Skip to content

Conversation

@radarhere
Copy link
Member

@radarhere radarhere commented Apr 4, 2025

xz 5.8.1 has been released - https://github.com/tukaani-project/xz/releases/tag/v5.8.1

This updates it, except for on 32-bit Windows. That would fail with https://github.com/radarhere/Pillow/actions/runs/14264115010/job/39981991680#step:30:1096

E OSError: decoder error -2

C:\hostedtoolcache\windows\Python\3.9.13\x86\lib\site-packages\PIL\TiffImagePlugin.py:1416: OSError
---------------------------- Captured stderr call -----------------------------
LZMADecode: Decoding error at scanline 0, data is corrupt.
LZMADecode: Not enough data at scanline 0 (short 49152 bytes).

I initially reported this to libtiff at https://gitlab.com/libtiff/libtiff/-/issues/677, but have since moved on and reported it directly to xz at tukaani-project/xz#171

@radarhere
Copy link
Member Author

tukaani-project/xz#171 found a workaround! I've pushed a commit to add -DXZ_CLMUL_CRC:BOOL=OFF.

@radarhere
Copy link
Member Author

For anyone who is wondering, we should not be affected by https://www.cve.org/CVERecord?id=CVE-2025-31115, as libtiff uses lzma_stream_decoder, not lzma_stream_decoder_mt. See https://gitlab.com/libtiff/libtiff/-/blob/master/libtiff/tif_lzma.c

@hugovk hugovk merged commit 774d0ae into python-pillow:main Apr 12, 2025
108 of 137 checks passed
@radarhere radarhere deleted the xz_upgrade branch April 12, 2025 07:30
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants