From e616649b74319752628c78b5e72a16cf120c1bb6 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Lum=C3=ADr=20Balhar?= Date: Wed, 8 Jul 2026 13:02:14 +0000 Subject: [PATCH 1/2] Add decompression bomb checks to FontFile classes Fixes CVE-2026-54059, CVE-2026-54060, CVE-2026-55379 Backport of upstream commit 0a263e6264aa5399988d9acd3bbfbca2ca3ec77d --- src/PIL/BdfFontFile.py | 2 ++ src/PIL/FontFile.py | 4 +++- src/PIL/PcfFontFile.py | 1 + 3 files changed, 6 insertions(+), 1 deletion(-) diff --git a/src/PIL/BdfFontFile.py b/src/PIL/BdfFontFile.py index c8bc604..a0c78b8 100644 --- a/src/PIL/BdfFontFile.py +++ b/src/PIL/BdfFontFile.py @@ -75,6 +75,8 @@ def bdf_char(f): bbox = (dx, dy), (l, -d-y, x+l, -d), (0, 0, x, y) + Image._decompression_bomb_check((x, y)) + try: im = Image.frombytes("1", (x, y), bitmap, "hex", "1") except ValueError: diff --git a/src/PIL/FontFile.py b/src/PIL/FontFile.py index 46e49bc..bc68af3 100644 --- a/src/PIL/FontFile.py +++ b/src/PIL/FontFile.py @@ -58,7 +58,7 @@ class FontFile(object): if glyph: d, dst, src, im = glyph h = max(h, src[3] - src[1]) - w = w + (src[2] - src[0]) + w += src[2] - src[0] if w > WIDTH: lines += 1 w = (src[2] - src[0]) @@ -70,6 +70,8 @@ class FontFile(object): if xsize == 0 and ysize == 0: return "" + Image._decompression_bomb_check((xsize, ysize)) + self.ysize = h # paste glyphs into bitmap diff --git a/src/PIL/PcfFontFile.py b/src/PIL/PcfFontFile.py index eba85fe..3fdb505 100644 --- a/src/PIL/PcfFontFile.py +++ b/src/PIL/PcfFontFile.py @@ -213,6 +213,7 @@ class PcfFontFile(FontFile.FontFile): for i in range(nbitmaps): x, y, l, r, w, a, d, f = metrics[i] + Image._decompression_bomb_check((x, y)) b, e = offsets[i], offsets[i+1] bitmaps.append( Image.frombytes("1", (x, y), data[b:e], "raw", mode, pad(x)) -- 2.54.0