Merge branch 'main' into progress

.appveyor.yml

@@ -18,7 +18,7 @@ environment:
   TEST_OPTIONS:
   DEPLOY: YES
   matrix:
-  - PYTHON: C:/Python312
+  - PYTHON: C:/Python313
     ARCHITECTURE: x86
     APPVEYOR_BUILD_WORKER_IMAGE: Visual Studio 2022
   - PYTHON: C:/Python39-x64

.ci/requirements-cibw.txt

@@ -1 +1 @@
-cibuildwheel==2.21.1
+cibuildwheel==2.21.3

.github/workflows/cifuzz.yml

@@ -6,11 +6,13 @@ on:
       - "**"
     paths:
       - ".github/workflows/cifuzz.yml"
+      - ".github/workflows/wheels-dependencies.sh"
       - "**.c"
       - "**.h"
   pull_request:
     paths:
       - ".github/workflows/cifuzz.yml"
+      - ".github/workflows/wheels-dependencies.sh"
       - "**.c"
       - "**.h"
   workflow_dispatch:
@@ -24,8 +26,6 @@ concurrency:
 
 jobs:
   Fuzzing:
-    # Disabled until google/oss-fuzz#11419 upgrades Python to 3.9+
-    if: false
     runs-on: ubuntu-latest
     steps:
     - name: Build Fuzzers

.github/workflows/wheels-dependencies.sh

@@ -16,15 +16,11 @@ ARCHIVE_SDIR=pillow-depends-main
 
 # Package versions for fresh source builds
 FREETYPE_VERSION=2.13.2
-if [[ "$MB_ML_VER" != 2014 ]]; then
+HARFBUZZ_VERSION=10.0.1
-    HARFBUZZ_VERSION=10.0.1
-else
-    HARFBUZZ_VERSION=8.5.0
-fi
 LIBPNG_VERSION=1.6.44
 JPEGTURBO_VERSION=3.0.4
 OPENJPEG_VERSION=2.5.2
-XZ_VERSION=5.6.2
+XZ_VERSION=5.6.3
 TIFF_VERSION=4.6.0
 LCMS2_VERSION=2.16
 if [[ -n "$IS_MACOS" ]]; then
@@ -65,21 +61,15 @@ function build_brotli {
 }
 
 function build_harfbuzz {
-    if [[ "$HARFBUZZ_VERSION" == 8.5.0 ]]; then
+    python3 -m pip install meson ninja
-        export FREETYPE_LIBS=-lfreetype
+
-        export FREETYPE_CFLAGS=-I/usr/local/include/freetype2/
+    local out_dir=$(fetch_unpack https://github.com/harfbuzz/harfbuzz/releases/download/$HARFBUZZ_VERSION/$HARFBUZZ_VERSION.tar.xz harfbuzz-$HARFBUZZ_VERSION.tar.xz)
-        build_simple harfbuzz $HARFBUZZ_VERSION https://github.com/harfbuzz/harfbuzz/releases/download/$HARFBUZZ_VERSION tar.xz --with-freetype=yes --with-glib=no
+    (cd $out_dir \
-        export FREETYPE_LIBS=""
+        && meson setup build --buildtype=release -Dfreetype=enabled -Dglib=disabled)
-        export FREETYPE_CFLAGS=""
+    (cd $out_dir/build \
-    else
+        && meson install)
-        local out_dir=$(fetch_unpack https://github.com/harfbuzz/harfbuzz/releases/download/$HARFBUZZ_VERSION/$HARFBUZZ_VERSION.tar.xz harfbuzz-$HARFBUZZ_VERSION.tar.xz)
+    if [[ "$MB_ML_LIBC" == "manylinux" ]]; then
-        (cd $out_dir \
+        cp /usr/local/lib64/libharfbuzz* /usr/local/lib
-            && meson setup build --buildtype=release -Dfreetype=enabled -Dglib=disabled)
-        (cd $out_dir/build \
-            && meson install)
-        if [[ "$MB_ML_LIBC" == "manylinux" ]]; then
-            cp /usr/local/lib64/libharfbuzz* /usr/local/lib
-        fi
     fi
 }
 
@@ -155,13 +145,7 @@ if [[ -n "$IS_MACOS" ]]; then
     brew remove --ignore-dependencies webp
   fi
 
-  brew install meson pkg-config
+  brew install pkg-config
-elif [[ "$MB_ML_LIBC" == "manylinux" ]]; then
-  if [[ "$HARFBUZZ_VERSION" != 8.5.0 ]]; then
-    yum install -y meson
-  fi
-else
-  apk add meson
 fi
 
 wrap_wheel_builder build

.github/workflows/wheels.yml

@@ -41,7 +41,7 @@ env:
 
 jobs:
   build-1-QEMU-emulated-wheels:
-    if: github.event_name != 'schedule' && github.event_name != 'workflow_dispatch'
+    if: github.event_name != 'schedule'
     name: aarch64 ${{ matrix.python-version }} ${{ matrix.spec }}
     runs-on: ubuntu-latest
     strategy:
@@ -278,7 +278,7 @@ jobs:
           path: dist
           merge-multiple: true
       - name: Upload wheels to scientific-python-nightly-wheels
-        uses: scientific-python/upload-nightly-action@b67d7fcc0396e1128a474d1ab2b48aa94680f9fc # 0.5.0
+        uses: scientific-python/upload-nightly-action@82396a2ed4269ba06c6b2988bb4fd568ef3c3d6b # 0.6.1
         with:
           artifacts_path: dist
           anaconda_nightly_upload_token: ${{ secrets.ANACONDA_ORG_UPLOAD_TOKEN }}
@@ -301,3 +301,5 @@ jobs:
           merge-multiple: true
       - name: Publish to PyPI
         uses: pypa/gh-action-pypi-publish@release/v1
+        with:
+          attestations: true

.pre-commit-config.yaml

@@ -1,6 +1,6 @@
 repos:
   - repo: https://github.com/astral-sh/ruff-pre-commit
-    rev: v0.6.3
+    rev: v0.6.9
     hooks:
       - id: ruff
         args: [--exit-non-zero-on-fix]
@@ -11,7 +11,7 @@ repos:
       - id: black
 
   - repo: https://github.com/PyCQA/bandit
-    rev: 1.7.9
+    rev: 1.7.10
     hooks:
     - id: bandit
       args: [--severity-level=high]
@@ -24,7 +24,7 @@ repos:
         exclude: (Makefile$|\.bat$|\.cmake$|\.eps$|\.fits$|\.gd$|\.opt$)
 
   - repo: https://github.com/pre-commit/mirrors-clang-format
-    rev: v18.1.8
+    rev: v19.1.1
     hooks:
       - id: clang-format
         types: [c]
@@ -36,7 +36,7 @@ repos:
       - id: rst-backticks
 
   - repo: https://github.com/pre-commit/pre-commit-hooks
-    rev: v4.6.0
+    rev: v5.0.0
     hooks:
       - id: check-executables-have-shebangs
       - id: check-shebang-scripts-are-executable
@@ -50,29 +50,29 @@ repos:
         exclude: ^.github/.*TEMPLATE|^Tests/(fonts|images)/
 
   - repo: https://github.com/python-jsonschema/check-jsonschema
-    rev: 0.29.2
+    rev: 0.29.3
     hooks:
       - id: check-github-workflows
       - id: check-readthedocs
       - id: check-renovate
 
   - repo: https://github.com/sphinx-contrib/sphinx-lint
-    rev: v0.9.1
+    rev: v1.0.0
     hooks:
       - id: sphinx-lint
 
   - repo: https://github.com/tox-dev/pyproject-fmt
-    rev: 2.2.1
+    rev: 2.2.4
     hooks:
       - id: pyproject-fmt
 
   - repo: https://github.com/abravalheri/validate-pyproject
-    rev: v0.19
+    rev: v0.20.2
     hooks:
       - id: validate-pyproject
 
   - repo: https://github.com/tox-dev/tox-ini-fmt
-    rev: 1.3.1
+    rev: 1.4.1
     hooks:
       - id: tox-ini-fmt
 

CHANGES.rst

@@ -5,12 +5,42 @@ Changelog (Pillow)
 11.0.0 (unreleased)
 -------------------
 
-- Fixed writing multiple StripOffsets to TIFF #8317
+- Do not close provided file handles with libtiff when saving #8458
+  [radarhere]
+
+- Support ImageFilter.BuiltinFilter for I;16* images #8438
+  [radarhere]
+
+- Use ImagingCore.ptr instead of ImagingCore.id #8341
+  [homm, radarhere, hugovk]
+
+- Updated EPS mode when opening images without transparency #8281
   [Yay295, radarhere]
 
-- Shared imagequant libraries may be located within usr/lib64 #8407
+- Use transparency when combining P frames from APNGs #8443
   [radarhere]
 
+- Support all resampling filters when resizing I;16* images #8422
+  [radarhere]
+
+- Free memory on early return #8413
+  [radarhere]
+
+- Cast int before potentially exceeding INT_MAX #8402
+  [radarhere]
+
+- Check image value before use #8400
+  [radarhere]
+
+- Improved copying imagequant libraries #8420
+  [radarhere]
+
+- Use Capsule for WebP saving #8386
+  [homm, radarhere]
+
+- Fixed writing multiple StripOffsets to TIFF #8317
+  [Yay295, radarhere]
+
 - Fix dereference before checking for NULL in ImagingTransformAffine #8398
   [PavlNekrasov]
 

Makefile

@@ -17,12 +17,10 @@ coverage:
 .PHONY: doc
 .PHONY: html
 doc html:
-	python3 -c "import PIL" > /dev/null 2>&1 || python3 -m pip install .
 	$(MAKE) -C docs html
 
 .PHONY: htmlview
 htmlview:
-	python3 -c "import PIL" > /dev/null 2>&1 || python3 -m pip install .
 	$(MAKE) -C docs htmlview
 
 .PHONY: doccheck
@@ -117,7 +115,7 @@ lint-fix:
 	python3 -c "import black" > /dev/null 2>&1 || python3 -m pip install black
 	python3 -m black .
 	python3 -c "import ruff" > /dev/null 2>&1 || python3 -m pip install ruff
-	python3 -m ruff --fix .
+	python3 -m ruff check --fix .
 
 .PHONY: mypy
 mypy:

Tests/test_features.py

@@ -56,17 +56,17 @@ def test_version() -> None:
 
 def test_webp_transparency() -> None:
     with pytest.warns(DeprecationWarning):
-        assert features.check("transp_webp") == features.check_module("webp")
+        assert (features.check("transp_webp") or False) == features.check_module("webp")
 
 
 def test_webp_mux() -> None:
     with pytest.warns(DeprecationWarning):
-        assert features.check("webp_mux") == features.check_module("webp")
+        assert (features.check("webp_mux") or False) == features.check_module("webp")
 
 
 def test_webp_anim() -> None:
     with pytest.warns(DeprecationWarning):
-        assert features.check("webp_anim") == features.check_module("webp")
+        assert (features.check("webp_anim") or False) == features.check_module("webp")
 
 
 @skip_unless_feature("libjpeg_turbo")

Tests/test_file_apng.py

@@ -259,8 +259,8 @@ def test_apng_mode() -> None:
         assert im.mode == "P"
         im.seek(im.n_frames - 1)
         im = im.convert("RGBA")
-        assert im.getpixel((0, 0)) == (255, 0, 0, 0)
+        assert im.getpixel((0, 0)) == (0, 255, 0, 255)
-        assert im.getpixel((64, 32)) == (255, 0, 0, 0)
+        assert im.getpixel((64, 32)) == (0, 255, 0, 255)
 
     with Image.open("Tests/images/apng/mode_palette_1bit_alpha.png") as im:
         assert im.mode == "P"

Tests/test_file_eps.py

@@ -8,6 +8,7 @@ import pytest
 from PIL import EpsImagePlugin, Image, UnidentifiedImageError, features
 
 from .helper import (
+    assert_image_equal_tofile,
     assert_image_similar,
     assert_image_similar_tofile,
     hopper,
@@ -19,18 +20,18 @@ from .helper import (
 HAS_GHOSTSCRIPT = EpsImagePlugin.has_ghostscript()
 
 # Our two EPS test files (they are identical except for their bounding boxes)
-FILE1 = "Tests/images/zero_bb.eps"
+FILE1 = "Tests/images/eps/zero_bb.eps"
-FILE2 = "Tests/images/non_zero_bb.eps"
+FILE2 = "Tests/images/eps/non_zero_bb.eps"
 
 # Due to palletization, we'll need to convert these to RGB after load
-FILE1_COMPARE = "Tests/images/zero_bb.png"
+FILE1_COMPARE = "Tests/images/eps/zero_bb.png"
-FILE1_COMPARE_SCALE2 = "Tests/images/zero_bb_scale2.png"
+FILE1_COMPARE_SCALE2 = "Tests/images/eps/zero_bb_scale2.png"
 
-FILE2_COMPARE = "Tests/images/non_zero_bb.png"
+FILE2_COMPARE = "Tests/images/eps/non_zero_bb.png"
-FILE2_COMPARE_SCALE2 = "Tests/images/non_zero_bb_scale2.png"
+FILE2_COMPARE_SCALE2 = "Tests/images/eps/non_zero_bb_scale2.png"
 
 # EPS test files with binary preview
-FILE3 = "Tests/images/binary_preview_map.eps"
+FILE3 = "Tests/images/eps/binary_preview_map.eps"
 
 # Three unsigned 32bit little-endian values:
 #   0xC6D3D0C5 magic number
@@ -126,6 +127,15 @@ def test_binary_header_only() -> None:
         EpsImagePlugin.EpsImageFile(data)
 
