tests for Fli OOB reads

python-pillow · Apr 1, 2020 · 19ff42b · 19ff42b
1 parent 8d4f3c0
commit 19ff42b
Show file tree

Hide file tree

Showing 48 changed files with 71 additions and 0 deletions.
diff --git a/Tests/check_fli_oob.py b/Tests/check_fli_oob.py
@@ -0,0 +1,61 @@
+#!/usr/bin/env python
+
+from PIL import Image
+
+repro_ss2 = ('images/fli_oob/06r/06r00.fli',
+             'images/fli_oob/06r/others/06r01.fli',
+             'images/fli_oob/06r/others/06r02.fli',
+             'images/fli_oob/06r/others/06r03.fli',
+             'images/fli_oob/06r/others/06r04.fli'
+)
+
+repro_lc = ('images/fli_oob/05r/05r00.fli',
+            'images/fli_oob/05r/others/05r03.fli',
+            'images/fli_oob/05r/others/05r06.fli',
+            'images/fli_oob/05r/others/05r05.fli',
+            'images/fli_oob/05r/others/05r01.fli',
+            'images/fli_oob/05r/others/05r04.fli',
+            'images/fli_oob/05r/others/05r02.fli',
+            'images/fli_oob/05r/others/05r07.fli',
+)
+
+
+repro_advance = ('images/fli_oob/03r/03r00.fli',
+                 'images/fli_oob/03r/others/03r01.fli',
+                 'images/fli_oob/03r/others/03r09.fli',
+                 'images/fli_oob/03r/others/03r11.fli',
+                 'images/fli_oob/03r/others/03r05.fli',
+                 'images/fli_oob/03r/others/03r10.fli',
+                 'images/fli_oob/03r/others/03r06.fli',
+                 'images/fli_oob/03r/others/03r08.fli',
+                 'images/fli_oob/03r/others/03r03.fli',
+                 'images/fli_oob/03r/others/03r07.fli',
+                 'images/fli_oob/03r/others/03r02.fli',
+                 'images/fli_oob/03r/others/03r04.fli',
+)
+
+repro_brun = ('images/fli_oob/04r/initial.fli',
+              'images/fli_oob/04r/others/04r02.fli',
+              'images/fli_oob/04r/others/04r05.fli',
+              'images/fli_oob/04r/others/04r04.fli',
+              'images/fli_oob/04r/others/04r03.fli',
+              'images/fli_oob/04r/others/04r01.fli',
+              'images/fli_oob/04r/04r00.fli',
+)
+
+repro_copy = ('images/fli_oob/02r/others/02r02.fli',
+              'images/fli_oob/02r/others/02r04.fli',
+              'images/fli_oob/02r/others/02r03.fli',
+              'images/fli_oob/02r/others/02r01.fli',
+              'images/fli_oob/02r/02r00.fli',
+)
+
+
+for path in repro_ss2 + repro_lc + repro_advance + repro_brun + repro_copy:
+    im = Image.open(path)
+    try:
+        im.load()
+    except Exception as msg:
+        print(msg)
+
+
diff --git a/Tests/images/fli_oob/02r/02r00.fli b/Tests/images/fli_oob/02r/02r00.fli
diff --git a/Tests/images/fli_oob/02r/notes b/Tests/images/fli_oob/02r/notes
@@ -0,0 +1 @@
+Is this because a file-originating field is being interpreted as a *signed* int32, allowing it to provide negative values for 'advance'?
diff --git a/Tests/images/fli_oob/02r/others/02r01.fli b/Tests/images/fli_oob/02r/others/02r01.fli
diff --git a/Tests/images/fli_oob/02r/others/02r02.fli b/Tests/images/fli_oob/02r/others/02r02.fli
diff --git a/Tests/images/fli_oob/02r/others/02r03.fli b/Tests/images/fli_oob/02r/others/02r03.fli
diff --git a/Tests/images/fli_oob/02r/others/02r04.fli b/Tests/images/fli_oob/02r/others/02r04.fli
diff --git a/Tests/images/fli_oob/02r/reproducing b/Tests/images/fli_oob/02r/reproducing
@@ -0,0 +1 @@
+Image.open(...).seek(212)
diff --git a/Tests/images/fli_oob/03r/03r00.fli b/Tests/images/fli_oob/03r/03r00.fli
diff --git a/Tests/images/fli_oob/03r/notes b/Tests/images/fli_oob/03r/notes
@@ -0,0 +1 @@
+ridiculous bytes value passed to ImagingFliDecode
diff --git a/Tests/images/fli_oob/03r/others/03r01.fli b/Tests/images/fli_oob/03r/others/03r01.fli
diff --git a/Tests/images/fli_oob/03r/others/03r02.fli b/Tests/images/fli_oob/03r/others/03r02.fli
diff --git a/Tests/images/fli_oob/03r/others/03r03.fli b/Tests/images/fli_oob/03r/others/03r03.fli
