From fb2fcd8e2ab198888180aec97b1e0ffea6ca1e50 Mon Sep 17 00:00:00 2001
From: Junxiao Shi <git@mail1.yoursunny.com>
Date: Sat, 1 Jun 2024 22:41:57 +0000
Subject: [PATCH] cgetpixel_mb constant size buffer

---
 src/_imaging.c           | 3 ++-
 src/libImaging/Storage.c | 2 +-
 2 files changed, 3 insertions(+), 2 deletions(-)

diff --git a/src/_imaging.c b/src/_imaging.c
index a8aabc0dd..c9818f50b 100644
--- a/src/_imaging.c
+++ b/src/_imaging.c
@@ -435,7 +435,8 @@ float16tofloat32(const FLOAT16 in) {
 
 static inline PyObject *
 getpixel_mb(Imaging im, ImagingAccess access, int x, int y) {
-    UINT8 pixel[im->pixelsize];
+    UINT8 pixel[sizeof(INT32) * 6];
+    assert(im->pixelsize <= sizeof(pixel));
     access->get_pixel(im, x, y, &pixel);
 
     PyObject *tuple = PyTuple_New(im->bands);
diff --git a/src/libImaging/Storage.c b/src/libImaging/Storage.c
index cdf62ceb3..382dbfa49 100644
--- a/src/libImaging/Storage.c
+++ b/src/libImaging/Storage.c
@@ -198,7 +198,7 @@ ImagingNewPrologueSubtype(
         }
         im->bands = bands;
         im->depth = depth;
-        im->pixelsize = depth * bands;
+        im->pixelsize = depth / CHAR_BIT * bands;
         im->linesize = xsize * im->pixelsize;
         im->type = IMAGING_TYPE_MB;