Compare commits
No commits in common. "c8" and "c8-beta" have entirely different histories.
@ -1,38 +0,0 @@
|
||||
From 2d30e67ec0b77993de62f975aae29266d8d1f784 Mon Sep 17 00:00:00 2001
|
||||
From: Lumir Balhar <lbalhar@redhat.com>
|
||||
Date: Thu, 4 Apr 2024 13:01:56 +0200
|
||||
Subject: [PATCH] CVE-2024-28219
|
||||
|
||||
---
|
||||
src/_imagingcms.c | 8 ++++----
|
||||
1 file changed, 4 insertions(+), 4 deletions(-)
|
||||
|
||||
diff --git a/src/_imagingcms.c b/src/_imagingcms.c
|
||||
index 5e4196c..4169e28 100644
|
||||
--- a/src/_imagingcms.c
|
||||
+++ b/src/_imagingcms.c
|
||||
@@ -212,8 +212,8 @@ cms_transform_new(cmsHTRANSFORM transform, char* mode_in, char* mode_out)
|
||||
|
||||
self->transform = transform;
|
||||
|
||||
- strcpy(self->mode_in, mode_in);
|
||||
- strcpy(self->mode_out, mode_out);
|
||||
+ strncpy(self->mode_in, mode_in, 8);
|
||||
+ strncpy(self->mode_out, mode_out, 8);
|
||||
|
||||
return (PyObject*) self;
|
||||
}
|
||||
@@ -286,8 +286,8 @@ findLCMStype(char* PILmode)
|
||||
}
|
||||
|
||||
else {
|
||||
- /* take a wild guess... but you probably should fail instead. */
|
||||
- return TYPE_GRAY_8; /* so there's no buffer overrun... */
|
||||
+ /* take a wild guess... */
|
||||
+ return TYPE_GRAY_8;
|
||||
}
|
||||
}
|
||||
|
||||
--
|
||||
2.44.0
|
||||
|
||||
@ -1,45 +0,0 @@
|
||||
From 1701afc3d17717caed28e34e9ae1312773bb97f5 Mon Sep 17 00:00:00 2001
|
||||
From: =?UTF-8?q?Lum=C3=ADr=20Balhar?= <lbalhar@redhat.com>
|
||||
Date: Tue, 28 Jul 2026 08:49:17 +0000
|
||||
Subject: [PATCH] CVE-2026-54058: Reject undersized stride when memory mapping
|
||||
an image
|
||||
|
||||
Ensure map stride is at least one full row of pixels in PyImaging_MapBuffer.
|
||||
Previously only recalculated stride when it was <= 0; a positive stride smaller
|
||||
than xsize*pixelsize was accepted as-is, causing out-of-bounds reads.
|
||||
|
||||
Upstream fix: https://github.com/python-pillow/Pillow/pull/9719
|
||||
---
|
||||
src/map.c | 13 +++++++++----
|
||||
1 file changed, 9 insertions(+), 4 deletions(-)
|
||||
|
||||
diff --git a/src/map.c b/src/map.c
|
||||
index 76b3160..ef36dd8 100644
|
||||
--- a/src/map.c
|
||||
+++ b/src/map.c
|
||||
@@ -330,13 +330,18 @@ PyImaging_MapBuffer(PyObject* self, PyObject* args)
|
||||
return NULL;
|
||||
}
|
||||
|
||||
- if (stride <= 0) {
|
||||
+ {
|
||||
+ int pixelsize;
|
||||
if (!strcmp(mode, "L") || !strcmp(mode, "P"))
|
||||
- stride = xsize;
|
||||
+ pixelsize = 1;
|
||||
else if (!strncmp(mode, "I;16", 4))
|
||||
- stride = xsize * 2;
|
||||
+ pixelsize = 2;
|
||||
else
|
||||
- stride = xsize * 4;
|
||||
+ pixelsize = 4;
|
||||
+
|
||||
+ if (stride <= xsize * pixelsize) {
|
||||
+ stride = xsize * pixelsize;
|
||||
+ }
|
||||
}
|
||||
|
||||
if (stride > 0 && ysize > INT_MAX / stride) {