 
+@pytest.mark.parametrize("prefix", (b"", simple_binary_header))
+def test_simple_eps_file(prefix: bytes) -> None:
+    data = io.BytesIO(prefix + b"\n".join(simple_eps_file))
+    with Image.open(data) as img:
+        assert img.mode == "RGB"
+        assert img.size == (100, 100)
+        assert img.format == "EPS"
+
+
 @pytest.mark.parametrize("prefix", (b"", simple_binary_header))
 def test_missing_version_comment(prefix: bytes) -> None:
     data = io.BytesIO(prefix + b"\n".join(simple_eps_file_without_version))
@@ -141,23 +151,21 @@ def test_missing_boundingbox_comment(prefix: bytes) -> None:
 
 
 @pytest.mark.parametrize("prefix", (b"", simple_binary_header))
-def test_invalid_boundingbox_comment(prefix: bytes) -> None:
+@pytest.mark.parametrize(
-    data = io.BytesIO(prefix + b"\n".join(simple_eps_file_with_invalid_boundingbox))
+    "file_lines",
+    (
+        simple_eps_file_with_invalid_boundingbox,
+        simple_eps_file_with_invalid_boundingbox_valid_imagedata,
+    ),
+)
+def test_invalid_boundingbox_comment(
+    prefix: bytes, file_lines: tuple[bytes, ...]
+) -> None:
+    data = io.BytesIO(prefix + b"\n".join(file_lines))
     with pytest.raises(OSError, match="cannot determine EPS bounding box"):
         EpsImagePlugin.EpsImageFile(data)
 
 
-@pytest.mark.parametrize("prefix", (b"", simple_binary_header))
-def test_invalid_boundingbox_comment_valid_imagedata_comment(prefix: bytes) -> None:
-    data = io.BytesIO(
-        prefix + b"\n".join(simple_eps_file_with_invalid_boundingbox_valid_imagedata)
-    )
-    with Image.open(data) as img:
-        assert img.mode == "RGB"
-        assert img.size == (100, 100)
-        assert img.format == "EPS"
-
-
 @pytest.mark.parametrize("prefix", (b"", simple_binary_header))
 def test_ascii_comment_too_long(prefix: bytes) -> None:
     data = io.BytesIO(prefix + b"\n".join(simple_eps_file_with_long_ascii_comment))
@@ -177,7 +185,7 @@ def test_load_long_binary_data(prefix: bytes) -> None:
     data = io.BytesIO(prefix + b"\n".join(simple_eps_file_with_long_binary_data))
     with Image.open(data) as img:
         img.load()
-        assert img.mode == "RGB"
+        assert img.mode == "1"
         assert img.size == (100, 100)
         assert img.format == "EPS"
 
@@ -187,7 +195,7 @@ def test_load_long_binary_data(prefix: bytes) -> None:
 )
 @pytest.mark.skipif(not HAS_GHOSTSCRIPT, reason="Ghostscript not available")
 def test_cmyk() -> None:
-    with Image.open("Tests/images/pil_sample_cmyk.eps") as cmyk_image:
+    with Image.open("Tests/images/eps/pil_sample_cmyk.eps") as cmyk_image:
         assert cmyk_image.mode == "CMYK"
         assert cmyk_image.size == (100, 100)
         assert cmyk_image.format == "EPS"
@@ -204,8 +212,8 @@ def test_cmyk() -> None:
 @pytest.mark.skipif(not HAS_GHOSTSCRIPT, reason="Ghostscript not available")
 def test_showpage() -> None:
     # See https://github.com/python-pillow/Pillow/issues/2615
-    with Image.open("Tests/images/reqd_showpage.eps") as plot_image:
+    with Image.open("Tests/images/eps/reqd_showpage.eps") as plot_image:
-        with Image.open("Tests/images/reqd_showpage.png") as target:
+        with Image.open("Tests/images/eps/reqd_showpage.png") as target:
             # should not crash/hang
             plot_image.load()
             # fonts could be slightly different
@@ -214,11 +222,11 @@ def test_showpage() -> None:
 
 @pytest.mark.skipif(not HAS_GHOSTSCRIPT, reason="Ghostscript not available")
 def test_transparency() -> None:
-    with Image.open("Tests/images/reqd_showpage.eps") as plot_image:
+    with Image.open("Tests/images/eps/reqd_showpage.eps") as plot_image:
         plot_image.load(transparency=True)
         assert plot_image.mode == "RGBA"
 
-        with Image.open("Tests/images/reqd_showpage_transparency.png") as target:
+        with Image.open("Tests/images/eps/reqd_showpage_transparency.png") as target:
             # fonts could be slightly different
             assert_image_similar(plot_image, target, 6)
 
@@ -245,9 +253,19 @@ def test_bytesio_object() -> None:
         assert_image_similar(img, image1_scale1_compare, 5)
 
 
-def test_1_mode() -> None:
+@pytest.mark.skipif(not HAS_GHOSTSCRIPT, reason="Ghostscript not available")
-    with Image.open("Tests/images/1.eps") as im:
+@pytest.mark.parametrize(
-        assert im.mode == "1"
+    # These images have an "ImageData" descriptor.
+    "filename",
+    (
+        "Tests/images/eps/1.eps",
+        "Tests/images/eps/1_boundingbox_after_imagedata.eps",
+        "Tests/images/eps/1_second_imagedata.eps",
+    ),
+)
+def test_1(filename: str) -> None:
+    with Image.open(filename) as im:
+        assert_image_equal_tofile(im, "Tests/images/eps/1.bmp")
 
 
 def test_image_mode_not_supported(tmp_path: Path) -> None:
@@ -302,7 +320,9 @@ def test_render_scale2() -> None:
 
 
 @pytest.mark.skipif(not HAS_GHOSTSCRIPT, reason="Ghostscript not available")
-@pytest.mark.parametrize("filename", (FILE1, FILE2, "Tests/images/illu10_preview.eps"))
+@pytest.mark.parametrize(
+    "filename", (FILE1, FILE2, "Tests/images/eps/illu10_preview.eps")
+)
 def test_resize(filename: str) -> None:
     with Image.open(filename) as im:
         new_size = (100, 100)
@@ -344,10 +364,10 @@ def test_readline(prefix: bytes, line_ending: bytes) -> None:
 @pytest.mark.parametrize(
     "filename",
     (
-        "Tests/images/illu10_no_preview.eps",
+        "Tests/images/eps/illu10_no_preview.eps",
-        "Tests/images/illu10_preview.eps",
+        "Tests/images/eps/illu10_preview.eps",
-        "Tests/images/illuCS6_no_preview.eps",
+        "Tests/images/eps/illuCS6_no_preview.eps",
-        "Tests/images/illuCS6_preview.eps",
+        "Tests/images/eps/illuCS6_preview.eps",
     ),
 )
 def test_open_eps(filename: str) -> None:
@@ -359,7 +379,7 @@ def test_open_eps(filename: str) -> None:
 @pytest.mark.skipif(not HAS_GHOSTSCRIPT, reason="Ghostscript not available")
 def test_emptyline() -> None:
     # Test file includes an empty line in the header data
-    emptyline_file = "Tests/images/zero_bb_emptyline.eps"
+    emptyline_file = "Tests/images/eps/zero_bb_emptyline.eps"
 
     with Image.open(emptyline_file) as image:
         image.load()
@@ -371,7 +391,7 @@ def test_emptyline() -> None:
 @pytest.mark.timeout(timeout=5)
 @pytest.mark.parametrize(
     "test_file",
-    ["Tests/images/timeout-d675703545fee17acab56e5fec644c19979175de.eps"],
+    ["Tests/images/eps/timeout-d675703545fee17acab56e5fec644c19979175de.eps"],
 )
 def test_timeout(test_file: str) -> None:
     with open(test_file, "rb") as f:
@@ -384,7 +404,7 @@ def test_bounding_box_in_trailer() -> None:
     # Check bounding boxes are parsed in the same way
     # when specified in the header and the trailer
     with (
-        Image.open("Tests/images/zero_bb_trailer.eps") as trailer_image,
+        Image.open("Tests/images/eps/zero_bb_trailer.eps") as trailer_image,
         Image.open(FILE1) as header_image,
     ):
         assert trailer_image.size == header_image.size
@@ -392,12 +412,12 @@ def test_bounding_box_in_trailer() -> None:
 
 def test_eof_before_bounding_box() -> None:
     with pytest.raises(OSError):
-        with Image.open("Tests/images/zero_bb_eof_before_boundingbox.eps"):
+        with Image.open("Tests/images/eps/zero_bb_eof_before_boundingbox.eps"):
             pass
 
 
 def test_invalid_data_after_eof() -> None:
-    with open("Tests/images/illuCS6_preview.eps", "rb") as f:
+    with open("Tests/images/eps/illuCS6_preview.eps", "rb") as f:
         img_bytes = io.BytesIO(f.read() + b"\r\n%" + (b" " * 255))
 
     with Image.open(img_bytes) as img:

Tests/test_file_tiff.py

@@ -108,10 +108,6 @@ class TestFileTiff:
             assert_image_equal_tofile(im, "Tests/images/hopper.tif")
 
         with Image.open("Tests/images/hopper_bigtiff.tif") as im:
-            # The data type of this file's StripOffsets tag is LONG8,
-            # which is not yet supported for offset data when saving multiple frames.
-            del im.tag_v2[273]
-
             outfile = str(tmp_path / "temp.tif")
             im.save(outfile, save_all=True, append_images=[im], tiffinfo=im.tag_v2)
 
@@ -783,6 +779,20 @@ class TestFileTiff:
             )
         assert progress == expected
 
+    def test_fixoffsets(self) -> None:
+        b = BytesIO(b"II\x2a\x00\x00\x00\x00\x00")
+        with TiffImagePlugin.AppendingTiffWriter(b) as a:
+            b.seek(0)
+            a.fixOffsets(1, isShort=True)
+
+            b.seek(0)
+            a.fixOffsets(1, isLong=True)
+
+            # Neither short nor long
+            b.seek(0)
+            with pytest.raises(RuntimeError):
+                a.fixOffsets(1)
+
     def test_saving_icc_profile(self, tmp_path: Path) -> None:
         # Tests saving TIFF with icc_profile set.
         # At the time of writing this will only work for non-compressed tiffs

Tests/test_image_filter.py

@@ -35,16 +35,25 @@ from .helper import assert_image_equal, hopper
         ImageFilter.UnsharpMask(10),
     ),
 )
-@pytest.mark.parametrize("mode", ("L", "I", "RGB", "CMYK"))
+@pytest.mark.parametrize(
-def test_sanity(filter_to_apply: ImageFilter.Filter, mode: str) -> None:
+    "mode", ("L", "I", "I;16", "I;16L", "I;16B", "I;16N", "RGB", "CMYK")
+)
+def test_sanity(
+    filter_to_apply: ImageFilter.Filter | type[ImageFilter.Filter], mode: str
+) -> None:
     im = hopper(mode)
-    if mode != "I" or isinstance(filter_to_apply, ImageFilter.BuiltinFilter):
+    if mode[0] != "I" or (
+        callable(filter_to_apply)
+        and issubclass(filter_to_apply, ImageFilter.BuiltinFilter)
+    ):
         out = im.filter(filter_to_apply)
         assert out.mode == im.mode
         assert out.size == im.size
 
 
-@pytest.mark.parametrize("mode", ("L", "I", "RGB", "CMYK"))
+@pytest.mark.parametrize(
+    "mode", ("L", "I", "I;16", "I;16L", "I;16B", "I;16N", "RGB", "CMYK")
+)
 def test_sanity_error(mode: str) -> None:
     im = hopper(mode)
     with pytest.raises(TypeError):
@@ -145,7 +154,9 @@ def test_kernel_not_enough_coefficients() -> None:
         ImageFilter.Kernel((3, 3), (0, 0))
 
 
-@pytest.mark.parametrize("mode", ("L", "LA", "I", "RGB", "CMYK"))
+@pytest.mark.parametrize(
+    "mode", ("L", "LA", "I", "I;16", "I;16L", "I;16B", "I;16N", "RGB", "CMYK")
+)
 def test_consistency_3x3(mode: str) -> None:
     with Image.open("Tests/images/hopper.bmp") as source:
         with Image.open("Tests/images/hopper_emboss.bmp") as reference:
@@ -161,7 +172,9 @@ def test_consistency_3x3(mode: str) -> None:
             assert_image_equal(source.filter(kernel), reference)
 
 
-@pytest.mark.parametrize("mode", ("L", "LA", "I", "RGB", "CMYK"))
+@pytest.mark.parametrize(
+    "mode", ("L", "LA", "I", "I;16", "I;16L", "I;16B", "I;16N", "RGB", "CMYK")
+)
 def test_consistency_5x5(mode: str) -> None:
     with Image.open("Tests/images/hopper.bmp") as source:
         with Image.open("Tests/images/hopper_emboss_more.bmp") as reference:

Tests/test_image_getim.py

@@ -1,11 +1,19 @@
 from __future__ import annotations
 
+import pytest
+
 from .helper import hopper
 
 
 def test_sanity() -> None:
     im = hopper()
-    type_repr = repr(type(im.getim()))
 
+    type_repr = repr(type(im.getim()))
     assert "PyCapsule" in type_repr
-    assert isinstance(im.im.id, int)
+
+    with pytest.warns(DeprecationWarning):
+        assert isinstance(im.im.id, int)
+
+    with pytest.warns(DeprecationWarning):
+        ptrs = dict(im.im.unsafe_ptrs)
+    assert ptrs.keys() == {"image8", "image32", "image"}

