Not able to parse particular greyscale .ico file

[IowaIowa]

I have dumped this .ico file from ResHacker from some particular PE file. I use IcoImagePlugin.IcoImageFile but getting:

python37\lib\site-packages\PIL\Image.py:800: in frombytes
    raise ValueError("not enough image data")

when debugging it seems that it derives bpp as 8 instead of 1.
Icon4.zip

[nulano]

It looks like bpp is coming from

Pillow/src/PIL/IcoImagePlugin.py

Lines 189 to 195 in 9e6dabf

	# figure out where AND mask image starts
	mode = a[0]
	bpp = 8
	for k, v in BmpImagePlugin.BIT2MODE.items():
	if mode == v[1]:
	bpp = k
	break

using the table

Pillow/src/PIL/BmpImagePlugin.py

Lines 39 to 47 in 9e6dabf

	BIT2MODE = {
	# bits => mode, rawmode
	1: ("P", "P;1"),
	4: ("P", "P;4"),
	8: ("P", "P"),
	16: ("RGB", "BGR;15"),
	24: ("RGB", "BGR"),
	32: ("RGB", "BGRX"),
	}

but for 1bpp images, the mode is first set to P based on this table, but then converted to 1 here

Pillow/src/PIL/BmpImagePlugin.py

Lines 242 to 244 in 9e6dabf

	if greyscale:
	self.mode = "1" if file_info["colors"] == 2 else "L"
	raw_mode = self.mode

Changing the first block to

            bpp = header["color_depth"]

defined at

Pillow/src/PIL/IcoImagePlugin.py

Lines 125 to 134 in 9e6dabf

	# See Wikipedia notes about color depth.
	# We need this just to differ images with equal sizes
	icon_header["color_depth"] = (
	icon_header["bpp"]
	or (
	icon_header["nb_color"] != 0
	and ceil(log(icon_header["nb_color"], 2))
	)
	or 256
	)

lets the image load with just a warning

c:\git\pillow\src\PIL\IcoImagePlugin.py:299: UserWarning: Image was not the expected size
  warnings.warn("Image was not the expected size")

but I suspect this could introduce a security vulnerability (I did not check thoroughly). The proper fix would probably be to add a special case to IcoImageFile for 1bpp images.

[radarhere]

Allowing the file to dictate bpp doesn't introduce a security problem because it's entirely within the Python layer.

I've created PR #5429 to resolve this.