File CVE-2022-45198.patch of Package python-Pillow

Overview Repositories Revisions Requests Users Attributes Meta

File CVE-2022-45198.patch of Package python-Pillow

Index: Pillow-7.2.0/Tests/test_decompression_bomb.py
===================================================================
--- Pillow-7.2.0.orig/Tests/test_decompression_bomb.py
+++ Pillow-7.2.0/Tests/test_decompression_bomb.py
@@ -60,6 +60,11 @@ class TestDecompressionBomb:
         with pytest.raises(Image.DecompressionBombError):
             Image.open("Tests/images/decompression_bomb.gif")
 
+    def test_exception_gif_extents(self):
+        with Image.open("Tests/images/decompression_bomb_extents.gif") as im:
+            with pytest.raises(Image.DecompressionBombError):
+                im.seek(1)
+
 
 class TestDecompressionCrop:
     @classmethod
Index: Pillow-7.2.0/src/PIL/GifImagePlugin.py
===================================================================
--- Pillow-7.2.0.orig/src/PIL/GifImagePlugin.py
+++ Pillow-7.2.0/src/PIL/GifImagePlugin.py
@@ -236,6 +236,7 @@ class GifImageFile(ImageFile.ImageFile):
                 x1, y1 = x0 + i16(s[4:]), y0 + i16(s[6:])
                 if x1 > self.size[0] or y1 > self.size[1]:
                     self._size = max(x1, self.size[0]), max(y1, self.size[1])
+                    Image._decompression_bomb_check(self._size)
                 self.dispose_extent = x0, y0, x1, y1
                 flags = i8(s[8])

Places

File CVE-2022-45198.patch of Package python-Pillow

Places