diff --git a/Tests/images/fli_oob/03r/others/03r04.fli b/Tests/images/fli_oob/03r/others/03r04.fli
diff --git a/Tests/images/fli_oob/03r/others/03r05.fli b/Tests/images/fli_oob/03r/others/03r05.fli
diff --git a/Tests/images/fli_oob/03r/others/03r06.fli b/Tests/images/fli_oob/03r/others/03r06.fli
diff --git a/Tests/images/fli_oob/03r/others/03r07.fli b/Tests/images/fli_oob/03r/others/03r07.fli
diff --git a/Tests/images/fli_oob/03r/others/03r08.fli b/Tests/images/fli_oob/03r/others/03r08.fli
diff --git a/Tests/images/fli_oob/03r/others/03r09.fli b/Tests/images/fli_oob/03r/others/03r09.fli
diff --git a/Tests/images/fli_oob/03r/others/03r10.fli b/Tests/images/fli_oob/03r/others/03r10.fli
diff --git a/Tests/images/fli_oob/03r/others/03r11.fli b/Tests/images/fli_oob/03r/others/03r11.fli
diff --git a/Tests/images/fli_oob/03r/reproducing b/Tests/images/fli_oob/03r/reproducing
@@ -0,0 +1 @@
+im = Image.open(d); im.seek(0); im.getdata()
diff --git a/Tests/images/fli_oob/04r/04r00.fli b/Tests/images/fli_oob/04r/04r00.fli
diff --git a/Tests/images/fli_oob/04r/initial.fli b/Tests/images/fli_oob/04r/initial.fli
diff --git a/Tests/images/fli_oob/04r/notes b/Tests/images/fli_oob/04r/notes
@@ -0,0 +1 @@
+failure to check input buffer (`data`) boundaries in BRUN chunk
diff --git a/Tests/images/fli_oob/04r/others/04r01.fli b/Tests/images/fli_oob/04r/others/04r01.fli
diff --git a/Tests/images/fli_oob/04r/others/04r02.fli b/Tests/images/fli_oob/04r/others/04r02.fli
diff --git a/Tests/images/fli_oob/04r/others/04r03.fli b/Tests/images/fli_oob/04r/others/04r03.fli
diff --git a/Tests/images/fli_oob/04r/others/04r04.fli b/Tests/images/fli_oob/04r/others/04r04.fli
diff --git a/Tests/images/fli_oob/04r/others/04r05.fli b/Tests/images/fli_oob/04r/others/04r05.fli
diff --git a/Tests/images/fli_oob/04r/reproducing b/Tests/images/fli_oob/04r/reproducing
@@ -0,0 +1 @@
+im = Image.open(d); im.seek(0); im.getdata()
diff --git a/Tests/images/fli_oob/05r/05r00.fli b/Tests/images/fli_oob/05r/05r00.fli
diff --git a/Tests/images/fli_oob/05r/notes b/Tests/images/fli_oob/05r/notes
@@ -0,0 +1 @@
+failure to check input buffer (`data`) boundaries in LC chunk
diff --git a/Tests/images/fli_oob/05r/others/05r01.fli b/Tests/images/fli_oob/05r/others/05r01.fli
diff --git a/Tests/images/fli_oob/05r/others/05r02.fli b/Tests/images/fli_oob/05r/others/05r02.fli
diff --git a/Tests/images/fli_oob/05r/others/05r03.fli b/Tests/images/fli_oob/05r/others/05r03.fli
diff --git a/Tests/images/fli_oob/05r/others/05r04.fli b/Tests/images/fli_oob/05r/others/05r04.fli
diff --git a/Tests/images/fli_oob/05r/others/05r05.fli b/Tests/images/fli_oob/05r/others/05r05.fli
diff --git a/Tests/images/fli_oob/05r/others/05r06.fli b/Tests/images/fli_oob/05r/others/05r06.fli
diff --git a/Tests/images/fli_oob/05r/others/05r07.fli b/Tests/images/fli_oob/05r/others/05r07.fli
diff --git a/Tests/images/fli_oob/05r/reproducing b/Tests/images/fli_oob/05r/reproducing
@@ -0,0 +1 @@
+im = Image.open(d); im.seek(0); im.getdata()
diff --git a/Tests/images/fli_oob/06r/06r00.fli b/Tests/images/fli_oob/06r/06r00.fli
diff --git a/Tests/images/fli_oob/06r/notes b/Tests/images/fli_oob/06r/notes
@@ -0,0 +1 @@
+failure to check input buffer (`data`) boundaries in SS2 chunk
diff --git a/Tests/images/fli_oob/06r/others/06r01.fli b/Tests/images/fli_oob/06r/others/06r01.fli
diff --git a/Tests/images/fli_oob/06r/others/06r02.fli b/Tests/images/fli_oob/06r/others/06r02.fli
diff --git a/Tests/images/fli_oob/06r/others/06r03.fli b/Tests/images/fli_oob/06r/others/06r03.fli
diff --git a/Tests/images/fli_oob/06r/others/06r04.fli b/Tests/images/fli_oob/06r/others/06r04.fli
diff --git a/Tests/images/fli_oob/06r/reproducing b/Tests/images/fli_oob/06r/reproducing
@@ -0,0 +1 @@
+im = Image.open(d); im.seek(0); im.getdata()