64 lines
2.1 KiB
Diff
64 lines
2.1 KiB
Diff
From e616649b74319752628c78b5e72a16cf120c1bb6 Mon Sep 17 00:00:00 2001
|
|
From: =?UTF-8?q?Lum=C3=ADr=20Balhar?= <lbalhar@redhat.com>
|
|
Date: Wed, 8 Jul 2026 13:02:14 +0000
|
|
Subject: [PATCH 1/2] Add decompression bomb checks to FontFile classes
|
|
|
|
Fixes CVE-2026-54059, CVE-2026-54060, CVE-2026-55379
|
|
Backport of upstream commit 0a263e6264aa5399988d9acd3bbfbca2ca3ec77d
|
|
---
|
|
src/PIL/BdfFontFile.py | 2 ++
|
|
src/PIL/FontFile.py | 4 +++-
|
|
src/PIL/PcfFontFile.py | 1 +
|
|
3 files changed, 6 insertions(+), 1 deletion(-)
|
|
|
|
diff --git a/src/PIL/BdfFontFile.py b/src/PIL/BdfFontFile.py
|
|
index c8bc604..a0c78b8 100644
|
|
--- a/src/PIL/BdfFontFile.py
|
|
+++ b/src/PIL/BdfFontFile.py
|
|
@@ -75,6 +75,8 @@ def bdf_char(f):
|
|
|
|
bbox = (dx, dy), (l, -d-y, x+l, -d), (0, 0, x, y)
|
|
|
|
+ Image._decompression_bomb_check((x, y))
|
|
+
|
|
try:
|
|
im = Image.frombytes("1", (x, y), bitmap, "hex", "1")
|
|
except ValueError:
|
|
diff --git a/src/PIL/FontFile.py b/src/PIL/FontFile.py
|
|
index 46e49bc..bc68af3 100644
|
|
--- a/src/PIL/FontFile.py
|
|
+++ b/src/PIL/FontFile.py
|
|
@@ -58,7 +58,7 @@ class FontFile(object):
|
|
if glyph:
|
|
d, dst, src, im = glyph
|
|
h = max(h, src[3] - src[1])
|
|
- w = w + (src[2] - src[0])
|
|
+ w += src[2] - src[0]
|
|
if w > WIDTH:
|
|
lines += 1
|
|
w = (src[2] - src[0])
|
|
@@ -70,6 +70,8 @@ class FontFile(object):
|
|
if xsize == 0 and ysize == 0:
|
|
return ""
|
|
|
|
+ Image._decompression_bomb_check((xsize, ysize))
|
|
+
|
|
self.ysize = h
|
|
|
|
# paste glyphs into bitmap
|
|
diff --git a/src/PIL/PcfFontFile.py b/src/PIL/PcfFontFile.py
|
|
index eba85fe..3fdb505 100644
|
|
--- a/src/PIL/PcfFontFile.py
|
|
+++ b/src/PIL/PcfFontFile.py
|
|
@@ -213,6 +213,7 @@ class PcfFontFile(FontFile.FontFile):
|
|
|
|
for i in range(nbitmaps):
|
|
x, y, l, r, w, a, d, f = metrics[i]
|
|
+ Image._decompression_bomb_check((x, y))
|
|
b, e = offsets[i], offsets[i+1]
|
|
bitmaps.append(
|
|
Image.frombytes("1", (x, y), data[b:e], "raw", mode, pad(x))
|
|
--
|
|
2.54.0
|
|
|