Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

PCD decoder overruns the shuffle buffer, Fixes #568 #1706

Merged
merged 2 commits into from
Feb 4, 2016

Conversation

wiredfool
Copy link
Member

The shuffle buffer is initialized to 24bpp, and the pcd decoder offsets 32bpp.

@wiredfool wiredfool added the Bug Any unexpected behavior, until confirmed feature. label Feb 2, 2016
@wiredfool wiredfool added this to the 3.1.1 milestone Feb 2, 2016
@wiredfool wiredfool mentioned this pull request Feb 2, 2016
# from convert look find on pillow and not imagemagick.

#target = hopper().resize((768,512))
#self.assert_image_similar(im, target, 10)
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Just curious, why are these lines commented?

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Never mind, I realise again that the comment explains it. This is a potential future test, a kind of todo if you will.

wiredfool added a commit that referenced this pull request Feb 4, 2016
PCD decoder overruns the shuffle buffer, Fixes #568
@wiredfool wiredfool merged commit 5ec7fd0 into python-pillow:master Feb 4, 2016
bluerise pushed a commit to bitrig/bitrig-ports that referenced this pull request Feb 9, 2016
…e.c,

where the decoder writes assuming 4 bytes per pixel into a 3 byte per pixel
wide buffer, allowing writing 768 bytes off the end of the buffer. This
overwrites objects in Python's stack, leading to a crash.
python-pillow/Pillow#1706

(There's also a newer upstream release but that will need additional
checking before it can go in).

Written by: Stuart Henderson <sthen@openbsd.org>
jsonn pushed a commit to jsonn/pkgsrc that referenced this pull request Feb 17, 2016
fixed buffer overflow in PcdDecode
bump PKGREV
@wiredfool wiredfool deleted the pcd-segfault branch October 2, 2017 13:30
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Bug Any unexpected behavior, until confirmed feature.
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants