Skip to content

Fixes for #2105 #2146

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 9 commits into from
Oct 3, 2016
Next Next commit
Memory error in Storage.c when accepting negative image size arguments
  • Loading branch information
wiredfool committed Oct 3, 2016
commit 5d8a0be45aad78c5a22c8d099118ee26ef8144af
1 change: 1 addition & 0 deletions Tests/images/negative_size.ppm
Original file line number Diff line number Diff line change
@@ -0,0 +1 @@
P632 358888888632!
12 changes: 12 additions & 0 deletions Tests/test_file_ppm.py
Original file line number Diff line number Diff line change
Expand Up @@ -44,5 +44,17 @@ def test_truncated_file(self):
self.assertRaises(ValueError, lambda: Image.open(path))


def test_neg_ppm(self):
"""test_neg_ppm

Storage.c accepted negative values for xsize, ysize.
open_ppm is a core debugging item that doesn't check any parameters for
sanity.
"""

with self.assertRaises(ValueError):
Image.core.open_ppm('Tests/images/negative_size.ppm')


if __name__ == '__main__':
unittest.main()
4 changes: 4 additions & 0 deletions libImaging/Storage.c
Original file line number Diff line number Diff line change
Expand Up @@ -406,6 +406,10 @@ ImagingNew(const char* mode, int xsize, int ysize)
} else
bytes = strlen(mode); /* close enough */

if (xsize < 0 || ysize < 0) {
return (Imaging) ImagingError_ValueError("bad image size");
}

if ((int64_t) xsize * (int64_t) ysize <= THRESHOLD / bytes) {
im = ImagingNewBlock(mode, xsize, ysize);
if (im)
Expand Down