Tests/test_image_resize.py

@@ -44,9 +44,19 @@ class TestImagingCoreResize:
             self.resize(hopper("1"), (15, 12), Image.Resampling.BILINEAR)
         with pytest.raises(ValueError):
             self.resize(hopper("P"), (15, 12), Image.Resampling.BILINEAR)
-        with pytest.raises(ValueError):
+        for mode in [
-            self.resize(hopper("I;16"), (15, 12), Image.Resampling.BILINEAR)
+            "L",
-        for mode in ["L", "I", "F", "RGB", "RGBA", "CMYK", "YCbCr"]:
+            "I",
+            "I;16",
+            "I;16L",
+            "I;16B",
+            "I;16N",
+            "F",
+            "RGB",
+            "RGBA",
+            "CMYK",
+            "YCbCr",
+        ]:
             im = hopper(mode)
             r = self.resize(im, (15, 12), Image.Resampling.BILINEAR)
             assert r.mode == mode
@@ -305,14 +315,14 @@ class TestImageResize:
             im = im.resize((64, 64))
             assert im.size == (64, 64)
 
-    @pytest.mark.parametrize("mode", ("L", "RGB", "I", "F"))
+    @pytest.mark.parametrize(
+        "mode", ("L", "RGB", "I", "I;16", "I;16L", "I;16B", "I;16N", "F")
+    )
     def test_default_filter_bicubic(self, mode: str) -> None:
         im = hopper(mode)
         assert im.resize((20, 20), Image.Resampling.BICUBIC) == im.resize((20, 20))
 
-    @pytest.mark.parametrize(
+    @pytest.mark.parametrize("mode", ("1", "P", "BGR;15", "BGR;16"))
-        "mode", ("1", "P", "I;16", "I;16L", "I;16B", "BGR;15", "BGR;16")
-    )
     def test_default_filter_nearest(self, mode: str) -> None:
         im = hopper(mode)
         assert im.resize((20, 20), Image.Resampling.NEAREST) == im.resize((20, 20))

Tests/test_imagemorph.py

@@ -324,17 +324,17 @@ def test_set_lut() -> None:
 
 def test_wrong_mode() -> None:
     lut = ImageMorph.LutBuilder(op_name="corner").build_lut()
-    imrgb = Image.new("RGB", (10, 10))
+    imrgb_ptr = Image.new("RGB", (10, 10)).getim()
-    iml = Image.new("L", (10, 10))
+    iml_ptr = Image.new("L", (10, 10)).getim()
 
     with pytest.raises(RuntimeError):
-        _imagingmorph.apply(bytes(lut), imrgb.im.id, iml.im.id)
+        _imagingmorph.apply(bytes(lut), imrgb_ptr, iml_ptr)
 
     with pytest.raises(RuntimeError):
-        _imagingmorph.apply(bytes(lut), iml.im.id, imrgb.im.id)
+        _imagingmorph.apply(bytes(lut), iml_ptr, imrgb_ptr)
 
     with pytest.raises(RuntimeError):
-        _imagingmorph.match(bytes(lut), imrgb.im.id)
+        _imagingmorph.match(bytes(lut), imrgb_ptr)
 
     # Should not raise
-    _imagingmorph.match(bytes(lut), iml.im.id)
+    _imagingmorph.match(bytes(lut), iml_ptr)

Tests/test_imagepath.py

@@ -204,6 +204,17 @@ def test_overflow_segfault() -> None:
             x[i] = b"0" * 16
 
 
+def test_compact_within_map() -> None:
+    p = ImagePath.Path([0, 1])
+
+    def map_func(x: float, y: float) -> tuple[float, float]:
+        p.compact()
+        return 0, 0
+
+    with pytest.raises(ValueError):
+        p.map(map_func)
+
+
 class Evil:
     def __init__(self) -> None:
         self.corrupt = Image.core.path(0x4000000000000000)

Tests/test_imageshow.py

@@ -117,5 +117,5 @@ def test_ipythonviewer() -> None:
     else:
         pytest.fail("IPythonViewer not found")
 
-    im = hopper()
+    with hopper() as im:
-    assert test_viewer.show(im) == 1
+        assert test_viewer.show(im) == 1

Tests/test_pickle.py

@@ -56,10 +56,10 @@ def helper_pickle_string(protocol: int, test_file: str, mode: str | None) -> Non
         ),
         ("Tests/images/hopper.tif", None),
         ("Tests/images/test-card.png", None),
-        ("Tests/images/zero_bb.png", None),
+        ("Tests/images/eps/zero_bb.png", None),
-        ("Tests/images/zero_bb_scale2.png", None),
+        ("Tests/images/eps/zero_bb_scale2.png", None),
-        ("Tests/images/non_zero_bb.png", None),
+        ("Tests/images/eps/non_zero_bb.png", None),
-        ("Tests/images/non_zero_bb_scale2.png", None),
+        ("Tests/images/eps/non_zero_bb_scale2.png", None),
         ("Tests/images/p_trns_single.png", None),
         ("Tests/images/pil123p.png", None),
         ("Tests/images/itxt_chunks.png", None),

depends/install_imagequant.sh

@@ -23,19 +23,14 @@ else
     cargo cinstall --prefix=/usr --destdir=.
 
     # Copy into place
-    if [ -d "usr/lib64" ]; then
+    sudo find usr -name libimagequant.so* -exec cp {} /usr/lib/ \;
-        lib="lib64"
-    else
-        lib="lib"
-    fi
-    sudo cp usr/$lib/libimagequant.so* /usr/lib/
     sudo cp usr/include/libimagequant.h /usr/include/
 
     if [ -n "$GITHUB_ACTIONS" ]; then
         # Copy to cache
         rm -rf ~/cache-$archive_name
         mkdir ~/cache-$archive_name
-        cp usr/lib/libimagequant.so* ~/cache-$archive_name/
+        find usr -name libimagequant.so* -exec cp {} ~/cache-$archive_name/ \;
         cp usr/include/libimagequant.h ~/cache-$archive_name/
     fi
 

docs/Makefile

@@ -46,7 +46,7 @@ clean:
 	-rm -rf $(BUILDDIR)/*
 
 install-sphinx:
-	$(PYTHON) -m pip install --quiet furo olefile sphinx sphinx-copybutton sphinx-inline-tabs sphinxext-opengraph
+	$(PYTHON) -m pip install -e ..[docs]
 
 .PHONY: html
 html:

docs/conf.py

@@ -22,7 +22,7 @@ import PIL
 # -- General configuration ------------------------------------------------
 
 # If your documentation needs a minimal Sphinx version, state it here.
-needs_sphinx = "7.3"
+needs_sphinx = "8.1"
 
 # Add any Sphinx extension module names here, as strings. They can be
 # extensions coming with Sphinx (named 'sphinx.ext.*') or your custom
@@ -121,7 +121,7 @@ nitpicky = True
 # generating warnings in “nitpicky mode”. Note that type should include the domain name
 # if present. Example entries would be ('py:func', 'int') or
 # ('envvar', 'LD_LIBRARY_PATH').
-nitpick_ignore = [("py:class", "_io.BytesIO")]
+nitpick_ignore = [("py:class", "_io.BytesIO"), ("py:class", "_CmsProfileCompatible")]
 
 
 # -- Options for HTML output ----------------------------------------------
@@ -338,8 +338,6 @@ linkcheck_allowed_redirects = {
 # https://www.sphinx-doc.org/en/master/usage/extensions/extlinks.html
 _repo = "https://github.com/python-pillow/Pillow/"
 extlinks = {
-    "cve": ("https://www.cve.org/CVERecord?id=CVE-%s", "CVE-%s"),
-    "cwe": ("https://cwe.mitre.org/data/definitions/%s.html", "CWE-%s"),
     "issue": (_repo + "issues/%s", "#%s"),
     "pr": (_repo + "pull/%s", "#%s"),
     "pypi": ("https://pypi.org/project/%s/", "%s"),

docs/deprecations.rst

@@ -165,6 +165,16 @@ Specific WebP Feature Checks
 ``True`` if the WebP module is installed, until they are removed in Pillow
 12.0.0 (2025-10-15).
 
+Get internal pointers to objects
+^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
+
+.. deprecated:: 11.0.0
+
+``Image.core.ImagingCore.id`` and ``Image.core.ImagingCore.unsafe_ptrs`` have been
+deprecated and will be removed in Pillow 12 (2025-10-15). They were used for obtaining
+raw pointers to ``ImagingCore`` internals. To interact with C code, you can use
+``Image.Image.getim()``, which returns a ``Capsule`` object.
+
 Removed features
 ----------------
 

docs/installation/platform-support.rst

@@ -17,13 +17,13 @@ These platforms are built and tested for every change.
 +----------------------------------+----------------------------+---------------------+
 | Operating system                 | Tested Python versions     | Tested architecture |
 +==================================+============================+=====================+
-| Alpine                           | 3.9                        | x86-64              |
+| Alpine                           | 3.12                       | x86-64              |
 +----------------------------------+----------------------------+---------------------+
 | Amazon Linux 2                   | 3.9                        | x86-64              |
 +----------------------------------+----------------------------+---------------------+
 | Amazon Linux 2023                | 3.9                        | x86-64              |
 +----------------------------------+----------------------------+---------------------+
-| Arch                             | 3.9                        | x86-64              |
+| Arch                             | 3.12                       | x86-64              |
 +----------------------------------+----------------------------+---------------------+
 | CentOS Stream 9                  | 3.9                        | x86-64              |
 +----------------------------------+----------------------------+---------------------+
@@ -33,7 +33,7 @@ These platforms are built and tested for every change.
 +----------------------------------+----------------------------+---------------------+
 | Fedora 40                        | 3.12                       | x86-64              |
 +----------------------------------+----------------------------+---------------------+
-| Gentoo                           | 3.9                        | x86-64              |
+| Gentoo                           | 3.12                       | x86-64              |
 +----------------------------------+----------------------------+---------------------+
 | macOS 13 Ventura                 | 3.9                        | x86-64              |
 +----------------------------------+----------------------------+---------------------+
@@ -48,12 +48,12 @@ These platforms are built and tested for every change.
 | Ubuntu Linux 24.04 LTS (Noble)   | 3.12                       | x86-64, ppc64le,    |
 |                                  |                            | s390x               |
 +----------------------------------+----------------------------+---------------------+
-| Windows Server 2016              | 3.9                        | x86-64              |
+| Windows Server 2019              | 3.9                        | x86-64              |
 +----------------------------------+----------------------------+---------------------+
 | Windows Server 2022              | 3.9, 3.10, 3.11,           | x86-64              |
 |                                  | 3.12, 3.13, PyPy3          |                     |
 |                                  +----------------------------+---------------------+
-|                                  | 3.12                       | x86                 |
+|                                  | 3.13                       | x86                 |
 |                                  +----------------------------+---------------------+
 |                                  | 3.9 (MinGW)                | x86-64              |
 |                                  +----------------------------+---------------------+
@@ -75,6 +75,8 @@ These platforms have been reported to work at the versions mentioned.
 | Operating system                 | | Tested Python            | | Latest tested  | | Tested     |
 |                                  | | versions                 | | Pillow version | | processors |
 +==================================+============================+==================+==============+
+| macOS 15 Sequoia                 | 3.8, 3.9, 3.10, 3.11, 3.12 | 10.4.0           |arm           |
++----------------------------------+----------------------------+------------------+--------------+
 | macOS 14 Sonoma                  | 3.8, 3.9, 3.10, 3.11, 3.12 | 10.4.0           |arm           |
 +----------------------------------+----------------------------+------------------+--------------+
 | macOS 13 Ventura                 | 3.8, 3.9, 3.10, 3.11       | 10.0.1           |arm           |

docs/releasenotes/11.0.0.rst

@@ -73,6 +73,16 @@ vulnerability introduced in FreeType 2.6 (:cve:`2020-15999`).
 
 .. _2.10.4: https://sourceforge.net/projects/freetype/files/freetype2/2.10.4/
 
+Get internal pointers to objects
+^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
+
+.. deprecated:: 11.0.0
+
+``Image.core.ImagingCore.id`` and ``Image.core.ImagingCore.unsafe_ptrs`` have been
+deprecated and will be removed in Pillow 12 (2025-10-15). They were used for obtaining
+raw pointers to ``ImagingCore`` internals. To interact with C code, you can use
+``Image.Image.getim()``, which returns a ``Capsule`` object.
+
 ICNS (width, height, scale) sizes
 ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
 
@@ -119,10 +129,11 @@ Specific WebP Feature Checks
 API Changes
 ===========
 
-TODO
+Default resampling filter for I;16* image modes
-^^^^
+^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
 
-TODO
+The default resampling filter for I;16, I;16L, I;16B and I;16N has been changed from
+``Image.NEAREST`` to ``Image.BICUBIC``, to match the majority of modes.
 
