Memory error in Storage.c when accepting negative image size arguments

python-pillow · Oct 3, 2016 · 5d8a0be · 5d8a0be
1 parent 8693afc
commit 5d8a0be
Show file tree

Hide file tree

Showing 3 changed files with 17 additions and 0 deletions.
diff --git a/Tests/images/negative_size.ppm b/Tests/images/negative_size.ppm
@@ -0,0 +1 @@
+P632 358888888632!
diff --git a/Tests/test_file_ppm.py b/Tests/test_file_ppm.py
@@ -44,5 +44,17 @@ def test_truncated_file(self):
         self.assertRaises(ValueError, lambda: Image.open(path))
 
 
+    def test_neg_ppm(self):
+        """test_neg_ppm
+
+        Storage.c accepted negative values for xsize, ysize.
+        open_ppm is a core debugging item that doesn't check any parameters for
+        sanity. 
+        """
+
+        with self.assertRaises(ValueError):
+            Image.core.open_ppm('Tests/images/negative_size.ppm')
+
+
 if __name__ == '__main__':
     unittest.main()
diff --git a/libImaging/Storage.c b/libImaging/Storage.c
@@ -406,6 +406,10 @@ ImagingNew(const char* mode, int xsize, int ysize)
     } else
         bytes = strlen(mode); /* close enough */
 
+    if (xsize < 0 || ysize < 0) {
+        return (Imaging) ImagingError_ValueError("bad image size");
+    }
+
     if ((int64_t) xsize * (int64_t) ysize <= THRESHOLD / bytes) {
         im = ImagingNewBlock(mode, xsize, ysize);
         if (im)