|
 |
ed67fe |
From eaef29c3696cd021147e692360997f4c12377c60 Mon Sep 17 00:00:00 2001
|
|
|
ed67fe |
From: Lumir Balhar <lbalhar@redhat.com>
|
|
|
ed67fe |
Date: Mon, 14 Jun 2021 09:19:50 +0200
|
|
|
ed67fe |
Subject: [PATCH 2/5] CVE-2021-28678
|
|
|
ed67fe |
|
|
|
ed67fe |
---
|
|
|
ed67fe |
src/PIL/BlpImagePlugin.py | 43 +++++++++++++++++++++------------------
|
|
|
ed67fe |
1 file changed, 23 insertions(+), 20 deletions(-)
|
|
|
ed67fe |
|
|
|
ed67fe |
diff --git a/src/PIL/BlpImagePlugin.py b/src/PIL/BlpImagePlugin.py
|
|
|
ed67fe |
index d56d46c..846c83d 100644
|
|
|
ed67fe |
--- a/src/PIL/BlpImagePlugin.py
|
|
|
ed67fe |
+++ b/src/PIL/BlpImagePlugin.py
|
|
|
ed67fe |
@@ -294,33 +294,36 @@ class _BLPBaseDecoder(ImageFile.PyDecoder):
|
|
|
ed67fe |
raise IOError("Truncated Blp file")
|
|
|
ed67fe |
return 0, 0
|
|
|
ed67fe |
|
|
|
ed67fe |
+ def _safe_read(self, length):
|
|
|
ed67fe |
+ return ImageFile._safe_read(self.fd, length)
|
|
|
ed67fe |
+
|
|
|
ed67fe |
def _read_palette(self):
|
|
|
ed67fe |
ret = []
|
|
|
ed67fe |
for i in range(256):
|
|
|
ed67fe |
try:
|
|
|
ed67fe |
- b, g, r, a = struct.unpack("<4B", self.fd.read(4))
|
|
|
ed67fe |
+ b, g, r, a = struct.unpack("<4B", self._safe_read(4))
|
|
|
ed67fe |
except struct.error:
|
|
|
ed67fe |
break
|
|
|
ed67fe |
ret.append((b, g, r, a))
|
|
|
ed67fe |
return ret
|
|
|
ed67fe |
|
|
|
ed67fe |
def _read_blp_header(self):
|
|
|
ed67fe |
- self._blp_compression, = struct.unpack("
|
|
|
ed67fe |
+ self._blp_compression, = struct.unpack("
|
|
|
ed67fe |
|
|
|
ed67fe |
- self._blp_encoding, = struct.unpack("
|
|
|
ed67fe |
- self._blp_alpha_depth, = struct.unpack("
|
|
|
ed67fe |
- self._blp_alpha_encoding, = struct.unpack("
|
|
|
ed67fe |
- self._blp_mips, = struct.unpack("
|
|
|
ed67fe |
+ self._blp_encoding, = struct.unpack("
|
|
|
ed67fe |
+ self._blp_alpha_depth, = struct.unpack("
|
|
|
ed67fe |
+ self._blp_alpha_encoding, = struct.unpack("
|
|
|
ed67fe |
+ self._blp_mips, = struct.unpack("
|
|
|
ed67fe |
|
|
|
ed67fe |
- self.size = struct.unpack("
|
|
|
ed67fe |
+ self.size = struct.unpack("
|
|
|
ed67fe |
|
|
|
ed67fe |
if self.magic == b"BLP1":
|
|
|
ed67fe |
# Only present for BLP1
|
|
|
ed67fe |
- self._blp_encoding, = struct.unpack("
|
|
|
ed67fe |
- self._blp_subtype, = struct.unpack("
|
|
|
ed67fe |
+ self._blp_encoding, = struct.unpack("
|
|
|
ed67fe |
+ self._blp_subtype, = struct.unpack("
|
|
|
ed67fe |
|
|
|
ed67fe |
- self._blp_offsets = struct.unpack("<16I", self.fd.read(16 * 4))
|
|
|
ed67fe |
- self._blp_lengths = struct.unpack("<16I", self.fd.read(16 * 4))
|
|
|
ed67fe |
+ self._blp_offsets = struct.unpack("<16I", self._safe_read(16 * 4))
|
|
|
ed67fe |
+ self._blp_lengths = struct.unpack("<16I", self._safe_read(16 * 4))
|
|
|
ed67fe |
|
|
|
ed67fe |
|
|
|
ed67fe |
class BLP1Decoder(_BLPBaseDecoder):
|
|
|
ed67fe |
@@ -333,7 +336,7 @@ class BLP1Decoder(_BLPBaseDecoder):
|
|
|
ed67fe |
if self._blp_encoding in (4, 5):
|
|
|
ed67fe |
data = bytearray()
|
|
|
ed67fe |
palette = self._read_palette()
|
|
|
ed67fe |
- _data = BytesIO(self.fd.read(self._blp_lengths[0]))
|
|
|
ed67fe |
+ _data = BytesIO(self._safe_read(self._blp_lengths[0]))
|
|
|
ed67fe |
while True:
|
|
|
ed67fe |
try:
|
|
|
ed67fe |
offset, = struct.unpack("
|
|
|
ed67fe |
@@ -355,10 +358,10 @@ class BLP1Decoder(_BLPBaseDecoder):
|
|
|
ed67fe |
def _decode_jpeg_stream(self):
|
|
|
ed67fe |
from PIL.JpegImagePlugin import JpegImageFile
|
|
|
ed67fe |
|
|
|
ed67fe |
- jpeg_header_size, = struct.unpack("
|
|
|
ed67fe |
- jpeg_header = self.fd.read(jpeg_header_size)
|
|
|
ed67fe |
- self.fd.read(self._blp_offsets[0] - self.fd.tell()) # What IS this?