 API Additions
 =============

pyproject.toml

@@ -43,7 +43,7 @@ dynamic = [
 optional-dependencies.docs = [
   "furo",
   "olefile",
-  "sphinx>=7.3",
+  "sphinx>=8.1",
   "sphinx-copybutton",
   "sphinx-inline-tabs",
   "sphinxext-opengraph",
@@ -97,9 +97,13 @@ config-settings = "raqm=enable raqm=vendor fribidi=vendor imagequant=disable"
 test-command = "cd {project} && .github/workflows/wheels-test.sh"
 test-extras = "tests"
 
-[tool.ruff]
+[tool.black]
-fix = true
+exclude = "wheels/multibuild"
 
+[tool.ruff]
+exclude = [ "wheels/multibuild" ]
+
+fix = true
 lint.select = [
   "C4",     # flake8-comprehensions
   "E",      # pycodestyle errors

src/PIL/EpsImagePlugin.py

@@ -121,7 +121,13 @@ def Ghostscript(
                 lengthfile -= len(s)
                 f.write(s)
 
-    device = "pngalpha" if transparency else "ppmraw"
+    if transparency:
+        # "RGBA"
+        device = "pngalpha"
+    else:
+        # "pnmraw" automatically chooses between
+        # PBM ("1"), PGM ("L"), and PPM ("RGB").
+        device = "pnmraw"
 
     # Build Ghostscript command
     command = [
@@ -151,8 +157,9 @@ def Ghostscript(
             startupinfo = subprocess.STARTUPINFO()
             startupinfo.dwFlags |= subprocess.STARTF_USESHOWWINDOW
         subprocess.check_call(command, startupinfo=startupinfo)
-        out_im = Image.open(outfile)
+        with Image.open(outfile) as out_im:
-        out_im.load()
+            out_im.load()
+            return out_im.im.copy()
     finally:
         try:
             os.unlink(outfile)
@@ -161,10 +168,6 @@ def Ghostscript(
         except OSError:
             pass
 
-    im = out_im.im.copy()
-    out_im.close()
-    return im
-
 
 def _accept(prefix: bytes) -> bool:
     return prefix[:4] == b"%!PS" or (len(prefix) >= 4 and i32(prefix) == 0xC6D3D0C5)
@@ -191,6 +194,11 @@ class EpsImageFile(ImageFile.ImageFile):
 
         self._mode = "RGB"
 
+        # When reading header comments, the first comment is used.
+        # When reading trailer comments, the last comment is used.
+        bounding_box: list[int] | None = None
+        imagedata_size: tuple[int, int] | None = None
+
         byte_arr = bytearray(255)
         bytes_mv = memoryview(byte_arr)
         bytes_read = 0
@@ -211,8 +219,8 @@ class EpsImageFile(ImageFile.ImageFile):
                 msg = 'EPS header missing "%%BoundingBox" comment'
                 raise SyntaxError(msg)
 
-        def _read_comment(s: str) -> bool:
+        def read_comment(s: str) -> bool:
-            nonlocal reading_trailer_comments
+            nonlocal bounding_box, reading_trailer_comments
             try:
                 m = split.match(s)
             except re.error as e:
@@ -227,18 +235,12 @@ class EpsImageFile(ImageFile.ImageFile):
             if k == "BoundingBox":
                 if v == "(atend)":
                     reading_trailer_comments = True
-                elif not self.tile or (trailer_reached and reading_trailer_comments):
+                elif not bounding_box or (trailer_reached and reading_trailer_comments):
                     try:
                         # Note: The DSC spec says that BoundingBox
                         # fields should be integers, but some drivers
                         # put floating point values there anyway.
-                        box = [int(float(i)) for i in v.split()]
+                        bounding_box = [int(float(i)) for i in v.split()]
-                        self._size = box[2] - box[0], box[3] - box[1]
-                        self.tile = [
-                            ImageFile._Tile(
-                                "eps", (0, 0) + self.size, offset, (length, box)
-                            )
-                        ]
                     except Exception:
                         pass
             return True
@@ -289,7 +291,7 @@ class EpsImageFile(ImageFile.ImageFile):
                     continue
 
                 s = str(bytes_mv[:bytes_read], "latin-1")
-                if not _read_comment(s):
+                if not read_comment(s):
                     m = field.match(s)
                     if m:
                         k = m.group(1)
@@ -308,6 +310,12 @@ class EpsImageFile(ImageFile.ImageFile):
                 # Check for an "ImageData" descriptor
                 # https://www.adobe.com/devnet-apps/photoshop/fileformatashtml/#50577413_pgfId-1035096
 
+                # If we've already read an "ImageData" descriptor,
+                # don't read another one.
+                if imagedata_size:
+                    bytes_read = 0
+                    continue
+
                 # Values:
                 # columns
                 # rows
@@ -333,22 +341,35 @@ class EpsImageFile(ImageFile.ImageFile):
                 else:
                     break
 
-                self._size = columns, rows
+                # Parse the columns and rows after checking the bit depth and mode
-                return
+                # in case the bit depth and/or mode are invalid.
+                imagedata_size = columns, rows
             elif bytes_mv[:5] == b"%%EOF":
                 break
             elif trailer_reached and reading_trailer_comments:
                 # Load EPS trailer
                 s = str(bytes_mv[:bytes_read], "latin-1")
-                _read_comment(s)
+                read_comment(s)
             elif bytes_mv[:9] == b"%%Trailer":
                 trailer_reached = True
             bytes_read = 0
 
-        if not self.tile:
+        # A "BoundingBox" is always required,
+        # even if an "ImageData" descriptor size exists.
+        if not bounding_box:
             msg = "cannot determine EPS bounding box"
             raise OSError(msg)
 
+        # An "ImageData" size takes precedence over the "BoundingBox".
+        self._size = imagedata_size or (
+            bounding_box[2] - bounding_box[0],
+            bounding_box[3] - bounding_box[1],
+        )
+
+        self.tile = [
+            ImageFile._Tile("eps", (0, 0) + self.size, offset, (length, bounding_box))
+        ]
+
     def _find_offset(self, fp: IO[bytes]) -> tuple[int, int]:
         s = fp.read(4)
 

src/PIL/Image.py

@@ -225,12 +225,7 @@ if TYPE_CHECKING:
     from IPython.lib.pretty import PrettyPrinter
 
     from . import ImageFile, ImageFilter, ImagePalette, ImageQt, TiffImagePlugin
-    from ._typing import NumpyArray, StrOrBytesPath, TypeGuard
+    from ._typing import CapsuleType, NumpyArray, StrOrBytesPath, TypeGuard
-
-    if sys.version_info >= (3, 13):
-        from types import CapsuleType
-    else:
-        CapsuleType = object
 ID: list[str] = []
 OPEN: dict[
     str,
@@ -2278,8 +2273,8 @@ class Image:
            :py:data:`Resampling.BILINEAR`, :py:data:`Resampling.HAMMING`,
            :py:data:`Resampling.BICUBIC` or :py:data:`Resampling.LANCZOS`.
            If the image has mode "1" or "P", it is always set to
-           :py:data:`Resampling.NEAREST`. If the image mode specifies a number
+           :py:data:`Resampling.NEAREST`. If the image mode is "BGR;15",
-           of bits, such as "I;16", then the default filter is
+           "BGR;16" or "BGR;24", then the default filter is
            :py:data:`Resampling.NEAREST`. Otherwise, the default filter is
            :py:data:`Resampling.BICUBIC`. See: :ref:`concept-filters`.
         :param box: An optional 4-tuple of floats providing
@@ -2302,8 +2297,8 @@ class Image:
         """
 
         if resample is None:
-            type_special = ";" in self.mode
+            bgr = self.mode.startswith("BGR;")
-            resample = Resampling.NEAREST if type_special else Resampling.BICUBIC
+            resample = Resampling.NEAREST if bgr else Resampling.BICUBIC
         elif resample not in (
             Resampling.NEAREST,
             Resampling.BILINEAR,

src/PIL/ImageCms.py

@@ -31,6 +31,10 @@ from ._typing import SupportsRead
 
 try:
     from . import _imagingcms as core
+
+    _CmsProfileCompatible = Union[
+        str, SupportsRead[bytes], core.CmsProfile, "ImageCmsProfile"
+    ]
 except ImportError as ex:
     # Allow error import for doc purposes, but error out when accessing
     # anything in core.
@@ -349,19 +353,17 @@ class ImageCmsTransform(Image.ImagePointHandler):
         return self.apply(im)
 
     def apply(self, im: Image.Image, imOut: Image.Image | None = None) -> Image.Image:
-        im.load()
         if imOut is None:
             imOut = Image.new(self.output_mode, im.size, None)
-        self.transform.apply(im.im.id, imOut.im.id)
+        self.transform.apply(im.getim(), imOut.getim())
         imOut.info["icc_profile"] = self.output_profile.tobytes()
         return imOut
 
     def apply_in_place(self, im: Image.Image) -> Image.Image:
-        im.load()
         if im.mode != self.output_mode:
             msg = "mode mismatch"
             raise ValueError(msg)  # wrong output mode
-        self.transform.apply(im.im.id, im.im.id)
+        self.transform.apply(im.getim(), im.getim())
         im.info["icc_profile"] = self.output_profile.tobytes()
         return im
 
@@ -391,10 +393,6 @@ def get_display_profile(handle: SupportsInt | None = None) -> ImageCmsProfile |
 # pyCMS compatible layer
 # --------------------------------------------------------------------.
 
-_CmsProfileCompatible = Union[
-    str, SupportsRead[bytes], core.CmsProfile, ImageCmsProfile
-]
-
 
 class PyCMSError(Exception):
     """(pyCMS) Exception class.

src/PIL/ImageEnhance.py

@@ -55,7 +55,9 @@ class Color(_Enhance):
         if "A" in image.getbands():
             self.intermediate_mode = "LA"
 
-        self.degenerate = image.convert(self.intermediate_mode).convert(image.mode)
+        if self.intermediate_mode != image.mode:
+            image = image.convert(self.intermediate_mode).convert(image.mode)
+        self.degenerate = image
 
 
 class Contrast(_Enhance):
@@ -68,11 +70,15 @@ class Contrast(_Enhance):
 
     def __init__(self, image: Image.Image) -> None:
         self.image = image
-        mean = int(ImageStat.Stat(image.convert("L")).mean[0] + 0.5)
+        if image.mode != "L":
-        self.degenerate = Image.new("L", image.size, mean).convert(image.mode)
+            image = image.convert("L")
+        mean = int(ImageStat.Stat(image).mean[0] + 0.5)
+        self.degenerate = Image.new("L", image.size, mean)
+        if self.degenerate.mode != self.image.mode:
+            self.degenerate = self.degenerate.convert(self.image.mode)
 
-        if "A" in image.getbands():
+        if "A" in self.image.getbands():
-            self.degenerate.putalpha(image.getchannel("A"))
+            self.degenerate.putalpha(self.image.getchannel("A"))
 
 
 class Brightness(_Enhance):

src/PIL/ImageMath.py

@@ -59,13 +59,12 @@ class _Operand:
         if im2 is None:
             # unary operation
             out = Image.new(mode or im_1.mode, im_1.size, None)
-            im_1.load()
             try:
                 op = getattr(_imagingmath, f"{op}_{im_1.mode}")
             except AttributeError as e:
                 msg = f"bad operand type for '{op}'"
                 raise TypeError(msg) from e
-            _imagingmath.unop(op, out.im.id, im_1.im.id)
+            _imagingmath.unop(op, out.getim(), im_1.getim())
         else:
             # binary operation
             im_2 = self.__fixup(im2)
@@ -86,14 +85,12 @@ class _Operand:
                 if im_2.size != size:
                     im_2 = im_2.crop((0, 0) + size)
             out = Image.new(mode or im_1.mode, im_1.size, None)
-            im_1.load()
-            im_2.load()
             try:
                 op = getattr(_imagingmath, f"{op}_{im_1.mode}")
             except AttributeError as e:
                 msg = f"bad operand type for '{op}'"
                 raise TypeError(msg) from e
-            _imagingmath.binop(op, out.im.id, im_1.im.id, im_2.im.id)
+            _imagingmath.binop(op, out.getim(), im_1.getim(), im_2.getim())
         return _Operand(out)
 
     # unary operators

src/PIL/ImageMorph.py

@@ -213,7 +213,7 @@ class MorphOp:
             msg = "Image mode must be L"
             raise ValueError(msg)
         outimage = Image.new(image.mode, image.size, None)
-        count = _imagingmorph.apply(bytes(self.lut), image.im.id, outimage.im.id)
+        count = _imagingmorph.apply(bytes(self.lut), image.getim(), outimage.getim())
         return count, outimage
 
     def match(self, image: Image.Image) -> list[tuple[int, int]]:
@@ -229,7 +229,7 @@ class MorphOp:
         if image.mode != "L":
             msg = "Image mode must be L"
             raise ValueError(msg)
-        return _imagingmorph.match(bytes(self.lut), image.im.id)
+        return _imagingmorph.match(bytes(self.lut), image.getim())
 
     def get_on_pixels(self, image: Image.Image) -> list[tuple[int, int]]:
         """Get a list of all turned on pixels in a binary image
@@ -240,7 +240,7 @@ class MorphOp:
         if image.mode != "L":
             msg = "Image mode must be L"
             raise ValueError(msg)
-        return _imagingmorph.get_on_pixels(image.im.id)
+        return _imagingmorph.get_on_pixels(image.getim())
 
     def load_lut(self, filename: str) -> None:
         """Load an operator from an mrl file"""

src/PIL/ImageTk.py

@@ -32,23 +32,12 @@ from typing import TYPE_CHECKING, Any, cast
 
 from . import Image, ImageFile
 
+if TYPE_CHECKING:
+    from ._typing import CapsuleType
+
 # --------------------------------------------------------------------
 # Check for Tkinter interface hooks
 
-_pilbitmap_ok = None
-
-
-def _pilbitmap_check() -> int:
-    global _pilbitmap_ok
-    if _pilbitmap_ok is None:
-        try:
-            im = Image.new("1", (1, 1))
-            tkinter.BitmapImage(data=f"PIL:{im.im.id}")
-            _pilbitmap_ok = 1
-        except tkinter.TclError:
-            _pilbitmap_ok = 0
-    return _pilbitmap_ok
-
 
 def _get_image_from_kw(kw: dict[str, Any]) -> ImageFile.ImageFile | None:
     source = None
@@ -62,18 +51,18 @@ def _get_image_from_kw(kw: dict[str, Any]) -> ImageFile.ImageFile | None:
 
 
 def _pyimagingtkcall(
-    command: str, photo: PhotoImage | tkinter.PhotoImage, id: int
+    command: str, photo: PhotoImage | tkinter.PhotoImage, ptr: CapsuleType
 ) -> None:
     tk = photo.tk
     try:
-        tk.call(command, photo, id)
+        tk.call(command, photo, repr(ptr))
     except tkinter.TclError:
         # activate Tkinter hook
         # may raise an error if it cannot attach to Tkinter
         from . import _imagingtk
 
