Skip to content

Commit

Permalink
Handle PCX images with an odd stride
Browse files Browse the repository at this point in the history
  • Loading branch information
radarhere committed Jan 21, 2021
1 parent 97b57e1 commit ac31061
Show file tree
Hide file tree
Showing 3 changed files with 17 additions and 4 deletions.
Binary file added Tests/images/odd_stride.pcx
Binary file not shown.
8 changes: 8 additions & 0 deletions Tests/test_file_pcx.py
Expand Up @@ -44,6 +44,14 @@ def test_odd(tmp_path):
_roundtrip(tmp_path, hopper(mode).resize((511, 511)))


def test_odd_read():
# Reading an image with an odd stride, making it malformed
with Image.open("Tests/images/odd_stride.pcx") as im:
im.load()

assert im.size == (371, 150)


def test_pil184():
# Check reading of files where xmin/xmax is not zero.

Expand Down
13 changes: 9 additions & 4 deletions src/PIL/PcxImagePlugin.py
Expand Up @@ -66,13 +66,13 @@ def _open(self):
version = s[1]
bits = s[3]
planes = s[65]
ignored_stride = i16(s, 66)
provided_stride = i16(s, 66)
logger.debug(
"PCX version %s, bits %s, planes %s, stride %s",
version,
bits,
planes,
ignored_stride,
provided_stride,
)

self.info["dpi"] = i16(s, 12), i16(s, 14)
Expand Down Expand Up @@ -110,10 +110,15 @@ def _open(self):
self.mode = mode
self._size = bbox[2] - bbox[0], bbox[3] - bbox[1]

# don't trust the passed in stride. Calculate for ourselves.
# Don't trust the passed in stride.
# Calculate the approximate position for ourselves.
# CVE-2020-35653
stride = (self._size[0] * bits + 7) // 8
stride += stride % 2

# While the specification states that this must be even,
# not all images follow this
if provided_stride != stride:
stride += stride % 2

bbox = (0, 0) + self.size
logger.debug("size: %sx%s", *self.size)
Expand Down

0 comments on commit ac31061

Please sign in to comment.