Skip to content
Permalink
Browse files Browse the repository at this point in the history
Icns DOS fix -- CVE-2014-3589
Found and reported by Andrew Drake of dropbox.com
  • Loading branch information
wiredfool committed Aug 13, 2014
1 parent cc6610e commit 205e056
Show file tree
Hide file tree
Showing 2 changed files with 12 additions and 0 deletions.
2 changes: 2 additions & 0 deletions PIL/IcnsImagePlugin.py
Expand Up @@ -179,6 +179,8 @@ def __init__(self, fobj):
i = HEADERSIZE
while i < filesize:
sig, blocksize = nextheader(fobj)
if blocksize <= 0:
raise SyntaxError('invalid block header')
i += HEADERSIZE
blocksize -= HEADERSIZE
dct[sig] = (i, blocksize)
Expand Down
10 changes: 10 additions & 0 deletions Tests/check_icns_dos.py
@@ -0,0 +1,10 @@
# Tests potential DOS of IcnsImagePlugin with 0 length block.
# Run from anywhere that PIL is importable.

from PIL import Image
from io import BytesIO

if bytes is str:
Image.open(BytesIO(bytes('icns\x00\x00\x00\x10hang\x00\x00\x00\x00')))
else:
Image.open(BytesIO(bytes('icns\x00\x00\x00\x10hang\x00\x00\x00\x00', 'latin-1')))

0 comments on commit 205e056

Please sign in to comment.