|
||||
--
|
||||
2.55.0
|
||||
|
||||
@ -1,63 +0,0 @@
|
||||
From e616649b74319752628c78b5e72a16cf120c1bb6 Mon Sep 17 00:00:00 2001
|
||||
From: =?UTF-8?q?Lum=C3=ADr=20Balhar?= <lbalhar@redhat.com>
|
||||
Date: Wed, 8 Jul 2026 13:02:14 +0000
|
||||
Subject: [PATCH 1/2] Add decompression bomb checks to FontFile classes
|
||||
|
||||
Fixes CVE-2026-54059, CVE-2026-54060, CVE-2026-55379
|
||||
Backport of upstream commit 0a263e6264aa5399988d9acd3bbfbca2ca3ec77d
|
||||
---
|
||||
src/PIL/BdfFontFile.py | 2 ++
|
||||
src/PIL/FontFile.py | 4 +++-
|
||||
src/PIL/PcfFontFile.py | 1 +
|
||||
3 files changed, 6 insertions(+), 1 deletion(-)
|
||||
|
||||
diff --git a/src/PIL/BdfFontFile.py b/src/PIL/BdfFontFile.py
|
||||
index c8bc604..a0c78b8 100644
|
||||
--- a/src/PIL/BdfFontFile.py
|
||||
+++ b/src/PIL/BdfFontFile.py
|
||||
@@ -75,6 +75,8 @@ def bdf_char(f):
|
||||
|
||||
bbox = (dx, dy), (l, -d-y, x+l, -d), (0, 0, x, y)
|
||||
|
||||
+ Image._decompression_bomb_check((x, y))
|
||||
+
|
||||
try:
|
||||
im = Image.frombytes("1", (x, y), bitmap, "hex", "1")
|
||||
except ValueError:
|
||||
diff --git a/src/PIL/FontFile.py b/src/PIL/FontFile.py
|
||||
index 46e49bc..bc68af3 100644
|
||||
--- a/src/PIL/FontFile.py
|
||||
+++ b/src/PIL/FontFile.py
|
||||
@@ -58,7 +58,7 @@ class FontFile(object):
|
||||
if glyph:
|
||||
d, dst, src, im = glyph
|
||||
h = max(h, src[3] - src[1])
|
||||
- w = w + (src[2] - src[0])
|
||||
+ w += src[2] - src[0]
|
||||
if w > WIDTH:
|
||||
lines += 1
|
||||
w = (src[2] - src[0])
|
||||
@@ -70,6 +70,8 @@ class FontFile(object):
|
||||
if xsize == 0 and ysize == 0:
|
||||
return ""
|
||||
|
||||
+ Image._decompression_bomb_check((xsize, ysize))
|
||||
+
|
||||
self.ysize = h
|
||||
|
||||
# paste glyphs into bitmap
|
||||
diff --git a/src/PIL/PcfFontFile.py b/src/PIL/PcfFontFile.py
|
||||
index eba85fe..3fdb505 100644
|
||||
--- a/src/PIL/PcfFontFile.py
|
||||
+++ b/src/PIL/PcfFontFile.py
|
||||
@@ -213,6 +213,7 @@ class PcfFontFile(FontFile.FontFile):
|
||||
|
||||
for i in range(nbitmaps):
|
||||
x, y, l, r, w, a, d, f = metrics[i]
|
||||
+ Image._decompression_bomb_check((x, y))
|
||||
b, e = offsets[i], offsets[i+1]
|
||||
bitmaps.append(
|
||||
Image.frombytes("1", (x, y), data[b:e], "raw", mode, pad(x))
|
||||
--
|
||||
2.54.0
|
||||
|
||||
@ -1,36 +0,0 @@
|
||||
From 5b9cc2556f54493f15420ecc842c54b81845930d Mon Sep 17 00:00:00 2001
|
||||
From: =?UTF-8?q?Lum=C3=ADr=20Balhar?= <lbalhar@redhat.com>
|
||||
Date: Wed, 8 Jul 2026 13:03:39 +0000
|
||||
Subject: [PATCH 2/2] Add decompression bomb check to GdImageFile
|
||||
|
||||
Fixes CVE-2026-55380
|
||||
Backport of upstream commit f39b0ae6624eb2d7c5c5d651d9bb5fdbd96a8675
|
||||
---
|
||||
src/PIL/GdImageFile.py | 4 +++-
|
||||
1 file changed, 3 insertions(+), 1 deletion(-)