         _imagingtk.tkinit(tk.interpaddr())
-        tk.call(command, photo, id)
+        tk.call(command, photo, repr(ptr))
 
 
 # --------------------------------------------------------------------
@@ -142,7 +131,10 @@ class PhotoImage:
             self.paste(image)
 
     def __del__(self) -> None:
-        name = self.__photo.name
+        try:
+            name = self.__photo.name
+        except AttributeError:
+            return
         self.__photo.name = None
         try:
             self.__photo.tk.call("image", "delete", name)
@@ -185,15 +177,14 @@ class PhotoImage:
                    the bitmap image.
         """
         # convert to blittable
-        im.load()
+        ptr = im.getim()
         image = im.im
-        if image.isblock() and im.mode == self.__mode:
+        if not image.isblock() or im.mode != self.__mode:
-            block = image
+            block = Image.core.new_block(self.__mode, im.size)
-        else:
-            block = image.new_block(self.__mode, im.size)
             image.convert2(block, image)  # convert directly between buffers
+            ptr = block.ptr
 
-        _pyimagingtkcall("PyImagingPhoto", self.__photo, block.id)
+        _pyimagingtkcall("PyImagingPhoto", self.__photo, ptr)
 
 
 # --------------------------------------------------------------------
@@ -225,18 +216,13 @@ class BitmapImage:
         self.__mode = image.mode
         self.__size = image.size
 
-        if _pilbitmap_check():
+        self.__photo = tkinter.BitmapImage(data=image.tobitmap(), **kw)
-            # fast way (requires the pilbitmap booster patch)
-            image.load()
-            kw["data"] = f"PIL:{image.im.id}"
-            self.__im = image  # must keep a reference
-        else:
-            # slow but safe way
-            kw["data"] = image.tobitmap()
-        self.__photo = tkinter.BitmapImage(**kw)
 
     def __del__(self) -> None:
-        name = self.__photo.name
+        try:
+            name = self.__photo.name
+        except AttributeError:
+            return
         self.__photo.name = None
         try:
             self.__photo.tk.call("image", "delete", name)
@@ -273,9 +259,8 @@ class BitmapImage:
 def getimage(photo: PhotoImage) -> Image.Image:
     """Copies the contents of a PhotoImage to a PIL image memory."""
     im = Image.new("RGBA", (photo.width(), photo.height()))
-    block = im.im
 
-    _pyimagingtkcall("PyImagingPhotoGet", photo, block.id)
+    _pyimagingtkcall("PyImagingPhotoGet", photo, im.getim())
 
     return im
 

src/PIL/PngImagePlugin.py

@@ -1063,6 +1063,12 @@ class PngImageFile(ImageFile.ImageFile):
                         "RGBA", self.info["transparency"]
                     )
                 else:
+                    if self.im.mode == "P" and "transparency" in self.info:
+                        t = self.info["transparency"]
+                        if isinstance(t, bytes):
+                            updated.putpalettealphas(t)
+                        elif isinstance(t, int):
+                            updated.putpalettealpha(t)
                     mask = updated.convert("RGBA")
                 self._prev_im.paste(updated, self.dispose_extent, mask)
                 self.im = self._prev_im

src/PIL/TiffImagePlugin.py

@@ -1864,7 +1864,7 @@ def _save(im: Image.Image, fp: IO[bytes], filename: str | bytes) -> None:
         if hasattr(fp, "fileno"):
             try:
                 fp.seek(0)
-                _fp = os.dup(fp.fileno())
+                _fp = fp.fileno()
             except io.UnsupportedOperation:
                 pass
 
@@ -1937,17 +1937,11 @@ def _save(im: Image.Image, fp: IO[bytes], filename: str | bytes) -> None:
         encoder = Image._getencoder(im.mode, "libtiff", a, encoderconfig)
         encoder.setimage(im.im, (0, 0) + im.size)
         while True:
-            # undone, change to self.decodermaxblock:
+            errcode, data = encoder.encode(ImageFile.MAXBLOCK)[1:]
-            errcode, data = encoder.encode(16 * 1024)[1:]
             if not _fp:
                 fp.write(data)
             if errcode:
                 break
-        if _fp:
-            try:
-                os.close(_fp)
-            except OSError:
-                pass
         if errcode < 0:
             msg = f"encoder error {errcode} when writing image file"
             raise OSError(msg)
@@ -2121,13 +2115,24 @@ class AppendingTiffWriter(io.BytesIO):
     def write(self, data: Buffer, /) -> int:
         return self.f.write(data)
 
-    def readShort(self) -> int:
+    def _fmt(self, field_size: int) -> str:
-        (value,) = struct.unpack(self.shortFmt, self.f.read(2))
+        try:
+            return {2: "H", 4: "L", 8: "Q"}[field_size]
+        except KeyError:
+            msg = "offset is not supported"
+            raise RuntimeError(msg)
+
+    def _read(self, field_size: int) -> int:
+        (value,) = struct.unpack(
+            self.endian + self._fmt(field_size), self.f.read(field_size)
+        )
         return value
 
+    def readShort(self) -> int:
+        return self._read(2)
+
     def readLong(self) -> int:
-        (value,) = struct.unpack(self.longFmt, self.f.read(4))
+        return self._read(4)
-        return value
 
     @staticmethod
     def _verify_bytes_written(bytes_written: int | None, expected: int) -> None:
@@ -2140,15 +2145,18 @@ class AppendingTiffWriter(io.BytesIO):
         bytes_written = self.f.write(struct.pack(self.longFmt, value))
         self._verify_bytes_written(bytes_written, 4)
 
+    def _rewriteLast(self, value: int, field_size: int) -> None:
+        self.f.seek(-field_size, os.SEEK_CUR)
+        bytes_written = self.f.write(
+            struct.pack(self.endian + self._fmt(field_size), value)
+        )
+        self._verify_bytes_written(bytes_written, field_size)
+
     def rewriteLastShort(self, value: int) -> None:
-        self.f.seek(-2, os.SEEK_CUR)
+        return self._rewriteLast(value, 2)
-        bytes_written = self.f.write(struct.pack(self.shortFmt, value))
-        self._verify_bytes_written(bytes_written, 2)
 
     def rewriteLastLong(self, value: int) -> None:
-        self.f.seek(-4, os.SEEK_CUR)
+        return self._rewriteLast(value, 4)
-        bytes_written = self.f.write(struct.pack(self.longFmt, value))
-        self._verify_bytes_written(bytes_written, 4)
 
     def writeShort(self, value: int) -> None:
         bytes_written = self.f.write(struct.pack(self.shortFmt, value))
@@ -2180,32 +2188,22 @@ class AppendingTiffWriter(io.BytesIO):
                 cur_pos = self.f.tell()
 
                 if is_local:
-                    self.fixOffsets(
+                    self._fixOffsets(count, field_size)
-                        count, isShort=(field_size == 2), isLong=(field_size == 4)
-                    )
                     self.f.seek(cur_pos + 4)
                 else:
                     self.f.seek(offset)
-                    self.fixOffsets(
+                    self._fixOffsets(count, field_size)
-                        count, isShort=(field_size == 2), isLong=(field_size == 4)
-                    )
                     self.f.seek(cur_pos)
 
             elif is_local:
                 # skip the locally stored value that is not an offset
                 self.f.seek(4, os.SEEK_CUR)
 
-    def fixOffsets(
+    def _fixOffsets(self, count: int, field_size: int) -> None:
-        self, count: int, isShort: bool = False, isLong: bool = False
-    ) -> None:
-        if not isShort and not isLong:
-            msg = "offset is neither short nor long"
-            raise RuntimeError(msg)
-
         for i in range(count):
-            offset = self.readShort() if isShort else self.readLong()
+            offset = self._read(field_size)
             offset += self.offsetOfNewPage
-            if isShort and offset >= 65536:
+            if field_size == 2 and offset >= 65536:
                 # offset is now too large - we must convert shorts to longs
                 if count != 1:
                     msg = "not implemented"
@@ -2217,10 +2215,19 @@ class AppendingTiffWriter(io.BytesIO):
                 self.f.seek(-10, os.SEEK_CUR)
                 self.writeShort(TiffTags.LONG)  # rewrite the type to LONG
                 self.f.seek(8, os.SEEK_CUR)
-            elif isShort:
-                self.rewriteLastShort(offset)
             else:
-                self.rewriteLastLong(offset)
+                self._rewriteLast(offset, field_size)
+
+    def fixOffsets(
+        self, count: int, isShort: bool = False, isLong: bool = False
+    ) -> None:
+        if isShort:
+            field_size = 2
+        elif isLong:
+            field_size = 4
+        else:
+            field_size = 0
+        return self._fixOffsets(count, field_size)
 
 
 def _save_all(im: Image.Image, fp: IO[bytes], filename: str | bytes) -> None:

src/PIL/_imagingcms.pyi

@@ -2,6 +2,8 @@ import datetime
 import sys
 from typing import Literal, SupportsFloat, TypedDict
 
+from ._typing import CapsuleType
+
 littlecms_version: str | None
 
 _Tuple3f = tuple[float, float, float]
@@ -108,7 +110,7 @@ class CmsProfile:
     def is_intent_supported(self, intent: int, direction: int, /) -> int: ...
 
 class CmsTransform:
-    def apply(self, id_in: int, id_out: int) -> int: ...
+    def apply(self, id_in: CapsuleType, id_out: CapsuleType) -> int: ...
 
 def profile_open(profile: str, /) -> CmsProfile: ...
 def profile_frombytes(profile: bytes, /) -> CmsProfile: ...

src/PIL/_typing.py

@@ -15,6 +15,11 @@ if TYPE_CHECKING:
     except (ImportError, AttributeError):
         pass
 
+if sys.version_info >= (3, 13):
+    from types import CapsuleType
+else:
+    CapsuleType = object
+
 if sys.version_info >= (3, 12):
     from collections.abc import Buffer
 else:

src/PIL/features.py

@@ -146,10 +146,11 @@ def check_feature(feature: str) -> bool | None:
 
     module, flag, ver = features[feature]
 
+    if isinstance(flag, bool):
+        deprecate(f'check_feature("{feature}")', 12)
     try:
         imported_module = __import__(module, fromlist=["PIL"])
         if isinstance(flag, bool):
-            deprecate(f'check_feature("{feature}")', 12)
             return flag
         return getattr(imported_module, flag)
     except ModuleNotFoundError:

src/Tk/tkImaging.c

@@ -56,19 +56,34 @@ static Tk_PhotoPutBlock_t TK_PHOTO_PUT_BLOCK;
 
 static Imaging
 ImagingFind(const char *name) {
-    Py_ssize_t id;
+    PyObject *capsule;
+    int direct_pointer = 0;
+    const char *expected = "capsule object \"" IMAGING_MAGIC "\" at 0x";
 
-    /* FIXME: use CObject instead? */
+    if (name[0] == '<') {
-#if defined(_WIN64)
+        name++;
-    id = _atoi64(name);
+    } else {
-#else
+        // Special case for PyPy, where the string representation of a Capsule
-    id = atol(name);
+        // refers directly to the pointer itself, not to the PyCapsule object.
-#endif
+        direct_pointer = 1;
-    if (!id) {
+    }
+
+    if (strncmp(name, expected, strlen(expected))) {
         return NULL;
     }
 
-    return (Imaging)id;
+    capsule = (PyObject *)strtoull(name + strlen(expected), NULL, 16);
+
+    if (direct_pointer) {
+        return (Imaging)capsule;
+    }
+
+    if (!PyCapsule_IsValid(capsule, IMAGING_MAGIC)) {
+        PyErr_Format(PyExc_TypeError, "Expected '%s' Capsule", IMAGING_MAGIC);
+        return NULL;
+    }
+
+    return (Imaging)PyCapsule_GetPointer(capsule, IMAGING_MAGIC);
 }
 
 static int

src/_imaging.c

@@ -1579,16 +1579,12 @@ _putdata(ImagingObject *self, PyObject *args) {
                 int bigendian = 0;
                 if (image->type == IMAGING_TYPE_SPECIAL) {
                     // I;16*
-                    if (strcmp(image->mode, "I;16N") == 0) {
+                    if (strcmp(image->mode, "I;16B") == 0
 #ifdef WORDS_BIGENDIAN
-                        bigendian = 1;
+                        || strcmp(image->mode, "I;16N") == 0
-#else
-                        bigendian = 0;
 #endif
-                    } else if (strcmp(image->mode, "I;16B") == 0) {
+                    ) {
                         bigendian = 1;
-                    } else {
-                        bigendian = 0;
                     }
                 }
                 for (i = x = y = 0; i < n; i++) {
@@ -3674,15 +3670,12 @@ static struct PyMethodDef methods[] = {
     /* Unsharpmask extension */
     {"gaussian_blur", (PyCFunction)_gaussian_blur, METH_VARARGS},
     {"unsharp_mask", (PyCFunction)_unsharp_mask, METH_VARARGS},
-
     {"box_blur", (PyCFunction)_box_blur, METH_VARARGS},
 
     /* Special effects */
     {"effect_spread", (PyCFunction)_effect_spread, METH_VARARGS},
 
     /* Misc. */
-    {"new_block", (PyCFunction)_new_block, METH_VARARGS},
-
     {"save_ppm", (PyCFunction)_save_ppm, METH_VARARGS},
 
     {NULL, NULL} /* sentinel */
@@ -3707,16 +3700,40 @@ _getattr_bands(ImagingObject *self, void *closure) {
 
 static PyObject *
 _getattr_id(ImagingObject *self, void *closure) {
+    if (PyErr_WarnEx(
+            PyExc_DeprecationWarning,
+            "id property is deprecated and will be removed in Pillow 12 (2025-10-15)",
+            1
+        ) < 0) {
+        return NULL;
+    }
     return PyLong_FromSsize_t((Py_ssize_t)self->image);
 }
 
