From 1701afc3d17717caed28e34e9ae1312773bb97f5 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Lum=C3=ADr=20Balhar?= Date: Tue, 28 Jul 2026 08:49:17 +0000 Subject: [PATCH] CVE-2026-54058: Reject undersized stride when memory mapping an image Ensure map stride is at least one full row of pixels in PyImaging_MapBuffer. Previously only recalculated stride when it was <= 0; a positive stride smaller than xsize*pixelsize was accepted as-is, causing out-of-bounds reads. Upstream fix: https://github.com/python-pillow/Pillow/pull/9719 --- src/map.c | 13 +++++++++---- 1 file changed, 9 insertions(+), 4 deletions(-) diff --git a/src/map.c b/src/map.c index 76b3160..ef36dd8 100644 --- a/src/map.c +++ b/src/map.c @@ -330,13 +330,18 @@ PyImaging_MapBuffer(PyObject* self, PyObject* args) return NULL; } - if (stride <= 0) { + { + int pixelsize; if (!strcmp(mode, "L") || !strcmp(mode, "P")) - stride = xsize; + pixelsize = 1; else if (!strncmp(mode, "I;16", 4)) - stride = xsize * 2; + pixelsize = 2; else - stride = xsize * 4; + pixelsize = 4; + + if (stride <= xsize * pixelsize) { + stride = xsize * pixelsize; + } } if (stride > 0 && ysize > INT_MAX / stride) { -- 2.55.0