Sign Up
Log In
Log In
or
Sign Up
Places
All Projects
Status Monitor
Collapse sidebar
systemsmanagement:Ardana:8:CentOS:7.3
python-Pillow
009-Catch-FLI-buffer-overrun.patch
Overview
Repositories
Revisions
Requests
Users
Attributes
Meta
File 009-Catch-FLI-buffer-overrun.patch of Package python-Pillow
From a09acd0decd8a87ccce939d5ff65dab59e7d365b Mon Sep 17 00:00:00 2001 From: Andrew Murray <radarhere@users.noreply.github.com> Date: Wed, 1 Jan 2020 14:14:47 +1100 Subject: [PATCH] Catch FLI buffer overrun --- Tests/test_image.py | 7 +++++++ src/libImaging/FliDecode.c | 7 +++++-- 2 files changed, 12 insertions(+), 2 deletions(-) diff --git a/Tests/test_image.py b/Tests/test_image.py index 47196a1394..cd7621e6b6 100644 --- a/Tests/test_image.py +++ b/Tests/test_image.py @@ -425,6 +425,13 @@ def test_overrun(self): except IOError as e: self.assertEqual(str(e), "buffer overrun when reading image file") + with Image.open("Tests/images/fli_overrun2.bin") as im: + try: + im.seek(1) + self.assertFail() + except IOError as e: + self.assertEqual(str(e), "buffer overrun when reading image file") + class MockEncoder(object): pass diff --git a/libImaging/FliDecode.c b/libImaging/FliDecode.c index 5f4485f890..6f48c07d41 100644 --- a/libImaging/FliDecode.c +++ b/libImaging/FliDecode.c @@ -40,8 +40,7 @@ ImagingFliDecode(Imaging im, ImagingCodecState state, UINT8* buf, Py_ssize_t byt return 0; /* We don't decode anything unless we have a full chunk in the - input buffer (on the other hand, the Python part of the driver - makes sure this is always the case) */ + input buffer */ ptr = buf; @@ -52,6 +51,10 @@ ImagingFliDecode(Imaging im, ImagingCodecState state, UINT8* buf, Py_ssize_t byt /* Make sure this is a frame chunk. The Python driver takes case of other chunk types. */ + if (bytes < 8) { + state->errcode = IMAGING_CODEC_OVERRUN; + return -1; + } if (I16(ptr+4) != 0xF1FA) { state->errcode = IMAGING_CODEC_UNKNOWN; return -1;
Locations
Projects
Search
Status Monitor
Help
OpenBuildService.org
Documentation
API Documentation
Code of Conduct
Contact
Support
@OBShq
Terms
openSUSE Build Service is sponsored by
The Open Build Service is an
openSUSE project
.
Sign Up
Log In
Places
Places
All Projects
Status Monitor