|
||||
|
||||
diff --git a/src/PIL/GdImageFile.py b/src/PIL/GdImageFile.py
|
||||
index 09ab5ec..f3c0e1d 100644
|
||||
--- a/src/PIL/GdImageFile.py
|
||||
+++ b/src/PIL/GdImageFile.py
|
||||
@@ -23,7 +23,7 @@
|
||||
# purposes only.
|
||||
|
||||
|
||||
-from . import ImageFile, ImagePalette
|
||||
+from . import Image, ImageFile, ImagePalette
|
||||
from ._binary import i16be as i16
|
||||
from ._util import isPath
|
||||
|
||||
@@ -55,6 +55,8 @@ class GdImageFile(ImageFile.ImageFile):
|
||||
self.mode = "L" # FIXME: "P"
|
||||
self.size = i16(s[0:2]), i16(s[2:4])
|
||||
|
||||
+ Image._decompression_bomb_check(self.size)
|
||||
+
|
||||
# transparency index
|
||||
tindex = i16(s[5:7])
|
||||
if tindex < 256:
|
||||
--
|
||||
2.54.0
|
||||
|
||||
@ -1,89 +0,0 @@
|
||||
From 07c1fe0c758ecf46dcf97e44856a9a21a2a48a72 Mon Sep 17 00:00:00 2001
|
||||
From: =?UTF-8?q?Lum=C3=ADr=20Balhar?= <lbalhar@redhat.com>
|
||||
Date: Tue, 28 Jul 2026 08:49:38 +0000
|
||||
Subject: [PATCH] CVE-2026-59197: Validate size and rank when initializing
|
||||
RankFilter
|
||||
|
||||
- Move size/rank validation into RankFilter.__init__ so errors are raised
|
||||
at construction time rather than when filter() is called (PR #9661)
|
||||
- Add check for excessively large filter sizes to prevent integer overflow
|
||||
in rank filter buffer allocation (PR #9695)
|
||||
- Update MedianFilter/MinFilter/MaxFilter to call super().__init__() to
|
||||
inherit validation
|
||||
- Add overflow guard in ImagingExpand for large margin values
|
||||
|
||||
Upstream fixes:
|
||||
https://github.com/python-pillow/Pillow/pull/9661
|
||||
https://github.com/python-pillow/Pillow/pull/9695
|
||||
---
|
||||
src/PIL/ImageFilter.py | 15 +++++++++------
|
||||
src/libImaging/Filter.c | 6 ++++++
|
||||
2 files changed, 15 insertions(+), 6 deletions(-)
|
||||
|
||||
diff --git a/src/PIL/ImageFilter.py b/src/PIL/ImageFilter.py
|
||||
index 735a008..1f458d5 100644
|
||||
--- a/src/PIL/ImageFilter.py
|
||||
+++ b/src/PIL/ImageFilter.py
|
||||
@@ -76,6 +76,12 @@ class RankFilter(Filter):
|
||||
name = "Rank"
|
||||
|
||||
def __init__(self, size, rank):
|
||||
+ if size * size * 4 > (2**31 - 1):
|
||||
+ raise ValueError("filter size too large")
|
||||
+ if size % 2 != 1:
|
||||
+ raise ValueError("bad filter size")
|
||||
+ if not (0 <= rank < size * size):
|
||||
+ raise ValueError("bad rank value")
|
||||
self.size = size
|
||||
self.rank = rank
|
||||
|
||||
@@ -96,8 +102,7 @@ class MedianFilter(RankFilter):
|
||||
name = "Median"
|
||||
|
||||
def __init__(self, size=3):
|
||||
- self.size = size
|
||||
- self.rank = size*size//2
|
||||
+ super().__init__(size, size*size//2)
|
||||
|
||||
|
||||
class MinFilter(RankFilter):
|
||||
@@ -110,8 +115,7 @@ class MinFilter(RankFilter):
|
||||
name = "Min"
|
||||
|
||||
def __init__(self, size=3):
|
||||
- self.size = size
|
||||
- self.rank = 0
|
||||
+ super().__init__(size, 0)
|
||||
|
||||
|
||||
class MaxFilter(RankFilter):
|
||||
@@ -124,8 +128,7 @@ class MaxFilter(RankFilter):
|
||||
name = "Max"
|
||||
|
||||
def __init__(self, size=3):
|
||||
- self.size = size
|
||||
- self.rank = size*size-1
|
||||
+ super().__init__(size, size*size-1)
|
||||
|
||||
|
||||
class ModeFilter(Filter):
|
||||
diff --git a/src/libImaging/Filter.c b/src/libImaging/Filter.c
|
||||
index 6e4a005..1d492ac 100644
|
||||
--- a/src/libImaging/Filter.c
|
||||
+++ b/src/libImaging/Filter.c
|
||||
@@ -46,6 +46,12 @@ ImagingExpand(Imaging imIn, int xmargin, int ymargin, int mode)
|
||||
if (xmargin < 0 && ymargin < 0)
|
||||
return (Imaging) ImagingError_ValueError("bad kernel size");
|
||||
|
||||
+ {
|
||||
+ int margin = xmargin > ymargin ? xmargin : ymargin;
|
||||
+ if (margin > 0 && margin > INT_MAX / (margin * (int)sizeof(FLOAT32)))
|
||||
+ return (Imaging) ImagingError_ValueError("filter size too large");
|
||||
+ }
|
||||
+
|
||||
imOut = ImagingNewDirty(
|
||||
imIn->mode, imIn->xsize+2*xmargin, imIn->ysize+2*ymargin);
|
||||
if (!imOut)