+static void
+_ptr_destructor(PyObject *capsule) {
+    PyObject *self = (PyObject *)PyCapsule_GetContext(capsule);
+    Py_DECREF(self);
+}
+
 static PyObject *
 _getattr_ptr(ImagingObject *self, void *closure) {
-    return PyCapsule_New(self->image, IMAGING_MAGIC, NULL);
+    PyObject *capsule = PyCapsule_New(self->image, IMAGING_MAGIC, _ptr_destructor);
+    Py_INCREF(self);
+    PyCapsule_SetContext(capsule, self);
+    return capsule;
 }
 
 static PyObject *
 _getattr_unsafe_ptrs(ImagingObject *self, void *closure) {
+    if (PyErr_WarnEx(
+            PyExc_DeprecationWarning,
+            "unsafe_ptrs property is deprecated and will be removed in Pillow 12 "
+            "(2025-10-15)",
+            1
+        ) < 0) {
+        return NULL;
+    }
     return Py_BuildValue(
         "(sn)(sn)(sn)",
         "image8",
@@ -4198,6 +4215,7 @@ static PyMethodDef functions[] = {
     {"blend", (PyCFunction)_blend, METH_VARARGS},
     {"fill", (PyCFunction)_fill, METH_VARARGS},
     {"new", (PyCFunction)_new, METH_VARARGS},
+    {"new_block", (PyCFunction)_new_block, METH_VARARGS},
     {"merge", (PyCFunction)_merge, METH_VARARGS},
 
     /* Functions */

src/_imagingcms.c

@@ -531,23 +531,24 @@ buildProofTransform(PyObject *self, PyObject *args) {
 
 static PyObject *
 cms_transform_apply(CmsTransformObject *self, PyObject *args) {
-    Py_ssize_t idIn;
+    PyObject *i0, *i1;
-    Py_ssize_t idOut;
     Imaging im;
     Imaging imOut;
 
-    int result;
+    if (!PyArg_ParseTuple(args, "OO:apply", &i0, &i1)) {
-
-    if (!PyArg_ParseTuple(args, "nn:apply", &idIn, &idOut)) {
         return NULL;
     }
 
-    im = (Imaging)idIn;
+    if (!PyCapsule_IsValid(i0, IMAGING_MAGIC) ||
-    imOut = (Imaging)idOut;
+        !PyCapsule_IsValid(i1, IMAGING_MAGIC)) {
+        PyErr_Format(PyExc_TypeError, "Expected '%s' Capsule", IMAGING_MAGIC);
+        return NULL;
+    }
 
-    result = pyCMSdoTransform(im, imOut, self->transform);
+    im = (Imaging)PyCapsule_GetPointer(i0, IMAGING_MAGIC);
+    imOut = (Imaging)PyCapsule_GetPointer(i1, IMAGING_MAGIC);
 
-    return Py_BuildValue("i", result);
+    return Py_BuildValue("i", pyCMSdoTransform(im, imOut, self->transform));
 }
 
 /* -------------------------------------------------------------------- */

src/_imagingft.c

@@ -830,7 +830,6 @@ font_render(FontObject *self, PyObject *args) {
     unsigned char convert_scale;    /* scale factor for non-8bpp bitmaps */
     PyObject *image;
     Imaging im;
-    Py_ssize_t id;
     int mask = 0;  /* is FT_LOAD_TARGET_MONO enabled? */
     int color = 0; /* is FT_LOAD_COLOR enabled? */
     float stroke_width = 0;
@@ -922,17 +921,13 @@ font_render(FontObject *self, PyObject *args) {
     width += ceil(stroke_width * 2 + x_start);
     height += ceil(stroke_width * 2 + y_start);
     image = PyObject_CallFunction(fill, "ii", width, height);
-    if (image == Py_None) {
+    if (image == NULL) {
-        PyMem_Del(glyph_info);
-        return Py_BuildValue("N(ii)", image, 0, 0);
-    } else if (image == NULL) {
         PyMem_Del(glyph_info);
         return NULL;
     }
-    PyObject *imageId = PyObject_GetAttrString(image, "id");
+    PyObject *imagePtr = PyObject_GetAttrString(image, "ptr");
-    id = PyLong_AsSsize_t(imageId);
+    im = (Imaging)PyCapsule_GetPointer(imagePtr, IMAGING_MAGIC);
-    Py_XDECREF(imageId);
+    Py_XDECREF(imagePtr);
-    im = (Imaging)id;
 
     x_offset = round(x_offset - stroke_width);
     y_offset = round(y_offset - stroke_width);

src/_imagingmath.c

@@ -23,6 +23,9 @@
 #define MAX_INT32 2147483647.0
 #define MIN_INT32 -2147483648.0
 
+#define MATH_FUNC_UNOP_MAGIC "Pillow Math unary func"
+#define MATH_FUNC_BINOP_MAGIC "Pillow Math binary func"
+
 #define UNOP(name, op, type)                   \
     void name(Imaging out, Imaging im1) {      \
         int x, y;                              \
@@ -168,15 +171,24 @@ _unop(PyObject *self, PyObject *args) {
     Imaging im1;
     void (*unop)(Imaging, Imaging);
 
-    Py_ssize_t op, i0, i1;
+    PyObject *op, *i0, *i1;
-    if (!PyArg_ParseTuple(args, "nnn", &op, &i0, &i1)) {
+    if (!PyArg_ParseTuple(args, "OOO", &op, &i0, &i1)) {
         return NULL;
     }
 
-    out = (Imaging)i0;
+    if (!PyCapsule_IsValid(op, MATH_FUNC_UNOP_MAGIC)) {
-    im1 = (Imaging)i1;
+        PyErr_Format(PyExc_TypeError, "Expected '%s' Capsule", MATH_FUNC_UNOP_MAGIC);
+        return NULL;
+    }
+    if (!PyCapsule_IsValid(i0, IMAGING_MAGIC) ||
+        !PyCapsule_IsValid(i1, IMAGING_MAGIC)) {
+        PyErr_Format(PyExc_TypeError, "Expected '%s' Capsule", IMAGING_MAGIC);
+        return NULL;
+    }
 
-    unop = (void *)op;
+    unop = (void *)PyCapsule_GetPointer(op, MATH_FUNC_UNOP_MAGIC);
+    out = (Imaging)PyCapsule_GetPointer(i0, IMAGING_MAGIC);
+    im1 = (Imaging)PyCapsule_GetPointer(i1, IMAGING_MAGIC);
 
     unop(out, im1);
 
@@ -191,16 +203,26 @@ _binop(PyObject *self, PyObject *args) {
     Imaging im2;
     void (*binop)(Imaging, Imaging, Imaging);
 
-    Py_ssize_t op, i0, i1, i2;
+    PyObject *op, *i0, *i1, *i2;
-    if (!PyArg_ParseTuple(args, "nnnn", &op, &i0, &i1, &i2)) {
+    if (!PyArg_ParseTuple(args, "OOOO", &op, &i0, &i1, &i2)) {
         return NULL;
     }
 
-    out = (Imaging)i0;
+    if (!PyCapsule_IsValid(op, MATH_FUNC_BINOP_MAGIC)) {
-    im1 = (Imaging)i1;
+        PyErr_Format(PyExc_TypeError, "Expected '%s' Capsule", MATH_FUNC_BINOP_MAGIC);
-    im2 = (Imaging)i2;
+        return NULL;
+    }
+    if (!PyCapsule_IsValid(i0, IMAGING_MAGIC) ||
+        !PyCapsule_IsValid(i1, IMAGING_MAGIC) ||
+        !PyCapsule_IsValid(i2, IMAGING_MAGIC)) {
+        PyErr_Format(PyExc_TypeError, "Expected '%s' Capsule", IMAGING_MAGIC);
+        return NULL;
+    }
 
-    binop = (void *)op;
+    binop = (void *)PyCapsule_GetPointer(op, MATH_FUNC_BINOP_MAGIC);
+    out = (Imaging)PyCapsule_GetPointer(i0, IMAGING_MAGIC);
+    im1 = (Imaging)PyCapsule_GetPointer(i1, IMAGING_MAGIC);
+    im2 = (Imaging)PyCapsule_GetPointer(i2, IMAGING_MAGIC);
 
     binop(out, im1, im2);
 
@@ -213,8 +235,17 @@ static PyMethodDef _functions[] = {
 };
 
 static void
-install(PyObject *d, char *name, void *value) {
+install_unary(PyObject *d, char *name, void *func) {
-    PyObject *v = PyLong_FromSsize_t((Py_ssize_t)value);
+    PyObject *v = PyCapsule_New(func, MATH_FUNC_UNOP_MAGIC, NULL);
+    if (!v || PyDict_SetItemString(d, name, v)) {
+        PyErr_Clear();
+    }
+    Py_XDECREF(v);
+}
+
+static void
+install_binary(PyObject *d, char *name, void *func) {
+    PyObject *v = PyCapsule_New(func, MATH_FUNC_BINOP_MAGIC, NULL);
     if (!v || PyDict_SetItemString(d, name, v)) {
         PyErr_Clear();
     }
@@ -225,50 +256,50 @@ static int
 setup_module(PyObject *m) {
     PyObject *d = PyModule_GetDict(m);
 
-    install(d, "abs_I", abs_I);
+    install_unary(d, "abs_I", abs_I);
-    install(d, "neg_I", neg_I);
+    install_unary(d, "neg_I", neg_I);
-    install(d, "add_I", add_I);
+    install_binary(d, "add_I", add_I);
-    install(d, "sub_I", sub_I);
+    install_binary(d, "sub_I", sub_I);
-    install(d, "diff_I", diff_I);
+    install_binary(d, "diff_I", diff_I);
-    install(d, "mul_I", mul_I);
+    install_binary(d, "mul_I", mul_I);
-    install(d, "div_I", div_I);
+    install_binary(d, "div_I", div_I);
-    install(d, "mod_I", mod_I);
+    install_binary(d, "mod_I", mod_I);
-    install(d, "min_I", min_I);
+    install_binary(d, "min_I", min_I);
-    install(d, "max_I", max_I);
+    install_binary(d, "max_I", max_I);
-    install(d, "pow_I", pow_I);
+    install_binary(d, "pow_I", pow_I);
 
-    install(d, "invert_I", invert_I);
+    install_unary(d, "invert_I", invert_I);
-    install(d, "and_I", and_I);
+    install_binary(d, "and_I", and_I);
-    install(d, "or_I", or_I);
+    install_binary(d, "or_I", or_I);
-    install(d, "xor_I", xor_I);
+    install_binary(d, "xor_I", xor_I);
-    install(d, "lshift_I", lshift_I);
+    install_binary(d, "lshift_I", lshift_I);
-    install(d, "rshift_I", rshift_I);
+    install_binary(d, "rshift_I", rshift_I);
 
-    install(d, "eq_I", eq_I);
+    install_binary(d, "eq_I", eq_I);
-    install(d, "ne_I", ne_I);
+    install_binary(d, "ne_I", ne_I);
-    install(d, "lt_I", lt_I);
+    install_binary(d, "lt_I", lt_I);
-    install(d, "le_I", le_I);
+    install_binary(d, "le_I", le_I);
-    install(d, "gt_I", gt_I);
+    install_binary(d, "gt_I", gt_I);
-    install(d, "ge_I", ge_I);
+    install_binary(d, "ge_I", ge_I);
 
-    install(d, "abs_F", abs_F);
+    install_unary(d, "abs_F", abs_F);
-    install(d, "neg_F", neg_F);
+    install_unary(d, "neg_F", neg_F);
-    install(d, "add_F", add_F);
+    install_binary(d, "add_F", add_F);
-    install(d, "sub_F", sub_F);
+    install_binary(d, "sub_F", sub_F);
-    install(d, "diff_F", diff_F);
+    install_binary(d, "diff_F", diff_F);
-    install(d, "mul_F", mul_F);
+    install_binary(d, "mul_F", mul_F);
-    install(d, "div_F", div_F);
+    install_binary(d, "div_F", div_F);
-    install(d, "mod_F", mod_F);
+    install_binary(d, "mod_F", mod_F);
-    install(d, "min_F", min_F);
+    install_binary(d, "min_F", min_F);
-    install(d, "max_F", max_F);
+    install_binary(d, "max_F", max_F);
-    install(d, "pow_F", pow_F);
+    install_binary(d, "pow_F", pow_F);
 
-    install(d, "eq_F", eq_F);
+    install_binary(d, "eq_F", eq_F);
-    install(d, "ne_F", ne_F);
+    install_binary(d, "ne_F", ne_F);
-    install(d, "lt_F", lt_F);
+    install_binary(d, "lt_F", lt_F);
-    install(d, "le_F", le_F);
+    install_binary(d, "le_F", le_F);
-    install(d, "gt_F", gt_F);
+    install_binary(d, "gt_F", gt_F);
-    install(d, "ge_F", ge_F);
+    install_binary(d, "ge_F", ge_F);
 
     return 0;
 }

src/_imagingmorph.c

@@ -11,7 +11,6 @@
  * See the README file for information on usage and redistribution.
  */
 
-#include "Python.h"
 #include "libImaging/Imaging.h"
 
 #define LUT_SIZE (1 << 9)
@@ -30,43 +29,36 @@
 static PyObject *
 apply(PyObject *self, PyObject *args) {
     const char *lut;
-    PyObject *py_lut;
+    Py_ssize_t lut_len;
-    Py_ssize_t lut_len, i0, i1;
+    PyObject *i0, *i1;
     Imaging imgin, imgout;
     int width, height;
     int row_idx, col_idx;
     UINT8 **inrows, **outrows;
     int num_changed_pixels = 0;
 
