Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Added decompression bomb checks #4102

Merged
merged 1 commit into from Sep 30, 2019
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Jump to
Jump to file
Failed to load files.
Diff view
Diff view
Binary file added Tests/images/decompression_bomb.gif
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.
Binary file added Tests/images/decompression_bomb.ico
Binary file not shown.
9 changes: 9 additions & 0 deletions Tests/test_decompression_bomb.py
Expand Up @@ -14,6 +14,7 @@ def tearDown(self):
def test_no_warning_small_file(self):
# Implicit assert: no warning.
# A warning would cause a failure.
Image.MAX_IMAGE_PIXELS = ORIGINAL_LIMIT
Image.open(TEST_FILE)

def test_no_warning_no_limit(self):
Expand Down Expand Up @@ -41,6 +42,14 @@ def test_exception(self):

self.assertRaises(Image.DecompressionBombError, lambda: Image.open(TEST_FILE))

def test_exception_ico(self):
with self.assertRaises(Image.DecompressionBombError):
Image.open("Tests/images/decompression_bomb.ico")

def test_exception_gif(self):
with self.assertRaises(Image.DecompressionBombError):
Image.open("Tests/images/decompression_bomb.gif")


class TestDecompressionCrop(PillowTestCase):
def setUp(self):
Expand Down
1 change: 1 addition & 0 deletions src/PIL/GifImagePlugin.py
Expand Up @@ -265,6 +265,7 @@ def _seek(self, frame):
self.dispose = None
elif self.disposal_method == 2:
# replace with background colour
Image._decompression_bomb_check(self.size)
self.dispose = Image.core.fill("P", self.size, self.info["background"])
else:
# replace with previous contents
Expand Down
1 change: 1 addition & 0 deletions src/PIL/IcoImagePlugin.py
Expand Up @@ -180,6 +180,7 @@ def frame(self, idx):
else:
# XOR + AND mask bmp frame
im = BmpImagePlugin.DibImageFile(self.buf)
Image._decompression_bomb_check(im.size)

# change tile dimension to only encompass XOR image
im._size = (im.size[0], int(im.size[1] / 2))
Expand Down