90 lines
2.8 KiB
Diff
90 lines
2.8 KiB
Diff
From 07c1fe0c758ecf46dcf97e44856a9a21a2a48a72 Mon Sep 17 00:00:00 2001
|
|
From: =?UTF-8?q?Lum=C3=ADr=20Balhar?= <lbalhar@redhat.com>
|
|
Date: Tue, 28 Jul 2026 08:49:38 +0000
|
|
Subject: [PATCH] CVE-2026-59197: Validate size and rank when initializing
|
|
RankFilter
|
|
|
|
- Move size/rank validation into RankFilter.__init__ so errors are raised
|
|
at construction time rather than when filter() is called (PR #9661)
|
|
- Add check for excessively large filter sizes to prevent integer overflow
|
|
in rank filter buffer allocation (PR #9695)
|
|
- Update MedianFilter/MinFilter/MaxFilter to call super().__init__() to
|
|
inherit validation
|
|
- Add overflow guard in ImagingExpand for large margin values
|
|
|
|
Upstream fixes:
|
|
https://github.com/python-pillow/Pillow/pull/9661
|
|
https://github.com/python-pillow/Pillow/pull/9695
|
|
---
|
|
src/PIL/ImageFilter.py | 15 +++++++++------
|
|
src/libImaging/Filter.c | 6 ++++++
|
|
2 files changed, 15 insertions(+), 6 deletions(-)
|
|
|
|
diff --git a/src/PIL/ImageFilter.py b/src/PIL/ImageFilter.py
|
|
index 735a008..1f458d5 100644
|
|
--- a/src/PIL/ImageFilter.py
|
|
+++ b/src/PIL/ImageFilter.py
|
|
@@ -76,6 +76,12 @@ class RankFilter(Filter):
|
|
name = "Rank"
|
|
|
|
def __init__(self, size, rank):
|
|
+ if size * size * 4 > (2**31 - 1):
|
|
+ raise ValueError("filter size too large")
|
|
+ if size % 2 != 1:
|
|
+ raise ValueError("bad filter size")
|
|
+ if not (0 <= rank < size * size):
|
|
+ raise ValueError("bad rank value")
|
|
self.size = size
|
|
self.rank = rank
|
|
|
|
@@ -96,8 +102,7 @@ class MedianFilter(RankFilter):
|
|
name = "Median"
|
|
|
|
def __init__(self, size=3):
|
|
- self.size = size
|
|
- self.rank = size*size//2
|
|
+ super().__init__(size, size*size//2)
|
|
|
|
|
|
class MinFilter(RankFilter):
|
|
@@ -110,8 +115,7 @@ class MinFilter(RankFilter):
|
|
name = "Min"
|
|
|
|
def __init__(self, size=3):
|
|
- self.size = size
|
|
- self.rank = 0
|
|
+ super().__init__(size, 0)
|
|
|
|
|
|
class MaxFilter(RankFilter):
|
|
@@ -124,8 +128,7 @@ class MaxFilter(RankFilter):
|
|
name = "Max"
|
|
|
|
def __init__(self, size=3):
|
|
- self.size = size
|
|
- self.rank = size*size-1
|
|
+ super().__init__(size, size*size-1)
|
|
|
|
|
|
class ModeFilter(Filter):
|
|
diff --git a/src/libImaging/Filter.c b/src/libImaging/Filter.c
|
|
index 6e4a005..1d492ac 100644
|
|
--- a/src/libImaging/Filter.c
|
|
+++ b/src/libImaging/Filter.c
|
|
@@ -46,6 +46,12 @@ ImagingExpand(Imaging imIn, int xmargin, int ymargin, int mode)
|
|
if (xmargin < 0 && ymargin < 0)
|
|
return (Imaging) ImagingError_ValueError("bad kernel size");
|
|
|
|
+ {
|
|
+ int margin = xmargin > ymargin ? xmargin : ymargin;
|
|
+ if (margin > 0 && margin > INT_MAX / (margin * (int)sizeof(FLOAT32)))
|
|
+ return (Imaging) ImagingError_ValueError("filter size too large");
|
|
+ }
|
|
+
|
|
imOut = ImagingNewDirty(
|
|
imIn->mode, imIn->xsize+2*xmargin, imIn->ysize+2*ymargin);
|
|
if (!imOut)
|
|
--
|
|
2.55.0
|
|
|