From bda494104681c60f1cfec4d50aea0f2036a6827d Mon Sep 17 00:00:00 2001
From: Andrew Murray <radarhere@users.noreply.github.com>
Date: Sat, 10 Aug 2019 05:51:10 +1000
Subject: [PATCH] Do not allow floodfill to extend into negative coordinates

---
 .../imagedraw_floodfill_not_negative.png      | Bin 0 -> 214 bytes
 Tests/test_imagedraw.py                       |  18 ++++++++++++++++++
 src/PIL/ImageDraw.py                          |   5 +++--
 3 files changed, 21 insertions(+), 2 deletions(-)
 create mode 100644 Tests/images/imagedraw_floodfill_not_negative.png

diff --git a/Tests/images/imagedraw_floodfill_not_negative.png b/Tests/images/imagedraw_floodfill_not_negative.png
new file mode 100644
index 0000000000000000000000000000000000000000..c3f34a174c01635e493e365e46c7720798f6a798
GIT binary patch
literal 214
zcmeAS@N?(olHy`uVBq!ia0vp^DIm<j1SJ1AFfjwExt=bLAr*7pUO33xU?6bh0CS+l
zTxZ@o)diBdjN0doH$Qwfk9Y2B{+iB+Mw-HdrFT~A1KooJK6vZ%?=m)Hd6=XI67_WT
Kb6Mw<&;$U><4D~A

literal 0
HcmV?d00001

diff --git a/Tests/test_imagedraw.py b/Tests/test_imagedraw.py
index ffe35a4fa4f..e7612a9d0df 100644
--- a/Tests/test_imagedraw.py
+++ b/Tests/test_imagedraw.py
@@ -559,6 +559,24 @@ def test_floodfill_thresh(self):
         # Assert
         self.assert_image_equal(im, Image.open("Tests/images/imagedraw_floodfill2.png"))
 
+    def test_floodfill_not_negative(self):
+        # floodfill() is experimental
+        # Test that floodfill does not extend into negative coordinates
+
+        # Arrange
+        im = Image.new("RGB", (W, H))
+        draw = ImageDraw.Draw(im)
+        draw.line((W / 2, 0, W / 2, H / 2), fill="green")
+        draw.line((0, H / 2, W / 2, H / 2), fill="green")
+
+        # Act
+        ImageDraw.floodfill(im, (int(W / 4), int(H / 4)), ImageColor.getrgb("red"))
+
+        # Assert
+        self.assert_image_equal(
+            im, Image.open("Tests/images/imagedraw_floodfill_not_negative.png")
+        )
+
     def create_base_image_draw(
         self, size, mode=DEFAULT_MODE, background1=WHITE, background2=GRAY
     ):
diff --git a/src/PIL/ImageDraw.py b/src/PIL/ImageDraw.py
index c9b2773881a..1805f86e42c 100644
--- a/src/PIL/ImageDraw.py
+++ b/src/PIL/ImageDraw.py
@@ -437,8 +437,9 @@ def floodfill(image, xy, value, border=None, thresh=0):
         new_edge = set()
         for (x, y) in edge:  # 4 adjacent method
             for (s, t) in ((x + 1, y), (x - 1, y), (x, y + 1), (x, y - 1)):
-                if (s, t) in full_edge:
-                    continue  # if already processed, skip
+                # If already processed, or if a coordinate is negative, skip
+                if (s, t) in full_edge or s < 0 or t < 0:
+                    continue
                 try:
                     p = pixel[s, t]
                 except (ValueError, IndexError):