|
||||
--
|
||||
2.55.0
|
||||
|
||||
@ -8,7 +8,7 @@
|
||||
|
||||
Name: python-%{srcname}
|
||||
Version: 5.1.1
|
||||
Release: 23%{?dist}
|
||||
Release: 20%{?dist}
|
||||
Summary: Python image processing library
|
||||
|
||||
# License: see http://www.pythonware.com/products/pil/license.htm
|
||||
@ -121,26 +121,6 @@ Patch21: CVE-2023-44271.patch
|
||||
# Upstream fix: https://github.com/python-pillow/Pillow/commit/02c6183d41c68a8dd080f5739f566bd82485822d
|
||||
# Patch rebased and tests converted from pytest to unittests.
|
||||
Patch22: CVE-2023-50447.patch
|
||||
# CVE-2024-28219 python-pillow: buffer overflow in _imagingcms.c
|
||||
# Upstream fix: https://github.com/python-pillow/Pillow/pull/7928
|
||||
# Patch rebased. The test requires a binary file and therefore isn't backported.
|
||||
Patch23: CVE-2024-28219.patch
|
||||
# CVE-2026-54059 python-pillow: uncontrolled memory allocation in PcfFontFile._load_bitmaps()
|
||||
# CVE-2026-54060 python-pillow: uncontrolled memory allocation in FontFile.compile()
|
||||
# CVE-2026-55379 python-pillow: uncontrolled memory allocation in BdfFontFile bdf_char()
|
||||
# Upstream fix: https://github.com/python-pillow/Pillow/commit/0a263e6264aa5399988d9acd3bbfbca2ca3ec77d
|
||||
Patch24: CVE-2026-54059_54060_55379.patch
|
||||
# CVE-2026-55380 python-pillow: uncontrolled memory allocation in GdImageFile
|
||||
# Upstream fix: https://github.com/python-pillow/Pillow/commit/f39b0ae6624eb2d7c5c5d651d9bb5fdbd96a8675
|
||||
Patch25: CVE-2026-55380.patch
|
||||
# CVE-2026-54058 python-pillow: out-of-bounds read via undersized stride when memory mapping McIdas AREA image
|
||||
# Upstream fix: https://github.com/python-pillow/Pillow/pull/9719
|
||||
Patch26: CVE-2026-54058.patch
|
||||
# CVE-2026-59197 python-pillow: integer overflow in RankFilter leading to out-of-bounds memory access
|
||||
# Upstream fixes:
|
||||
# https://github.com/python-pillow/Pillow/pull/9661
|
||||
# https://github.com/python-pillow/Pillow/pull/9695
|
||||
Patch27: CVE-2026-59197.patch
|
||||
|
||||
BuildRequires: freetype-devel
|
||||
BuildRequires: gcc
|
||||
@ -285,18 +265,6 @@ popd
|
||||
|
||||
|
||||
%changelog
|
||||
* Mon Jul 28 2026 Lumír Balhar <lbalhar@redhat.com> - 5.1.1-23
|
||||
- Security fix for CVE-2026-54058, CVE-2026-59197
|
||||
Resolves: RHEL-211857, RHEL-211848
|
||||
|
||||
* Wed Jul 08 2026 Lumír Balhar <lbalhar@redhat.com> - 5.1.1-22
|
||||
- Security fix for CVE-2026-54059, CVE-2026-54060, CVE-2026-55379, CVE-2026-55380
|
||||
Resolves: RHEL-192830, RHEL-192770, RHEL-192684, RHEL-192731
|
||||
|
||||
* Thu Apr 04 2024 Lumír Balhar <lbalhar@redhat.com> - 5.1.1-21
|
||||
- Security fix for CVE-2024-28219
|
||||
Resolves: RHEL-31071
|
||||
|
||||
* Thu Jan 25 2024 Lumír Balhar <lbalhar@redhat.com> - 5.1.1-20
|
||||
- Security fix for CVE-2023-50447
|
||||
Resolves: RHEL-22240
|
||||
|
||||
Loading…
Reference in New Issue
Block a user