Skip to content

Conversation

@radarhere
Copy link
Member

@radarhere radarhere commented Sep 22, 2024

Resolves #8401

tablen is an integer

int tablen;

and before we set it to im->bands * im->ysize, we check that the value will be less than INT_MAX

if (im->xsize > INT_MAX / im->bands || im->ysize > INT_MAX / im->bands) {
state->errcode = IMAGING_CODEC_MEMORY;
return -1;

but we then temporarily multiply it by 8, which might exceed INT_MAX.

c->tablen = im->bands * im->ysize;
/* below, we populate the starttab and lentab into the bufsize,
each with 4 bytes per element of tablen
Check here before we allocate any memory
*/
if (c->bufsize < 8 * c->tablen) {

So this PR casts it to int64_t before applying the multiplication.

@hugovk hugovk merged commit 747fdf5 into python-pillow:main Oct 1, 2024
@radarhere radarhere deleted the sgirle branch October 1, 2024 11:05
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Possible integer overflow in ImagingSgiRleDecode (SgiRleDecode.c)

2 participants