Decompression bomb protection

[hugovk]

For #515.

Further discussion welcome.

[aclark4life]

How is this one coming along?

[hugovk]

@aclark4life It's ready for review. Discussion has been going on over at #515.

[aclark4life]

Should I manually merge this?

[wiredfool]

I'm not sure that we have consensus on the intended behaviour change.

[masklinn]

Look good to me, though maybe it could use a custom subcass of Warning or RuntimeWarning so it could be filtered (e.g. to an error) independently from other possible RuntimeWarnings?

I'm not sure that we have consensus on the intended behaviour change.

It seems innocuous enough that BC proponents would not mind it, and easy enough to notice that more hardline ones would be OK with it (and it's easy enough to turn warnings to errors).

[hugovk]

@masklinn Good idea, I've changed the warning to a custom DecompressionBombWarning, a subclass or RuntimeWarning.

[coveralls]

Coverage increased (+0.04%) when pulling 729b9f3 on hugovk:bomb into 0cbf318 on python-pillow:master.

[aclark4life]

Thanks