File CVE-2024-28219.patch of Package python-Pillow.35230

Overview Repositories Revisions Requests Users Attributes Meta

File CVE-2024-28219.patch of Package python-Pillow.35230

From 2a93aba5cfcf6e241ab4f9392c13e3b74032c061 Mon Sep 17 00:00:00 2001
From: Andrew Murray <radarhere@users.noreply.github.com>
Date: Thu, 22 Feb 2024 18:56:26 +1100
Subject: [PATCH] Use strncpy to avoid buffer overflow

---
 Tests/icc/sGrey-v2-nano.icc | Bin 0 -> 290 bytes
 Tests/test_imagecms.py      |   5 +++++
 src/_imagingcms.c           |   9 ++++-----
 3 files changed, 9 insertions(+), 5 deletions(-)
 create mode 100644 Tests/icc/sGrey-v2-nano.icc

Index: Pillow-7.2.0/src/_imagingcms.c
===================================================================
--- Pillow-7.2.0.orig/src/_imagingcms.c
+++ Pillow-7.2.0/src/_imagingcms.c
@@ -207,8 +207,8 @@ cms_transform_new(cmsHTRANSFORM transfor
 
     self->transform = transform;
 
-    strcpy(self->mode_in, mode_in);
-    strcpy(self->mode_out, mode_out);
+    strncpy(self->mode_in, mode_in, 8);
+    strncpy(self->mode_out, mode_out, 8);
 
     return (PyObject*) self;
 }
@@ -279,10 +279,9 @@ findLCMStype(char* PILmode)
         // LabX equivalent like ALab, but not reversed -- no #define in lcms2
         return (COLORSPACE_SH(PT_LabV2)|CHANNELS_SH(3)|BYTES_SH(1)|EXTRA_SH(1));
     }
-
     else {
-        /* take a wild guess... but you probably should fail instead. */
-        return TYPE_GRAY_8; /* so there's no buffer overrun... */
+        /* take a wild guess... */
+        return TYPE_GRAY_8;
     }
 }
 
Index: Pillow-7.2.0/Tests/test_imagecms.py
===================================================================
--- Pillow-7.2.0.orig/Tests/test_imagecms.py
+++ Pillow-7.2.0/Tests/test_imagecms.py
@@ -606,3 +606,8 @@ def test_auxiliary_channels_isolated():
                 )
 
                 assert_image_equal(test_image.convert(dst_format[2]), reference_image)
+
+
+def test_long_modes():
+    p = ImageCms.getOpenProfile("Tests/icc/sGrey-v2-nano.icc")
+    ImageCms.buildTransform(p, p, "ABCDEFGHI", "ABCDEFGHI")

Places

File CVE-2024-28219.patch of Package python-Pillow.35230

Places