Added GimpPaletteFile frombytes() to allow for unlimited parsing #8826
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Resolves #6639
#6640 has concerns about Pillow's limits when reading a Gimp palette file.
Pillow/src/PIL/GimpPaletteFile.py
Lines 33 to 34 in e66ebb6
Pillow/src/PIL/GimpPaletteFile.py
Lines 41 to 43 in e66ebb6
3. A colour's name can't be long enough to make the line more than 100 characters.
My general concern is that the spirit of #515 is against reading an unlimited amount of data from a file.
The test files that we have do include two additional headers and a comment.
Pillow/Tests/images/custom_gimp_palette.gpl
Lines 1 to 5 in e66ebb6
So I think extending the number of lines read by three is reasonable. That is my first commit, partly addressing point 2.
Beyond that, I think there are three options.
A. Do nothing. Palettes with more than 256 colours and long colour names are an edge case, and this is a lesser used format.
B. #6640's solution is to add class variables to allow configuration -
max_colors,_max_line_sizeand_max_file_size. I think that makes for a bit of a complex API.C. My idea is to add a
frombytes()method that accepts bytes. That way, if the user doesn't like our limits, they can take on the responsibility of reading everything from a file, and we can just parse the result.