From 0788efd272f9e689a316cd173b1a767843192661 Mon Sep 17 00:00:00 2001
From: Andrew Murray <radarhere@gmail.com>
Date: Tue, 8 Dec 2015 12:23:02 +1100
Subject: [PATCH] Catch malformed value in TIFF

---
 PIL/TiffImagePlugin.py      |   2 ++
 Tests/images/malformed.tiff | Bin 0 -> 448 bytes
 Tests/test_file_tiff.py     |   5 +++++
 3 files changed, 7 insertions(+)
 create mode 100644 Tests/images/malformed.tiff

diff --git a/PIL/TiffImagePlugin.py b/PIL/TiffImagePlugin.py
index a84d01755..9d1877868 100644
--- a/PIL/TiffImagePlugin.py
+++ b/PIL/TiffImagePlugin.py
@@ -404,6 +404,8 @@ class ImageFileDirectory_v2(collections.MutableMapping):
         if info.length == 1:
             if legacy_api and self.tagtype[tag] in [5, 10]:
                 values = values,
+            if len(values) != 1:
+                raise TypeError("A tag was malformed")
             dest[tag], = values
         else:
             dest[tag] = values
diff --git a/Tests/images/malformed.tiff b/Tests/images/malformed.tiff
new file mode 100644
index 0000000000000000000000000000000000000000..3f6a50c5989ae8ea1bfb36a69fb732a9e526d764
GIT binary patch
literal 448
zcmebD)M7|tU|^`YwfEvi-UA9eE`d7w2PSf!U~!3SQ2KpdWYVj1v0YEf{S!D76}Eb3
zsGC>MZvC{Mr-OGzP7eE#K!X!@J~jRwxxO9qlgp~&SFD{D{(b*%eg1XNYoF;ER7wA1
z5Mp3pWM*Il+Mxi%j7V%ID4PW+&J1O90NHF%HZzdT1!aTu^D;6q@B?WFAV-jq1#Bir
zy%3TbQ6#n)kj)8{R{&yhsQO4CTZ)kttTzB?jx>}V0c6V{>D54DYXaF!Kz%^h1MOyJ
zFaWX=fa*aYFTW%{JF}#uQm-U4Ee$N>0VF}PU^*@B|9=JsW8;}K!EzYHnKK~ynKMBo
QHUN=NOFMH0n=AtZ00C@9DgXcg

literal 0
HcmV?d00001

diff --git a/Tests/test_file_tiff.py b/Tests/test_file_tiff.py
index 308783fb3..3265bb97e 100644
--- a/Tests/test_file_tiff.py
+++ b/Tests/test_file_tiff.py
@@ -107,6 +107,11 @@ class TestFileTiff(PillowTestCase):
         self.assertRaises(SyntaxError,
                           lambda: TiffImagePlugin.TiffImageFile(invalid_file))
 
+    def test_malformed_value(self):
+        malformed_file = "Tests/images/malformed.tiff"
+
+        self.assertRaises(IOError, lambda: Image.open(malformed_file))
+
     def test_bad_exif(self):
         i = Image.open('Tests/images/hopper_bad_exif.jpg')
         try: