Skip to content

Conversation

@radarhere
Copy link
Member

This improves/adds length checks in _accept for several plugins.

Here are two examples of the errors this fixes.

>>> from PIL import FliImagePlugin
>>> FliImagePlugin._accept(b"test\x11\xaf")
Traceback (most recent call last):
  File "<stdin>", line 1, in <module>
  File "PIL/FliImagePlugin.py", line 35, in _accept
    and i16(prefix, 14) in [0, 3]  # flags
  File "PIL/_binary.py", line 37, in i16le
    return unpack_from("<H", c, o)[0]
struct.error: unpack_from requires a buffer of at least 16 bytes for unpacking 2 bytes at offset 14 (actual buffer size is 6)
>>> from PIL import GribStubImagePlugin
>>> GribStubImagePlugin._accept(b"GRIB")
Traceback (most recent call last):
  File "<stdin>", line 1, in <module>
  File "PIL/GribStubImagePlugin.py", line 36, in _accept
    return prefix.startswith(b"GRIB") and prefix[7] == 1
IndexError: index out of range

@hugovk hugovk merged commit bde9075 into python-pillow:main Aug 27, 2025
51 checks passed
@radarhere radarhere deleted the accept branch August 27, 2025 20:06
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants