:29:09 +02:00 committed by GitHub
commit b64d96d414
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
2 changed files with 9 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

14
Tests/test_image_resample.py
View File

@ -11,11 +11,15 @@ class TestImagingResampleVulnerability(PillowTestCase):
# see https://github.com/python-pillow/Pillow/issues/1710
def test_overflow(self):
im = hopper("L")
xsize = 0x100000008 // 4
ysize = 1000 # unimportant
with self.assertRaises(MemoryError):
# any resampling filter will do here
im.im.resize((xsize, ysize), Image.BILINEAR)
size_too_large = 0x100000008 // 4
size_normal = 1000 # unimportant
for xsize, ysize in (
(size_too_large, size_normal),
(size_normal, size_too_large),
):
with self.assertRaises(MemoryError):
# any resampling filter will do here
im.im.resize((xsize, ysize), Image.BILINEAR)
def test_invalid_size(self):
im = hopper()

2
src/libImaging/Resample.c
View File

@ -627,8 +627,6 @@ ImagingResampleInner(Imaging imIn, int xsize, int ysize,
if ( ! ksize_vert) {
free(bounds_horiz);
free(kk_horiz);
free(bounds_vert);
free(kk_vert);
return NULL;
}