Skip to content

Commit

Permalink
Limit size even if one dimension is zero
Browse files Browse the repository at this point in the history
  • Loading branch information
radarhere committed Jun 28, 2023
1 parent 4834f80 commit 8437d98
Show file tree
Hide file tree
Showing 4 changed files with 11 additions and 2 deletions.
Binary file added Tests/images/zero_width.gif
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.
9 changes: 9 additions & 0 deletions Tests/test_decompression_bomb.py
Original file line number Diff line number Diff line change
Expand Up @@ -64,6 +64,15 @@ def test_exception_gif_extents(self):
with pytest.raises(Image.DecompressionBombError):
im.seek(1)

def test_exception_gif_zero_width(self):
# Set limit to trigger exception on the test file
Image.MAX_IMAGE_PIXELS = 4 * 64 * 128
assert Image.MAX_IMAGE_PIXELS == 4 * 64 * 128

with pytest.raises(Image.DecompressionBombError):
with Image.open("Tests/images/zero_width.gif"):
pass

def test_exception_bmp(self):
with pytest.raises(Image.DecompressionBombError):
with Image.open("Tests/images/bmp/b/reallybig.bmp"):
Expand Down
2 changes: 1 addition & 1 deletion src/PIL/Image.py
Original file line number Diff line number Diff line change
Expand Up @@ -3141,7 +3141,7 @@ def _decompression_bomb_check(size):
if MAX_IMAGE_PIXELS is None:
return

pixels = size[0] * size[1]
pixels = max(1, size[0]) * max(1, size[1])

if pixels > 2 * MAX_IMAGE_PIXELS:
msg = (
Expand Down
2 changes: 1 addition & 1 deletion src/_imagingft.c
Original file line number Diff line number Diff line change
Expand Up @@ -880,7 +880,7 @@ font_render(FontObject *self, PyObject *args) {
width += stroke_width * 2 + ceil(x_start);
height += stroke_width * 2 + ceil(y_start);
if (max_image_pixels != Py_None) {
if ((long long)width * height > PyLong_AsLongLong(max_image_pixels) * 2) {
if ((long long)(width > 1 ? width : 1) * (height > 1 ? height : 1) > PyLong_AsLongLong(max_image_pixels) * 2) {
PyMem_Del(glyph_info);
return Py_BuildValue("O(ii)(ii)", Py_None, width, height, 0, 0);
}
Expand Down

0 comments on commit 8437d98

Please sign in to comment.