PPM "Channel value too large" error

[GauthierDa]

What did you do?

We are using PIL for reading PPM images of 1280x1024 or 1920x1080 pixels in RGB 24 bits with maxval of 255 in the header.

What did you expect to happen?

We expect the PPM to open correctly.

What actually happened?

The opening of PPM images failed due to a maxval error "Channel value too large for this mode"

What are your OS, Python and Pillow versions?

• OS: Windows 10
• Python: 3.9
• Pillow: 9.4.0

When I first try to load my PPM, PIL return the channel value too large error with the value of 20458 with a maxval of 255. Then I searched in my PPM this value and there is no data higher than 255.
After investigated the issue, I saw that the concatenation of the half_block and the next block block give this:
-> end of previus block: ... 204 ]
-> half_block + block: [20458 ...
-> expected: [204 58 ...

I fixed the issue locally by changing line 239:

if half_token:
    block = half_token + block  # stitch half_token to new block

By

if half_token:
    block = half_token + b' ' + block  # stitch half_token to new block
    half_token = False

[radarhere]

Could you upload a copy of the image?

[GauthierDa]

After searching a little bit more, my issue was because I create my PPM image in a C program using LF at the end of each line but then I launch the program with Windows so the EOL became CRLF and then pillow crash when I wanted to use show or save method.
I don't know if this CRLF is handle by pillow.

Edit
I have the same issue. Because my PPM file is internal to my company, I can't share it but I will try to replicate the bug with another PPM tomorrow.

[radarhere]

Hmm. I don't think the issue should be CRLF. I would have thought that

Pillow/src/PIL/PpmImagePlugin.py

Line 241 in 8cc5396

tokens = block.split()

splits CRLF without a problem.

[GauthierDa]

output.zip

Here my PPM images. First one, "mignon.ppm" can be open and show without any issue. The second one, "mignon1280.ppm" is the same image resize to 1280x1024 by Paint Shop Pro and can't be shown.

Code use to test:

# Python39
from PIL import Image
im = Image.open("mignon1280.ppm")
im.show()

[radarhere]

Thanks very much. I expect to include a fix for this in the next release of Pillow on April 1.

[GauthierDa]

Amazing, did you have any idea how can we make a local fix because we use pillow to convert PPM images to PNG and we can’t really wait one month. If you don’t know, we will find another way make it !

[radarhere]

This should serve as a temporary workaround.

from PIL.PpmImagePlugin import PpmPlainDecoder
PpmPlainDecoder._read_block = lambda self: self.fd.read()

from PIL import Image
im = Image.open("mignon1280.ppm")
im.show()

[radarhere]

I've created PR #7052 to resolve this. It should be part of Pillow 9.5.0, due out in the next day or so.

Normally I would have created the PR earlier, but investigating your problem, I found that it was actually also a security issue. The half token that was sticking around could be used to consume unexpected resources, by continuously providing data to fill any size that the image might claim itself to be.

[radarhere]

Pillow 9.5.0 has now been released.