diff --git a/Tests/images/pcx_overrun2.bin b/Tests/images/pcx_overrun2.bin new file mode 100644 index 00000000000..5f00b50595a Binary files /dev/null and b/Tests/images/pcx_overrun2.bin differ diff --git a/Tests/test_image.py b/Tests/test_image.py index cd7621e6b65..33657d56cf0 100644 --- a/Tests/test_image.py +++ b/Tests/test_image.py @@ -590,7 +590,12 @@ def act(fp): self.assertFalse(fp.closed) def test_overrun(self): - for file in ["fli_overrun.bin", "sgi_overrun.bin", "pcx_overrun.bin"]: + for file in [ + "fli_overrun.bin", + "sgi_overrun.bin", + "pcx_overrun.bin", + "pcx_overrun2.bin", + ]: im = Image.open(os.path.join("Tests/images", file)) try: im.load() diff --git a/src/libImaging/PcxDecode.c b/src/libImaging/PcxDecode.c index 67dcc1e0858..9e9504ce5f1 100644 --- a/src/libImaging/PcxDecode.c +++ b/src/libImaging/PcxDecode.c @@ -25,6 +25,9 @@ ImagingPcxDecode(Imaging im, ImagingCodecState state, UINT8* buf, Py_ssize_t byt if (strcmp(im->mode, "1") == 0 && state->xsize > state->bytes * 8) { state->errcode = IMAGING_CODEC_OVERRUN; return -1; + } else if (strcmp(im->mode, "P") == 0 && state->xsize > state->bytes) { + state->errcode = IMAGING_CODEC_OVERRUN; + return -1; } ptr = buf;