From f0353c599676d694692174e32dc3acee2912b4a0 Mon Sep 17 00:00:00 2001
From: Andrew Murray <radarhere@users.noreply.github.com>
Date: Sun, 15 May 2022 13:51:31 +1000
Subject: [PATCH] When reading past the end of a scan line, reduce bytes left

---
 Tests/images/cross_scan_line_truncated.tga | Bin 0 -> 4881 bytes
 Tests/test_file_tga.py                     |   4 ++++
 src/libImaging/TgaRleDecode.c              |   1 +
 3 files changed, 5 insertions(+)
 create mode 100644 Tests/images/cross_scan_line_truncated.tga

diff --git a/Tests/images/cross_scan_line_truncated.tga b/Tests/images/cross_scan_line_truncated.tga
new file mode 100644
index 0000000000000000000000000000000000000000..cec4357e3acb85ebfc34e88bdbd4d4621670c456
GIT binary patch
literal 4881
zcmeIzyA8k~3`NmLmu!%2$YxnRe8dDPC~}O1Tv>4CYp0w^%GIvi?HoN32>h17v-{`u
m>jM->Fu<UDqz^FA2XmuvfeT#V!X&^2E^vVhi-37B=D`d1ArNf<

literal 0
HcmV?d00001

diff --git a/Tests/test_file_tga.py b/Tests/test_file_tga.py
index aeea3fb42..0c8c9f304 100644
--- a/Tests/test_file_tga.py
+++ b/Tests/test_file_tga.py
@@ -101,6 +101,10 @@ def test_cross_scan_line():
     with Image.open("Tests/images/cross_scan_line.tga") as im:
         assert_image_equal_tofile(im, "Tests/images/cross_scan_line.png")
 
+    with Image.open("Tests/images/cross_scan_line_truncated.tga") as im:
+        with pytest.raises(OSError):
+            im.load()
+
 
 def test_save(tmp_path):
     test_file = "Tests/images/tga_id_field.tga"
diff --git a/src/libImaging/TgaRleDecode.c b/src/libImaging/TgaRleDecode.c
index df430c940..95ae9b622 100644
--- a/src/libImaging/TgaRleDecode.c
+++ b/src/libImaging/TgaRleDecode.c
@@ -120,6 +120,7 @@ ImagingTgaRleDecode(Imaging im, ImagingCodecState state, UINT8 *buf, Py_ssize_t
             }
             memcpy(state->buffer + state->x, ptr, n);
             ptr += n;
+            bytes -= n;
             extra_bytes -= n;
         }
     }