Skip to content
This repository

HTTPS clone URL

Subversion checkout URL

You can clone with HTTPS or Subversion.

Download ZIP
Browse code

[1.3.x] Fixed a security issue in image uploading. Disclosure and rel…

…ease forthcoming.

Backport of dd16b17 from master.
  • Loading branch information...
commit 9ca0ff6268eeff92d0d0ac2c315d4b6a8e229155 1 parent 7ca10b1
Florian Apolloner authored July 30, 2012

Showing 1 changed file with 6 additions and 1 deletion. Show diff stats Hide diff stats

  1. 7  django/core/files/images.py
7  django/core/files/images.py
@@ -47,13 +47,18 @@ def get_image_dimensions(file_or_path, close=False):
47 47
         file = open(file_or_path, 'rb')
48 48
         close = True
49 49
     try:
  50
+        # Most of the time PIL only needs a small chunk to parse the image and
  51
+        # get the dimensions, but with some TIFF files PIL needs to parse the
  52
+        # whole file.
  53
+        chunk_size = 1024
50 54
         while 1:
51  
-            data = file.read(1024)
  55
+            data = file.read(chunk_size)
52 56
             if not data:
53 57
                 break
54 58
             p.feed(data)
55 59
             if p.image:
56 60
                 return p.image.size
  61
+            chunk_size = chunk_size*2
57 62
         return None
58 63
     finally:
59 64
         if close:

0 notes on commit 9ca0ff6

Please sign in to comment.
Something went wrong with that request. Please try again.