Merge branch 'main' of ssh://github.com/python-pillow/Pillow into fix-alpha-for-overlapping-glyphs

.appveyor.yml

@@ -10,7 +10,7 @@ environment:
   TEST_OPTIONS:
   DEPLOY: YES
   matrix:
-  - PYTHON: C:/Python311
+  - PYTHON: C:/Python312
     ARCHITECTURE: x86
     APPVEYOR_BUILD_WORKER_IMAGE: Visual Studio 2022
   - PYTHON: C:/Python38-x64
@@ -43,7 +43,7 @@ build_script:
 
 test_script:
 - cd c:\pillow
-- '%PYTHON%\%EXECUTABLE% -m pip install pytest pytest-cov pytest-timeout'
+- '%PYTHON%\%EXECUTABLE% -m pip install pytest pytest-cov pytest-timeout defusedxml numpy olefile pyroma'
 - c:\"Program Files (x86)"\"Windows Kits"\10\Debuggers\x86\gflags.exe /p /enable %PYTHON%\%EXECUTABLE%
 - '%PYTHON%\%EXECUTABLE% -c "from PIL import Image"'
 - '%PYTHON%\%EXECUTABLE% -m pytest -vx --cov PIL --cov Tests --cov-report term --cov-report xml Tests'

.github/workflows/test-docker.yml

@@ -51,7 +51,6 @@ jobs:
           debian-11-bullseye-amd64,
           debian-12-bookworm-x86,
           debian-12-bookworm-amd64,
-          fedora-37-amd64,
           fedora-38-amd64,
           gentoo,
           ubuntu-20.04-focal-amd64,

.github/workflows/test-windows.yml

@@ -65,8 +65,8 @@ jobs:
     - name: Print build system information
       run: python3 .github/workflows/system-info.py
 
-    - name: python3 -m pip install pytest pytest-cov pytest-timeout defusedxml
-      run: python3 -m pip install pytest pytest-cov pytest-timeout defusedxml
+    - name: python3 -m pip install pytest pytest-cov pytest-timeout defusedxml olefile pyroma
+      run: python3 -m pip install pytest pytest-cov pytest-timeout defusedxml olefile pyroma
 
     - name: Install dependencies
       id: install

.travis.yml

@@ -9,8 +9,8 @@ env:
 
 language: python
 # Default Python version is usually 3.6
-python: "3.11"
-dist: focal
+python: "3.12"
+dist: jammy
 services: docker
 
 jobs:

CHANGES.rst

@@ -2,6 +2,12 @@
 Changelog (Pillow)
 ==================
 
+10.2.0 (unreleased)
+-------------------
+
+- Fixed frombytes() for images with a zero dimension #7493
+  [radarhere]
+
 10.1.0 (2023-10-15)
 -------------------
 

Tests/test_image.py

@@ -906,6 +906,13 @@ class TestImage:
         im = Image.new("RGB", size)
         assert im.tobytes() == b""
 
+    @pytest.mark.parametrize("size", ((1, 0), (0, 1), (0, 0)))
+    def test_zero_frombytes(self, size):
+        Image.frombytes("RGB", size, b"")
+
+        im = Image.new("RGB", size)
+        im.frombytes(b"")
+
     def test_has_transparency_data(self):
         for mode in ("1", "L", "P", "RGB"):
             im = Image.new(mode, (1, 1))

docs/conf.py

@@ -338,6 +338,7 @@ extlinks = {
     "cwe": ("https://cwe.mitre.org/data/definitions/%s.html", "CWE-%s"),
     "issue": (_repo + "issues/%s", "#%s"),
     "pr": (_repo + "pull/%s", "#%s"),
+    "pypi": ("https://pypi.org/project/%s/", "%s"),
 }
 
 # sphinxext.opengraph

docs/deprecations.rst

@@ -443,6 +443,6 @@ PIL.OleFileIO
 .. versionremoved:: 6.0.0
 
 PIL.OleFileIO was removed as a vendored file in Pillow 4.0.0 (2017-01) in favour of
-the upstream olefile Python package, and replaced with an ``ImportError`` in 5.0.0
+the upstream :pypi:`olefile` Python package, and replaced with an ``ImportError`` in 5.0.0
 (2018-01). The deprecated file has now been removed from Pillow. If needed, install from
 PyPI (eg. ``python3 -m pip install olefile``).

docs/handbook/image-file-formats.rst

@@ -1296,6 +1296,8 @@ Pillow reads Kodak FlashPix files. In the current version, only the highest
 resolution image is read from the file, and the viewing transform is not taken
 into account.
 
+To enable FPX support, you must install :pypi:`olefile`.
+
 .. note::
 
     To enable full FlashPix support, you need to build and install the IJG JPEG
@@ -1372,6 +1374,8 @@ the first sprite in the file is loaded. You can use :py:meth:`~PIL.Image.Image.s
 
 Note that there may be an embedded gamma of 2.2 in MIC files.
 