-    if (!PyArg_ParseTuple(args, "Onn", &py_lut, &i0, &i1)) {
+    if (!PyArg_ParseTuple(args, "s#OO", &lut, &lut_len, &i0, &i1)) {
-        PyErr_SetString(PyExc_RuntimeError, "Argument parsing problem");
         return NULL;
     }
 
-    if (!PyBytes_Check(py_lut)) {
-        PyErr_SetString(PyExc_RuntimeError, "The morphology LUT is not a bytes object");
-        return NULL;
-    }
-
-    lut_len = PyBytes_Size(py_lut);
-
     if (lut_len < LUT_SIZE) {
         PyErr_SetString(PyExc_RuntimeError, "The morphology LUT has the wrong size");
         return NULL;
     }
 
-    lut = PyBytes_AsString(py_lut);
+    if (!PyCapsule_IsValid(i0, IMAGING_MAGIC) ||
+        !PyCapsule_IsValid(i1, IMAGING_MAGIC)) {
+        PyErr_Format(PyExc_TypeError, "Expected '%s' Capsule", IMAGING_MAGIC);
+        return NULL;
+    }
 
-    imgin = (Imaging)i0;
+    imgin = (Imaging)PyCapsule_GetPointer(i0, IMAGING_MAGIC);
-    imgout = (Imaging)i1;
+    imgout = (Imaging)PyCapsule_GetPointer(i1, IMAGING_MAGIC);
     width = imgin->xsize;
     height = imgin->ysize;
 
-    if (imgin->type != IMAGING_TYPE_UINT8 || imgin->bands != 1) {
+    if (imgin->type != IMAGING_TYPE_UINT8 || imgin->bands != 1 ||
-        PyErr_SetString(PyExc_RuntimeError, "Unsupported image type");
+        imgout->type != IMAGING_TYPE_UINT8 || imgout->bands != 1) {
-        return NULL;
-    }
-    if (imgout->type != IMAGING_TYPE_UINT8 || imgout->bands != 1) {
         PyErr_SetString(PyExc_RuntimeError, "Unsupported image type");
         return NULL;
     }
@@ -129,46 +121,39 @@ apply(PyObject *self, PyObject *args) {
 static PyObject *
 match(PyObject *self, PyObject *args) {
     const char *lut;
-    PyObject *py_lut;
+    Py_ssize_t lut_len;
-    Py_ssize_t lut_len, i0;
+    PyObject *i0;
     Imaging imgin;
     int width, height;
     int row_idx, col_idx;
     UINT8 **inrows;
-    PyObject *ret = PyList_New(0);
+
-    if (ret == NULL) {
+    if (!PyArg_ParseTuple(args, "s#O", &lut, &lut_len, &i0)) {
         return NULL;
     }
 
-    if (!PyArg_ParseTuple(args, "On", &py_lut, &i0)) {
-        Py_DECREF(ret);
-        PyErr_SetString(PyExc_RuntimeError, "Argument parsing problem");
-        return NULL;
-    }
-
-    if (!PyBytes_Check(py_lut)) {
-        Py_DECREF(ret);
-        PyErr_SetString(PyExc_RuntimeError, "The morphology LUT is not a bytes object");
-        return NULL;
-    }
-
-    lut_len = PyBytes_Size(py_lut);
-
     if (lut_len < LUT_SIZE) {
-        Py_DECREF(ret);
         PyErr_SetString(PyExc_RuntimeError, "The morphology LUT has the wrong size");
         return NULL;
     }
 
-    lut = PyBytes_AsString(py_lut);
+    if (!PyCapsule_IsValid(i0, IMAGING_MAGIC)) {
-    imgin = (Imaging)i0;
+        PyErr_Format(PyExc_TypeError, "Expected '%s' Capsule", IMAGING_MAGIC);
+        return NULL;
+    }
+
+    imgin = (Imaging)PyCapsule_GetPointer(i0, IMAGING_MAGIC);
 
     if (imgin->type != IMAGING_TYPE_UINT8 || imgin->bands != 1) {
-        Py_DECREF(ret);
         PyErr_SetString(PyExc_RuntimeError, "Unsupported image type");
         return NULL;
     }
 
+    PyObject *ret = PyList_New(0);
+    if (ret == NULL) {
+        return NULL;
+    }
+
     inrows = imgin->image8;
     width = imgin->xsize;
     height = imgin->ysize;
@@ -215,26 +200,31 @@ match(PyObject *self, PyObject *args) {
 */
 static PyObject *
 get_on_pixels(PyObject *self, PyObject *args) {
-    Py_ssize_t i0;
+    PyObject *i0;
     Imaging img;
     UINT8 **rows;
     int row_idx, col_idx;
     int width, height;
+
+    if (!PyArg_ParseTuple(args, "O", &i0)) {
+        return NULL;
+    }
+
+    if (!PyCapsule_IsValid(i0, IMAGING_MAGIC)) {
+        PyErr_Format(PyExc_TypeError, "Expected '%s' Capsule", IMAGING_MAGIC);
+        return NULL;
+    }
+
+    img = (Imaging)PyCapsule_GetPointer(i0, IMAGING_MAGIC);
+    rows = img->image8;
+    width = img->xsize;
+    height = img->ysize;
+
     PyObject *ret = PyList_New(0);
     if (ret == NULL) {
         return NULL;
     }
 
-    if (!PyArg_ParseTuple(args, "n", &i0)) {
-        Py_DECREF(ret);
-        PyErr_SetString(PyExc_RuntimeError, "Argument parsing problem");
-        return NULL;
-    }
-    img = (Imaging)i0;
-    rows = img->image8;
-    width = img->xsize;
-    height = img->ysize;
-
     for (row_idx = 0; row_idx < height; row_idx++) {
         UINT8 *row = rows[row_idx];
         for (col_idx = 0; col_idx < width; col_idx++) {

src/libImaging/Filter.c

@@ -26,6 +26,8 @@
 
 #include "Imaging.h"
 
+#define ROUND_UP(f) ((int)((f) >= 0.0 ? (f) + 0.5F : (f) - 0.5F))
+
 static inline UINT8
 clip8(float in) {
     if (in <= 0.0) {
@@ -105,6 +107,22 @@ ImagingExpand(Imaging imIn, int xmargin, int ymargin) {
     return imOut;
 }
 
+float
+kernel_i16(int size, UINT8 *in0, int x, const float *kernel, int bigendian) {
+    int i;
+    float result = 0;
+    int half_size = (size - 1) / 2;
+    for (i = 0; i < size; i++) {
+        int x1 = x + i - half_size;
+        result += _i2f(
+                      in0[x1 * 2 + (bigendian ? 1 : 0)] +
+                      (in0[x1 * 2 + (bigendian ? 0 : 1)] >> 8)
+                  ) *
+                  kernel[i];
+    }
+    return result;
+}
+
 void
 ImagingFilter3x3(Imaging imOut, Imaging im, const float *kernel, float offset) {
 #define KERNEL1x3(in0, x, kernel, d)                               \
@@ -135,6 +153,16 @@ ImagingFilter3x3(Imaging imOut, Imaging im, const float *kernel, float offset) {
                 out[x] = in0[x];
             }
         } else {
+            int bigendian = 0;
+            if (im->type == IMAGING_TYPE_SPECIAL) {
+                if (strcmp(im->mode, "I;16B") == 0
+#ifdef WORDS_BIGENDIAN
+                    || strcmp(im->mode, "I;16N") == 0
+#endif
+                ) {
+                    bigendian = 1;
+                }
+            }
             for (y = 1; y < im->ysize - 1; y++) {
                 UINT8 *in_1 = (UINT8 *)im->image[y - 1];
                 UINT8 *in0 = (UINT8 *)im->image[y];
@@ -142,14 +170,31 @@ ImagingFilter3x3(Imaging imOut, Imaging im, const float *kernel, float offset) {
                 UINT8 *out = (UINT8 *)imOut->image[y];
 
                 out[0] = in0[0];
+                if (im->type == IMAGING_TYPE_SPECIAL) {
+                    out[1] = in0[1];
+                }
                 for (x = 1; x < im->xsize - 1; x++) {
                     float ss = offset;
-                    ss += KERNEL1x3(in1, x, &kernel[0], 1);
+                    if (im->type == IMAGING_TYPE_SPECIAL) {
-                    ss += KERNEL1x3(in0, x, &kernel[3], 1);
+                        ss += kernel_i16(3, in1, x, &kernel[0], bigendian);
-                    ss += KERNEL1x3(in_1, x, &kernel[6], 1);
+                        ss += kernel_i16(3, in0, x, &kernel[3], bigendian);
-                    out[x] = clip8(ss);
+                        ss += kernel_i16(3, in_1, x, &kernel[6], bigendian);
+                        int ss_int = ROUND_UP(ss);
+                        out[x * 2 + (bigendian ? 1 : 0)] = clip8(ss_int % 256);
+                        out[x * 2 + (bigendian ? 0 : 1)] = clip8(ss_int >> 8);
+                    } else {
+                        ss += KERNEL1x3(in1, x, &kernel[0], 1);
+                        ss += KERNEL1x3(in0, x, &kernel[3], 1);
+                        ss += KERNEL1x3(in_1, x, &kernel[6], 1);
+                        out[x] = clip8(ss);
+                    }
+                }
+                if (im->type == IMAGING_TYPE_SPECIAL) {
+                    out[x * 2] = in0[x * 2];
+                    out[x * 2 + 1] = in0[x * 2 + 1];
+                } else {
+                    out[x] = in0[x];
                 }
-                out[x] = in0[x];
             }
         }
     } else {
@@ -261,6 +306,16 @@ ImagingFilter5x5(Imaging imOut, Imaging im, const float *kernel, float offset) {
                 out[x + 1] = in0[x + 1];
             }
         } else {
+            int bigendian = 0;
+            if (im->type == IMAGING_TYPE_SPECIAL) {
+                if (strcmp(im->mode, "I;16B") == 0
+#ifdef WORDS_BIGENDIAN
+                    || strcmp(im->mode, "I;16N") == 0
+#endif
+                ) {
+                    bigendian = 1;
+                }
+            }
             for (y = 2; y < im->ysize - 2; y++) {
                 UINT8 *in_2 = (UINT8 *)im->image[y - 2];
                 UINT8 *in_1 = (UINT8 *)im->image[y - 1];
@@ -271,17 +326,39 @@ ImagingFilter5x5(Imaging imOut, Imaging im, const float *kernel, float offset) {
 
                 out[0] = in0[0];
                 out[1] = in0[1];
+                if (im->type == IMAGING_TYPE_SPECIAL) {
+                    out[2] = in0[2];
+                    out[3] = in0[3];
+                }
                 for (x = 2; x < im->xsize - 2; x++) {
                     float ss = offset;
-                    ss += KERNEL1x5(in2, x, &kernel[0], 1);
+                    if (im->type == IMAGING_TYPE_SPECIAL) {
-                    ss += KERNEL1x5(in1, x, &kernel[5], 1);
+                        ss += kernel_i16(5, in2, x, &kernel[0], bigendian);
-                    ss += KERNEL1x5(in0, x, &kernel[10], 1);
+                        ss += kernel_i16(5, in1, x, &kernel[5], bigendian);
-                    ss += KERNEL1x5(in_1, x, &kernel[15], 1);
+                        ss += kernel_i16(5, in0, x, &kernel[10], bigendian);
-                    ss += KERNEL1x5(in_2, x, &kernel[20], 1);
+                        ss += kernel_i16(5, in_1, x, &kernel[15], bigendian);
-                    out[x] = clip8(ss);
+                        ss += kernel_i16(5, in_2, x, &kernel[20], bigendian);
+                        int ss_int = ROUND_UP(ss);
+                        out[x * 2 + (bigendian ? 1 : 0)] = clip8(ss_int % 256);
+                        out[x * 2 + (bigendian ? 0 : 1)] = clip8(ss_int >> 8);
+                    } else {
+                        ss += KERNEL1x5(in2, x, &kernel[0], 1);
+                        ss += KERNEL1x5(in1, x, &kernel[5], 1);
+                        ss += KERNEL1x5(in0, x, &kernel[10], 1);
+                        ss += KERNEL1x5(in_1, x, &kernel[15], 1);
+                        ss += KERNEL1x5(in_2, x, &kernel[20], 1);
+                        out[x] = clip8(ss);
+                    }
+                }
+                if (im->type == IMAGING_TYPE_SPECIAL) {
+                    out[x * 2 + 0] = in0[x * 2 + 0];
+                    out[x * 2 + 1] = in0[x * 2 + 1];
+                    out[x * 2 + 2] = in0[x * 2 + 2];
+                    out[x * 2 + 3] = in0[x * 2 + 3];
+                } else {
+                    out[x + 0] = in0[x + 0];
+                    out[x + 1] = in0[x + 1];
                 }
-                out[x + 0] = in0[x + 0];
-                out[x + 1] = in0[x + 1];
             }
         }
     } else {
@@ -383,7 +460,8 @@ ImagingFilter(Imaging im, int xsize, int ysize, const FLOAT32 *kernel, FLOAT32 o
     Imaging imOut;
     ImagingSectionCookie cookie;
 
-    if (im->type != IMAGING_TYPE_UINT8 && im->type != IMAGING_TYPE_INT32) {
+    if (im->type == IMAGING_TYPE_FLOAT32 ||
+        (im->type == IMAGING_TYPE_SPECIAL && im->bands != 1)) {
         return (Imaging)ImagingError_ModeError();
     }
 

src/libImaging/FliDecode.c

@@ -224,7 +224,7 @@ ImagingFliDecode(Imaging im, ImagingCodecState state, UINT8 *buf, Py_ssize_t byt
                 break;
             case 16:
                 /* COPY chunk */
-                if (INT32_MAX / state->xsize < state->ysize) {
+                if (INT32_MAX < (uint64_t)state->xsize * state->ysize) {
                     /* Integer overflow, bail */
                     state->errcode = IMAGING_CODEC_OVERRUN;
                     return -1;

src/libImaging/Geometry.c

@@ -791,15 +791,15 @@ ImagingGenericTransform(
     char *out;
     double xx, yy;
 
