Merge pull request #6510 from radarhere/buffer

python-pillow · Aug 31, 2022 · b607e83 · b607e83
2 parents 6697de1 + c463ef4
commit b607e83
Show file tree

Hide file tree

Showing 3 changed files with 10 additions and 0 deletions.
diff --git a/Tests/images/mmap_error.bmp b/Tests/images/mmap_error.bmp
diff --git a/Tests/test_file_bmp.py b/Tests/test_file_bmp.py
@@ -39,6 +39,13 @@ def test_invalid_file():
             BmpImagePlugin.BmpImageFile(fp)
 
 
+def test_fallback_if_mmap_errors():
+    # This image has been truncated,
+    # so that the buffer is not large enough when using mmap
+    with Image.open("Tests/images/mmap_error.bmp") as im:
+        assert_image_equal_tofile(im, "Tests/images/pal8_offset.bmp")
+
+
 def test_save_to_bytes():
     output = io.BytesIO()
     im = hopper()

diff --git a/src/PIL/ImageFile.py b/src/PIL/ImageFile.py
@@ -192,6 +192,9 @@ def load(self):
 
                     with open(self.filename) as fp:
                         self.map = mmap.mmap(fp.fileno(), 0, access=mmap.ACCESS_READ)
+                    if offset + self.size[1] * args[1] > self.map.size():
+                        # buffer is not large enough
+                        raise OSError
                     self.im = Image.core.map_buffer(
                         self.map, self.size, decoder_name, offset, args
                     )