Finish reading data at eof

Tests/test_file_bmp.py

@@ -139,6 +139,27 @@ def test_rle8():
     with Image.open("Tests/images/hopper_rle8_row_overflow.bmp") as im:
         assert_image_similar_tofile(im.convert("RGB"), "Tests/images/hopper.bmp", 12)
 
+    # Test EOF immediately after the header
+    with open("Tests/images/hopper_rle8.bmp", "rb") as fp:
+        data = fp.read(1078)
+        with Image.open(io.BytesIO(data)) as im:
+            with pytest.raises(ValueError):
+                im.load()
+
+    # Test EOF during delta
+    with open("Tests/images/bmp/q/pal8rletrns.bmp", "rb") as fp:
+        data = fp.read(3670)
+        with Image.open(io.BytesIO(data)) as im:
+            with pytest.raises(ValueError):
+                im.load()
+
+    # Test EOF when reading data in absolute mode
+    with open("Tests/images/bmp/g/pal8rle.bmp", "rb") as fp:
+        data = fp.read(1064)
+        with Image.open(io.BytesIO(data)) as im:
+            with pytest.raises(ValueError):
+                im.load()
+
 
 def test_offset():
     # This image has been hexedited

src/PIL/BmpImagePlugin.py

@@ -283,8 +283,11 @@ def decode(self, buffer):
         data = b""
         x = 0
         while len(data) < self.state.xsize * self.state.ysize:
-            num_pixels = self.fd.read(1)[0]
+            pixels = self.fd.read(1)
             byte = self.fd.read(1)
+            if not pixels or not byte:
+                break
+            num_pixels = pixels[0]
             if num_pixels:
                 # encoded mode
                 if x + num_pixels > self.state.xsize:
@@ -303,12 +306,18 @@ def decode(self, buffer):
                     break
                 elif byte[0] == 2:
                     # delta
+                    bytes_read = self.fd.read(2)
+                    if len(bytes_read) < 2:
+                        break
                     right, up = self.fd.read(2)
                     data += b"\x00" * (right + up * self.state.xsize)
                     x = len(data) % self.state.xsize
                 else:
                     # absolute mode
-                    data += self.fd.read(byte[0])
+                    bytes_read = self.fd.read(byte[0])
+                    data += bytes_read
+                    if len(bytes_read) < byte[0]:
+                        break
                     x += byte[0]
 
                     # align to 16-bit word boundary