python-pillow/Pillow
1
1
Fork 0
mirror of https://github.com/python-pillow/Pillow.git synced 2024-12-27 02:16:19 +03:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #5214 from radarhere/pcx

Browse Source 
Handle PCX images with an odd stride
This commit is contained in:
Hugo van Kemenade 2021-03-07 11:41:14 +02:00 committed by GitHub
commit f9b830f058
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
3 changed files with 17 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

BIN
Tests/images/odd_stride.pcx Normal file
View File

Binary file not shown.

8
Tests/test_file_pcx.py
View File

@ -44,6 +44,14 @@ def test_odd(tmp_path):
_roundtrip(tmp_path, hopper(mode).resize((511, 511))) _roundtrip(tmp_path, hopper(mode).resize((511, 511)))
def test_odd_read():
# Reading an image with an odd stride, making it malformed
with Image.open("Tests/images/odd_stride.pcx") as im:
im.load()
assert im.size == (371, 150)
def test_pil184(): def test_pil184():
# Check reading of files where xmin/xmax is not zero. # Check reading of files where xmin/xmax is not zero.

13
src/PIL/PcxImagePlugin.py
View File

@ -66,13 +66,13 @@ class PcxImageFile(ImageFile.ImageFile):
version = s[1] version = s[1]
bits = s[3] bits = s[3]
planes = s[65] planes = s[65]
ignored_stride = i16(s, 66) provided_stride = i16(s, 66)
logger.debug( logger.debug(
"PCX version %s, bits %s, planes %s, stride %s", "PCX version %s, bits %s, planes %s, stride %s",
version, version,
bits, bits,
planes, planes,
ignored_stride, provided_stride,
) )
self.info["dpi"] = i16(s, 12), i16(s, 14) self.info["dpi"] = i16(s, 12), i16(s, 14)
@ -110,10 +110,15 @@ class PcxImageFile(ImageFile.ImageFile):
self.mode = mode self.mode = mode
self._size = bbox[2] - bbox[0], bbox[3] - bbox[1] self._size = bbox[2] - bbox[0], bbox[3] - bbox[1]
# don't trust the passed in stride. Calculate for ourselves. # Don't trust the passed in stride.
# Calculate the approximate position for ourselves.
# CVE-2020-35653 # CVE-2020-35653
stride = (self._size[0] * bits + 7) // 8 stride = (self._size[0] * bits + 7) // 8
stride += stride % 2
# While the specification states that this must be even,
# not all images follow this
if provided_stride != stride:
stride += stride % 2
bbox = (0, 0) + self.size bbox = (0, 0) + self.size
logger.debug("size: %sx%s", *self.size) logger.debug("size: %sx%s", *self.size)