From 07c1fe0c758ecf46dcf97e44856a9a21a2a48a72 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Lum=C3=ADr=20Balhar?= <lbalhar@redhat.com>
Date: Tue, 28 Jul 2026 08:49:38 +0000
Subject: [PATCH] CVE-2026-59197: Validate size and rank when initializing
 RankFilter

- Move size/rank validation into RankFilter.__init__ so errors are raised
  at construction time rather than when filter() is called (PR #9661)
- Add check for excessively large filter sizes to prevent integer overflow
  in rank filter buffer allocation (PR #9695)
- Update MedianFilter/MinFilter/MaxFilter to call super().__init__() to
  inherit validation
- Add overflow guard in ImagingExpand for large margin values

Upstream fixes:
  https://github.com/python-pillow/Pillow/pull/9661
  https://github.com/python-pillow/Pillow/pull/9695
---
 src/PIL/ImageFilter.py  | 15 +++++++++------
 src/libImaging/Filter.c |  6 ++++++
 2 files changed, 15 insertions(+), 6 deletions(-)

diff --git a/src/PIL/ImageFilter.py b/src/PIL/ImageFilter.py
index 735a008..1f458d5 100644
--- a/src/PIL/ImageFilter.py
+++ b/src/PIL/ImageFilter.py
@@ -76,6 +76,12 @@ class RankFilter(Filter):
     name = "Rank"
 
     def __init__(self, size, rank):
+        if size * size * 4 > (2**31 - 1):
+            raise ValueError("filter size too large")
+        if size % 2 != 1:
+            raise ValueError("bad filter size")
+        if not (0 <= rank < size * size):
+            raise ValueError("bad rank value")
         self.size = size
         self.rank = rank
 
@@ -96,8 +102,7 @@ class MedianFilter(RankFilter):
     name = "Median"
 
     def __init__(self, size=3):
-        self.size = size
-        self.rank = size*size//2
+        super().__init__(size, size*size//2)
 
 
 class MinFilter(RankFilter):
@@ -110,8 +115,7 @@ class MinFilter(RankFilter):
     name = "Min"
 
     def __init__(self, size=3):
-        self.size = size
-        self.rank = 0
+        super().__init__(size, 0)
 
 
 class MaxFilter(RankFilter):
@@ -124,8 +128,7 @@ class MaxFilter(RankFilter):
     name = "Max"
 
     def __init__(self, size=3):
-        self.size = size
-        self.rank = size*size-1
+        super().__init__(size, size*size-1)
 
 
 class ModeFilter(Filter):
diff --git a/src/libImaging/Filter.c b/src/libImaging/Filter.c
index 6e4a005..1d492ac 100644
--- a/src/libImaging/Filter.c
+++ b/src/libImaging/Filter.c
@@ -46,6 +46,12 @@ ImagingExpand(Imaging imIn, int xmargin, int ymargin, int mode)
     if (xmargin < 0 && ymargin < 0)
         return (Imaging) ImagingError_ValueError("bad kernel size");
 
+    {
+        int margin = xmargin > ymargin ? xmargin : ymargin;
+        if (margin > 0 && margin > INT_MAX / (margin * (int)sizeof(FLOAT32)))
+            return (Imaging) ImagingError_ValueError("filter size too large");
+    }
+
     imOut = ImagingNewDirty(
         imIn->mode, imIn->xsize+2*xmargin, imIn->ysize+2*ymargin);
     if (!imOut)
-- 
2.55.0