46 lines
1.3 KiB
Diff
46 lines
1.3 KiB
Diff
From 1701afc3d17717caed28e34e9ae1312773bb97f5 Mon Sep 17 00:00:00 2001
|
|
From: =?UTF-8?q?Lum=C3=ADr=20Balhar?= <lbalhar@redhat.com>
|
|
Date: Tue, 28 Jul 2026 08:49:17 +0000
|
|
Subject: [PATCH] CVE-2026-54058: Reject undersized stride when memory mapping
|
|
an image
|
|
|
|
Ensure map stride is at least one full row of pixels in PyImaging_MapBuffer.
|
|
Previously only recalculated stride when it was <= 0; a positive stride smaller
|
|
than xsize*pixelsize was accepted as-is, causing out-of-bounds reads.
|
|
|
|
Upstream fix: https://github.com/python-pillow/Pillow/pull/9719
|
|
---
|
|
src/map.c | 13 +++++++++----
|
|
1 file changed, 9 insertions(+), 4 deletions(-)
|
|
|
|
diff --git a/src/map.c b/src/map.c
|
|
index 76b3160..ef36dd8 100644
|
|
--- a/src/map.c
|
|
+++ b/src/map.c
|
|
@@ -330,13 +330,18 @@ PyImaging_MapBuffer(PyObject* self, PyObject* args)
|
|
return NULL;
|
|
}
|
|
|
|
- if (stride <= 0) {
|
|
+ {
|
|
+ int pixelsize;
|
|
if (!strcmp(mode, "L") || !strcmp(mode, "P"))
|
|
- stride = xsize;
|
|
+ pixelsize = 1;
|
|
else if (!strncmp(mode, "I;16", 4))
|
|
- stride = xsize * 2;
|
|
+ pixelsize = 2;
|
|
else
|
|
- stride = xsize * 4;
|
|
+ pixelsize = 4;
|
|
+
|
|
+ if (stride <= xsize * pixelsize) {
|
|
+ stride = xsize * pixelsize;
|
|
+ }
|
|
}
|
|
|
|
if (stride > 0 && ysize > INT_MAX / stride) {
|
|
--
|
|
2.55.0
|
|
|