Security fix for CVE-2023-44271

Resolves: RHEL-15460

CVE-2023-44271.patch

@@ -0,0 +1,91 @@
+From fc055dbef875b477c27196e10c61f98aeb23d62c Mon Sep 17 00:00:00 2001
+From: Lumir Balhar <lbalhar@redhat.com>
+Date: Fri, 10 Nov 2023 15:39:41 +0100
+Subject: [PATCH] CVE-2023-44271
+
+---
+ docs/reference/ImageFont.rst |  9 +++++++++
+ src/PIL/ImageFont.py         | 12 ++++++++++++
+ 2 files changed, 21 insertions(+)
+
+diff --git a/docs/reference/ImageFont.rst b/docs/reference/ImageFont.rst
+index 76fde44..21b9d9d 100644
+--- a/docs/reference/ImageFont.rst
++++ b/docs/reference/ImageFont.rst
+@@ -17,6 +17,15 @@ OpenType fonts (as well as other font formats supported by the FreeType
+ library). For earlier versions, TrueType support is only available as part of
+ the imToolkit package
+ 
++.. warning::
++    To protect against potential DOS attacks when using arbitrary strings as
++    text input, Pillow will raise a ``ValueError`` if the number of characters
++    is over a certain limit, :py:data:`MAX_STRING_LENGTH`.
++
++    This threshold can be changed by setting
++    :py:data:`MAX_STRING_LENGTH`. It can be disabled by setting
++    ``ImageFont.MAX_STRING_LENGTH = None``.
++
+ Example
+ -------
+ 
+diff --git a/src/PIL/ImageFont.py b/src/PIL/ImageFont.py
+index f3b55e0..7e7b62f 100644
+--- a/src/PIL/ImageFont.py
++++ b/src/PIL/ImageFont.py
+@@ -39,6 +39,8 @@ class _imagingft_not_installed(object):
+     def __getattr__(self, id):
+         raise ImportError("The _imagingft C module is not installed")
+ 
++MAX_STRING_LENGTH = 1_000_000
++
+ 
+ try:
+     from . import _imagingft as core
+@@ -46,6 +48,12 @@ except ImportError:
+     core = _imagingft_not_installed()
+ 
+ 
++def _string_length_check(text):
++    if MAX_STRING_LENGTH is not None and len(text) > MAX_STRING_LENGTH:
++        msg = "too many characters in string"
++        raise ValueError(msg)
++
++
+ # FIXME: add support for pilfont2 format (see FontFile.py)
+ 
+ # --------------------------------------------------------------------
+@@ -109,6 +117,7 @@ class ImageFont(object):
+         self.font = Image.core.font(image.im, data)
+ 
+     def getsize(self, text, *args, **kwargs):
++        _string_length_check(text)
+         return self.font.getsize(text)
+ 
+     def getmask(self, text, mode="", *args, **kwargs):
+@@ -154,6 +163,7 @@ class FreeTypeFont(object):
+         return self.font.ascent, self.font.descent
+ 
+     def getsize(self, text, direction=None, features=None):
++        _string_length_check(text)
+         size, offset = self.font.getsize(text, direction, features)
+         return (size[0] + offset[0], size[1] + offset[1])
+ 
+@@ -164,6 +174,7 @@ class FreeTypeFont(object):
+         return self.getmask2(text, mode, direction=direction, features=features)[0]
+ 
+     def getmask2(self, text, mode="", fill=Image.core.fill, direction=None, features=None, *args, **kwargs):
++        _string_length_check(text)
+         size, offset = self.font.getsize(text, direction, features)
+         im = fill("L", size, 0)
+         self.font.render(text, im.id, mode == "1", direction, features)
+@@ -205,6 +216,7 @@ class TransposedFont(object):
+         self.orientation = orientation  # any 'transpose' argument, or None
+ 
+     def getsize(self, text, *args, **kwargs):
++        _string_length_check(text)
+         w, h = self.font.getsize(text)
+         if self.orientation in (Image.ROTATE_90, Image.ROTATE_270):
+             return h, w
+-- 
+2.41.0
+

python-pillow.spec

@@ -8,7 +8,7 @@
 
 Name:           python-%{srcname}
 Version:        5.1.1
-Release:        18%{?dist}
+Release:        19%{?dist}
 Summary:        Python image processing library
 
 # License: see http://www.pythonware.com/products/pil/license.htm
@@ -113,6 +113,10 @@ Patch19:        CVE-2022-22817.patch
 # https://bugzilla.redhat.com/show_bug.cgi?id=2042511
 # https://bugzilla.redhat.com/show_bug.cgi?id=2042522
 Patch20:        CVE-2022-22815_CVE-2022-22816.patch
+# CVE-2023-44271 python-pillow: uncontrolled resource consumption when textlength
+# in an ImageDraw instance operates on a long text argument
+# Upstream fix: https://github.com/python-pillow/Pillow/commit/1fe1bb49c452b0318cad12ea9d97c3bef188e9a7
+Patch21:        CVE-2023-44271.patch
 
 BuildRequires:  freetype-devel
 BuildRequires:  gcc
@@ -257,6 +261,10 @@ popd
 
 
 %changelog
+* Fri Nov 10 2023 Lumír Balhar <lbalhar@redhat.com> - 5.1.1-19
+- Security fix for CVE-2023-44271
+Resolves: RHEL-15460
+
 * Fri Feb 11 2022 Charalampos Stratakis <cstratak@redhat.com> - 5.1.1-18
 - Fixup for CVE-2022-22817
 - Security fixes for CVE-2022-22815, CVE-2022-22816