+    if (!imOut || !imIn || strcmp(imIn->mode, imOut->mode) != 0) {
+        return (Imaging)ImagingError_ModeError();
+    }
+
     ImagingTransformFilter filter = getfilter(imIn, filterid);
     if (!filter) {
         return (Imaging)ImagingError_ValueError("bad filter number");
     }
 
-    if (!imOut || !imIn || strcmp(imIn->mode, imOut->mode) != 0) {
-        return (Imaging)ImagingError_ModeError();
-    }
-
     ImagingCopyPalette(imOut, imIn);
 
     ImagingSectionEnter(&cookie);

src/libImaging/ImPlatform.h

@@ -7,6 +7,7 @@
  * Copyright (c) Fredrik Lundh 1995-2003.
  */
 
+#define PY_SSIZE_T_CLEAN
 #include "Python.h"
 
 /* Check that we have an ANSI compliant compiler */

src/libImaging/Imaging.h

@@ -60,8 +60,8 @@ typedef struct ImagingHistogramInstance *ImagingHistogram;
 typedef struct ImagingOutlineInstance *ImagingOutline;
 typedef struct ImagingPaletteInstance *ImagingPalette;
 
-/* handle magics (used with PyCObject). */
+/* handle magics (used with PyCapsule). */
-#define IMAGING_MAGIC "PIL Imaging"
+#define IMAGING_MAGIC "Pillow Imaging"
 
 /* pixel types */
 #define IMAGING_TYPE_UINT8 0

src/libImaging/QuantOctree.c

@@ -188,7 +188,7 @@ create_sorted_color_palette(const ColorCube cube) {
         buckets,
         cube->size,
         sizeof(struct _ColorBucket),
-        (int (*)(void const *, void const *)) & compare_bucket_count
+        (int (*)(void const *, void const *))&compare_bucket_count
     );
 
     return buckets;

src/libImaging/Resample.c

@@ -460,6 +460,83 @@ ImagingResampleVertical_8bpc(
     ImagingSectionLeave(&cookie);
 }
 
+void
+ImagingResampleHorizontal_16bpc(
+    Imaging imOut, Imaging imIn, int offset, int ksize, int *bounds, double *kk
+) {
+    ImagingSectionCookie cookie;
+    double ss;
+    int xx, yy, x, xmin, xmax, ss_int;
+    double *k;
+
+    int bigendian = 0;
+    if (strcmp(imIn->mode, "I;16N") == 0
+#ifdef WORDS_BIGENDIAN
+        || strcmp(imIn->mode, "I;16B") == 0
+#endif
+    ) {
+        bigendian = 1;
+    }
+
+    ImagingSectionEnter(&cookie);
+    for (yy = 0; yy < imOut->ysize; yy++) {
+        for (xx = 0; xx < imOut->xsize; xx++) {
+            xmin = bounds[xx * 2 + 0];
+            xmax = bounds[xx * 2 + 1];
+            k = &kk[xx * ksize];
+            ss = 0.0;
+            for (x = 0; x < xmax; x++) {
+                ss += (imIn->image8[yy + offset][(x + xmin) * 2 + (bigendian ? 1 : 0)] +
+                       (imIn->image8[yy + offset][(x + xmin) * 2 + (bigendian ? 0 : 1)]
+                        << 8)) *
+                      k[x];
+            }
+            ss_int = ROUND_UP(ss);
+            imOut->image8[yy][xx * 2 + (bigendian ? 1 : 0)] = CLIP8(ss_int % 256);
+            imOut->image8[yy][xx * 2 + (bigendian ? 0 : 1)] = CLIP8(ss_int >> 8);
+        }
+    }
+    ImagingSectionLeave(&cookie);
+}
+
+void
+ImagingResampleVertical_16bpc(
+    Imaging imOut, Imaging imIn, int offset, int ksize, int *bounds, double *kk
+) {
+    ImagingSectionCookie cookie;
+    double ss;
+    int xx, yy, y, ymin, ymax, ss_int;
+    double *k;
+
+    int bigendian = 0;
+    if (strcmp(imIn->mode, "I;16N") == 0
+#ifdef WORDS_BIGENDIAN
+        || strcmp(imIn->mode, "I;16B") == 0
+#endif
+    ) {
+        bigendian = 1;
+    }
+
+    ImagingSectionEnter(&cookie);
+    for (yy = 0; yy < imOut->ysize; yy++) {
+        ymin = bounds[yy * 2 + 0];
+        ymax = bounds[yy * 2 + 1];
+        k = &kk[yy * ksize];
+        for (xx = 0; xx < imOut->xsize; xx++) {
+            ss = 0.0;
+            for (y = 0; y < ymax; y++) {
+                ss += (imIn->image8[y + ymin][xx * 2 + (bigendian ? 1 : 0)] +
+                       (imIn->image8[y + ymin][xx * 2 + (bigendian ? 0 : 1)] << 8)) *
+                      k[y];
+            }
+            ss_int = ROUND_UP(ss);
+            imOut->image8[yy][xx * 2 + (bigendian ? 1 : 0)] = CLIP8(ss_int % 256);
+            imOut->image8[yy][xx * 2 + (bigendian ? 0 : 1)] = CLIP8(ss_int >> 8);
+        }
+    }
+    ImagingSectionLeave(&cookie);
+}
+
 void
 ImagingResampleHorizontal_32bpc(
     Imaging imOut, Imaging imIn, int offset, int ksize, int *bounds, double *kk
@@ -574,7 +651,12 @@ ImagingResample(Imaging imIn, int xsize, int ysize, int filter, float box[4]) {
     }
 
     if (imIn->type == IMAGING_TYPE_SPECIAL) {
-        return (Imaging)ImagingError_ModeError();
+        if (strncmp(imIn->mode, "I;16", 4) == 0) {
+            ResampleHorizontal = ImagingResampleHorizontal_16bpc;
+            ResampleVertical = ImagingResampleVertical_16bpc;
+        } else {
+            return (Imaging)ImagingError_ModeError();
+        }
     } else if (imIn->image8) {
         ResampleHorizontal = ImagingResampleHorizontal_8bpc;
         ResampleVertical = ImagingResampleVertical_8bpc;

src/libImaging/SgiRleDecode.c

@@ -183,7 +183,7 @@ ImagingSgiRleDecode(Imaging im, ImagingCodecState state, UINT8 *buf, Py_ssize_t
        each with 4 bytes per element of tablen
        Check here before we allocate any memory
     */
-    if (c->bufsize < 8 * c->tablen) {
+    if (c->bufsize < 8 * (int64_t)c->tablen) {
         state->errcode = IMAGING_CODEC_OVERRUN;
         return -1;
     }
@@ -195,6 +195,7 @@ ImagingSgiRleDecode(Imaging im, ImagingCodecState state, UINT8 *buf, Py_ssize_t
     }
     _imaging_seek_pyFd(state->fd, SGI_HEADER_SIZE, SEEK_SET);
     if (_imaging_read_pyFd(state->fd, (char *)ptr, c->bufsize) != c->bufsize) {
+        free(ptr);
         state->errcode = IMAGING_CODEC_UNKNOWN;
         return -1;
     }

src/libImaging/TiffDecode.c

@@ -780,7 +780,7 @@ ImagingLibTiffDecode(
 decode_err:
     // TIFFClose in libtiff calls tif_closeproc and TIFFCleanup
     if (clientstate->fp) {
-        // Pillow will manage the closing of the file rather than libtiff
+        // Python will manage the closing of the file rather than libtiff
         // So only call TIFFCleanup
         TIFFCleanup(tiff);
     } else {
@@ -1008,7 +1008,17 @@ ImagingLibTiffEncode(Imaging im, ImagingCodecState state, UINT8 *buffer, int byt
                 ) == -1) {
                 TRACE(("Encode Error, row %d\n", state->y));
                 state->errcode = IMAGING_CODEC_BROKEN;
-                TIFFClose(tiff);
+
+                // TIFFClose in libtiff calls tif_closeproc and TIFFCleanup
+                if (clientstate->fp) {
+                    // Python will manage the closing of the file rather than libtiff
+                    // So only call TIFFCleanup
+                    TIFFCleanup(tiff);
+                } else {
+                    // When tif_closeproc refers to our custom _tiffCloseProc though,
+                    // that is fine, as it does not close the file
+                    TIFFClose(tiff);
+                }
                 if (!clientstate->fp) {
                     free(clientstate->data);
                 }
@@ -1025,14 +1035,22 @@ ImagingLibTiffEncode(Imaging im, ImagingCodecState state, UINT8 *buffer, int byt
                 TRACE(("Error flushing the tiff"));
                 // likely reason is memory.
                 state->errcode = IMAGING_CODEC_MEMORY;
-                TIFFClose(tiff);
+                if (clientstate->fp) {
+                    TIFFCleanup(tiff);
+                } else {
+                    TIFFClose(tiff);
+                }
                 if (!clientstate->fp) {
                     free(clientstate->data);
                 }
                 return -1;
             }
             TRACE(("Closing \n"));
-            TIFFClose(tiff);
+            if (clientstate->fp) {
+                TIFFCleanup(tiff);
+            } else {
+                TIFFClose(tiff);
+            }
             // reset the clientstate metadata to use it to read out the buffer.
             clientstate->loc = 0;
             clientstate->size = clientstate->eof;  // redundant?

src/path.c

@@ -44,6 +44,7 @@ PyImaging_GetBuffer(PyObject *buffer, Py_buffer *view);
 typedef struct {
     PyObject_HEAD Py_ssize_t count;
     double *xy;
+    int mapping;
 } PyPathObject;
 
 static PyTypeObject PyPathType;
@@ -91,6 +92,7 @@ path_new(Py_ssize_t count, double *xy, int duplicate) {
 
     path->count = count;
     path->xy = xy;
+    path->mapping = 0;
 
     return path;
 }
@@ -276,6 +278,10 @@ path_compact(PyPathObject *self, PyObject *args) {
 
     double cityblock = 2.0;
 
+    if (self->mapping) {
+        PyErr_SetString(PyExc_ValueError, "Path compacted during mapping");
+        return NULL;
+    }
     if (!PyArg_ParseTuple(args, "|d:compact", &cityblock)) {
         return NULL;
     }
@@ -393,11 +399,13 @@ path_map(PyPathObject *self, PyObject *args) {
     xy = self->xy;
 
     /* apply function to coordinate set */
+    self->mapping = 1;
     for (i = 0; i < self->count; i++) {
         double x = xy[i + i];
         double y = xy[i + i + 1];
         PyObject *item = PyObject_CallFunction(function, "dd", x, y);
         if (!item || !PyArg_ParseTuple(item, "dd", &x, &y)) {
+            self->mapping = 0;
             Py_XDECREF(item);
             return NULL;
         }
@@ -405,6 +413,7 @@ path_map(PyPathObject *self, PyObject *args) {
         xy[i + i + 1] = y;
         Py_DECREF(item);
     }
+    self->mapping = 0;
 
     Py_INCREF(Py_None);
     return Py_None;

winbuild/README.md

@@ -11,7 +11,7 @@ For more extensive info, see the [Windows build instructions](build.rst).
 * Requires Microsoft Visual Studio 2017 or newer with C++ component.
 * Requires NASM for libjpeg-turbo, a required dependency when using this script.
 * Requires CMake 3.15 or newer (available as Visual Studio component).
-* Tested on Windows Server 2016 with Visual Studio 2017 Community, and Windows Server 2019 with Visual Studio 2022 Community (AppVeyor).
+* Tested on Windows Server 2019 with Visual Studio 2019 Community and Visual Studio 2022 Community (AppVeyor).
 * Tested on Windows Server 2022 with Visual Studio 2022 Enterprise (GitHub Actions).
 
 The following is a simplified version of the script used on AppVeyor:

winbuild/build_prepare.py

@@ -119,7 +119,7 @@ V = {
     "LIBWEBP": "1.4.0",
     "OPENJPEG": "2.5.2",
     "TIFF": "4.6.0",
-    "XZ": "5.6.2",
+    "XZ": "5.6.3",
     "ZLIB": "1.3.1",
 }
 V["LIBPNG_DOTLESS"] = V["LIBPNG"].replace(".", "")
@@ -185,7 +185,7 @@ DEPS: dict[str, dict[str, Any]] = {
             cmd_copy(r"src\liblzma\api\lzma\*.h", r"{inc_dir}\lzma"),
         ],
         "headers": [r"src\liblzma\api\lzma.h"],
-        "libs": [r"liblzma.lib"],
+        "libs": [r"lzma.lib"],
     },
     "libwebp": {
         "url": f"http://downloads.webmproject.org/releases/webp/libwebp-{V['LIBWEBP']}.tar.gz",
@@ -216,8 +216,8 @@ DEPS: dict[str, dict[str, Any]] = {
         "license": "LICENSE.md",
         "patch": {
             r"libtiff\tif_lzma.c": {
-                # link against liblzma.lib
+                # link against lzma.lib
-                "#ifdef LZMA_SUPPORT": '#ifdef LZMA_SUPPORT\n#pragma comment(lib, "liblzma.lib")',  # noqa: E501
+                "#ifdef LZMA_SUPPORT": '#ifdef LZMA_SUPPORT\n#pragma comment(lib, "lzma.lib")',  # noqa: E501
             },
             r"libtiff\tif_webp.c": {
                 # link against libwebp.lib