+To enable MIC support, you must install :pypi:`olefile`.
+
 MPO
 ^^^
 

docs/installation.rst

@@ -42,6 +42,11 @@ Install Pillow with :command:`pip`::
     python3 -m pip install --upgrade pip
     python3 -m pip install --upgrade Pillow
 
+Optionally, install :pypi:`defusedxml` for Pillow to read XMP data,
+and :pypi:`olefile` for Pillow to read FPX and MIC images::
+
+    python3 -m pip install --upgrade defusedxml olefile
+
 
 .. tab:: Linux
 
@@ -456,8 +461,6 @@ These platforms are built and tested for every change.
 +----------------------------------+----------------------------+---------------------+
 | Debian 12 Bookworm               | 3.11                       | x86, x86-64         |
 +----------------------------------+----------------------------+---------------------+
-| Fedora 37                        | 3.11                       | x86-64              |
-+----------------------------------+----------------------------+---------------------+
 | Fedora 38                        | 3.11                       | x86-64              |
 +----------------------------------+----------------------------+---------------------+
 | Gentoo                           | 3.9                        | x86-64              |
@@ -478,7 +481,7 @@ These platforms are built and tested for every change.
 | Windows Server 2022              | 3.8, 3.9, 3.10, 3.11,      | x86-64              |
 |                                  | 3.12, PyPy3                |                     |
 |                                  +----------------------------+---------------------+
-|                                  | 3.11                       | x86                 |
+|                                  | 3.12                       | x86                 |
 |                                  +----------------------------+---------------------+
 |                                  | 3.9 (MinGW)                | x86-64              |
 |                                  +----------------------------+---------------------+

docs/reference/ImageFont.rst

@@ -10,7 +10,7 @@ this class store bitmap fonts, and are used with the
 
 PIL uses its own font file format to store bitmap fonts, limited to 256 characters. You can use
 `pilfont.py <https://github.com/python-pillow/pillow-scripts/blob/main/Scripts/pilfont.py>`_
-from `pillow-scripts <https://pypi.org/project/pillow-scripts/>`_ to convert BDF and
+from :pypi:`pillow-scripts` to convert BDF and
 PCF font descriptors (X window font formats) to this format.
 
 Starting with version 1.1.4, PIL can be configured to support TrueType and

docs/releasenotes/10.0.0.rst

@@ -173,8 +173,8 @@ been processed before Pillow started checking for decompression bombs.
 Added ImageFont.MAX_STRING_LENGTH
 ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
 
-To protect against potential DOS attacks when using arbitrary strings as text
-input, Pillow will now raise a ``ValueError`` if the number of characters
+:cve:`2023-44271`: To protect against potential DOS attacks when using arbitrary strings as text
+input, Pillow will now raise a :py:exc:`ValueError` if the number of characters
 passed into ImageFont methods is over a certain limit,
 :py:data:`PIL.ImageFont.MAX_STRING_LENGTH`.
 

docs/releasenotes/4.0.0.rst

@@ -17,8 +17,8 @@ Pillow 4.0 supports Python 3.6.
 OleFileIO.py
 ============
 
-OleFileIO.py has been removed as a vendored file and is now installed
-from the upstream olefile pypi package. All internal dependencies are
+``OleFileIO.py`` has been removed as a vendored file and is now installed
+from the upstream :pypi:`olefile` PyPI package. All internal dependencies are
 redirected to the olefile package. Direct accesses to
 ``PIL.OlefileIO`` raises a deprecation warning, then patches the
 upstream olefile into ``sys.modules`` in its place.

docs/releasenotes/5.0.0.rst

@@ -28,7 +28,7 @@ Scripts
 
 The scripts formerly installed by Pillow have been split into a
 separate package, pillow-scripts, living at
-https://github.com/python-pillow/pillow-scripts .
+https://github.com/python-pillow/pillow-scripts.
 
 
 API Changes
@@ -37,7 +37,7 @@ API Changes
 OleFileIO.py
 ^^^^^^^^^^^^
 
-The olefile module is no longer a required dependency when installing Pillow.
+The :pypi:`olefile` module is no longer a required dependency when installing Pillow.
 Support for plugins requiring olefile will not be loaded if it is not
 installed. This allows library consumers to avoid installing this dependency
 if they choose. Some library consumers have little interest in the format

docs/releasenotes/6.0.0.rst

@@ -14,8 +14,8 @@ Pillow for Python 3.4 is 5.4.1.
 Removed deprecated PIL.OleFileIO
 ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
 
-PIL.OleFileIO was removed as a vendored file and in Pillow 4.0.0 (2017-01) in favour of
-the upstream olefile Python package, and replaced with an ``ImportError``. The
+``PIL.OleFileIO`` was removed as a vendored file and in Pillow 4.0.0 (2017-01) in favour of
+the upstream :pypi:`olefile` Python package, and replaced with an :py:exc:`ImportError`. The
 deprecated file has now been removed from Pillow. If needed, install from PyPI (eg.
 ``python3 -m pip install olefile``).
 

src/PIL/Image.py

@@ -791,6 +791,9 @@ class Image:
         but loads data into this image instead of creating a new image object.
         """
 
+        if self.width == 0 or self.height == 0:
+            return
+
         # may pass tuple instead of argument list
         if len(args) == 1 and isinstance(args[0], tuple):
             args = args[0]
@@ -2967,15 +2970,16 @@ def frombytes(mode, size, data, decoder_name="raw", *args):
 
     _check_size(size)
 
-    # may pass tuple instead of argument list
-    if len(args) == 1 and isinstance(args[0], tuple):
-        args = args[0]
-
-    if decoder_name == "raw" and args == ():
-        args = mode
-
     im = new(mode, size)
-    im.frombytes(data, decoder_name, args)
+    if im.width != 0 and im.height != 0:
+        # may pass tuple instead of argument list
+        if len(args) == 1 and isinstance(args[0], tuple):
+            args = args[0]
+
+        if decoder_name == "raw" and args == ():
+            args = mode
+
+        im.frombytes(data, decoder_name, args)
     return im
 
 

src/PIL/ImageMath.py

@@ -239,7 +239,7 @@ def eval(expression, _dict={}, **kw):
     args = ops.copy()
     args.update(_dict)
     args.update(kw)
-    for k, v in list(args.items()):
+    for k, v in args.items():
         if hasattr(v, "im"):
             args[k] = _Operand(v)