Cannot modify the first frame of a MPO with asymmetric sized frames after seek

[telicent]

What did you do?

Did a seek(1) to the second frame followed by a seek(0) back to the first, and a transpose

What did you expect to happen?

The transpose

What actually happened?

Segmentation fault: 11

What are your OS, Python and Pillow versions?

• OS: OSX 10.15.7 and Ubuntu 20.04
• Python: 3.8.11 and 3.10.2
• Pillow: 9.0.1

This is an edge case issue with images created by the Nikon coolpix 500b (and possibly others), which appears to embed a couple "thumbnails" in the image files. Pillow (reasonably) detects this as a 3-frame MPO. For some reason, however, seeking back to the first frame and trying to modify it after seeking to any other frame crashes with a seg fault.

For the example below I used this image (not sure on the licensing, just the first I googled):
https://img.photographyblog.com/reviews/nikon_coolpix_b500/photos/nikon_coolpix_b500_02.jpg

from PIL import Image
im = Image.open('nikon_coolpix_b500_02.jpg')
im.seek(1)
im.seek(0)
im.transpose(Image.FLIP_LEFT_RIGHT) # => Segment fault: 11

If it helps, I noticed that the im.size doesn't update after the seek(0) back to the first frame, even though tell reports the correct frame:

im = Image.open('nikon_coolpix_b500_02.jpg')
im.size #  =>  (4608, 3456)
im.seek(1)
im.size #  =>  (640, 480)
im.seek(0)
im.size #  =>  (640, 480)
im.tell() # => 0

For my particular case, the problematic usage was some legacy code trying to detect animations that is better handled by checking n_frames, so I was able to work around it. Mainly documenting the issue in case anyone else runs into it.

[radarhere]

Hi. The problem here is that #5168 introduced a rule that MPO image size can only change for "Large Thumbnail" frames. However, it forgot to reset the size back to the initial value when seeking to another frame after that.

So in the case of your image, the first frame is a "Baseline MP Primary Image".
Then you seek to the second frame, a "Large Thumbnail (VGA Equivalent)", and the size is changed.
And then you seek back to the first frame, where the size incorrectly stays at the dimensions of the Large Thumbnail.

I've created PR #6101 to resolve this.