Raise ValueError when WMF inch is zero (python-pillow#8600)

Co-authored-by: Andrew Murray <[email protected]>

Author: radarhere

Tests/test_file_wmf.py

@@ -35,6 +35,13 @@ def test_load() -> None:
             assert im.load()[0, 0] == (255, 255, 255)
 
 
+def test_load_zero_inch() -> None:
+    b = BytesIO(b"\xd7\xcd\xc6\x9a\x00\x00" + b"\x00" * 10)
+    with pytest.raises(ValueError):
+        with Image.open(b):
+            pass
+
+
 def test_register_handler(tmp_path: Path) -> None:
     class TestHandler(ImageFile.StubHandler):
         methodCalled = False

src/PIL/WmfImagePlugin.py

@@ -92,6 +92,9 @@ def _open(self) -> None:
 
             # get units per inch
             self._inch = word(s, 14)
+            if self._inch == 0:
+                msg = "Invalid inch"
+                raise ValueError(msg)
 
             # get bounding box
             x0 = short(s, 6)