|
|
|
ed67fe |
- data = self.fd.read(self._blp_lengths[0])
|
|
|
ed67fe |
+ jpeg_header_size, = struct.unpack("
|
|
|
ed67fe |
+ jpeg_header = self._safe_read(jpeg_header_size)
|
|
|
ed67fe |
+ self._safe_read(self._blp_offsets[0] - self.fd.tell()) # What IS this?
|
|
|
ed67fe |
+ data = self._safe_read(self._blp_lengths[0])
|
|
|
ed67fe |
data = jpeg_header + data
|
|
|
ed67fe |
data = BytesIO(data)
|
|
|
ed67fe |
image = JpegImageFile(data)
|
|
|
ed67fe |
@@ -380,7 +383,7 @@ class BLP2Decoder(_BLPBaseDecoder):
|
|
|
ed67fe |
# Uncompressed or DirectX compression
|
|
|
ed67fe |
|
|
|
ed67fe |
if self._blp_encoding == BLP_ENCODING_UNCOMPRESSED:
|
|
|
ed67fe |
- _data = BytesIO(self.fd.read(self._blp_lengths[0]))
|
|
|
ed67fe |
+ _data = BytesIO(self._safe_read(self._blp_lengths[0]))
|
|
|
ed67fe |
while True:
|
|
|
ed67fe |
try:
|
|
|
ed67fe |
offset, = struct.unpack("
|
|
|
ed67fe |
@@ -394,7 +397,7 @@ class BLP2Decoder(_BLPBaseDecoder):
|
|
|
ed67fe |
linesize = (self.size[0] + 3) // 4 * 8
|
|
|
ed67fe |
for yb in range((self.size[1] + 3) // 4):
|
|
|
ed67fe |
for d in decode_dxt1(
|
|
|
ed67fe |
- self.fd.read(linesize),
|
|
|
ed67fe |
+ self._safe_read(linesize),
|
|
|
ed67fe |
alpha=bool(self._blp_alpha_depth)
|
|
|
ed67fe |
):
|
|
|
ed67fe |
data += d
|
|
|
ed67fe |
@@ -402,13 +405,13 @@ class BLP2Decoder(_BLPBaseDecoder):
|
|
|
ed67fe |
elif self._blp_alpha_encoding == BLP_ALPHA_ENCODING_DXT3:
|
|
|
ed67fe |
linesize = (self.size[0] + 3) // 4 * 16
|
|
|
ed67fe |
for yb in range((self.size[1] + 3) // 4):
|
|
|
ed67fe |
- for d in decode_dxt3(self.fd.read(linesize)):
|
|
|
ed67fe |
+ for d in decode_dxt3(self._safe_read(linesize)):
|
|
|
ed67fe |
data += d
|
|
|
ed67fe |
|
|
|
ed67fe |
elif self._blp_alpha_encoding == BLP_ALPHA_ENCODING_DXT5:
|
|
|
ed67fe |
linesize = (self.size[0] + 3) // 4 * 16
|
|
|
ed67fe |
for yb in range((self.size[1] + 3) // 4):
|
|
|
ed67fe |
- for d in decode_dxt5(self.fd.read(linesize)):
|
|
|
ed67fe |
+ for d in decode_dxt5(self._safe_read(linesize)):
|
|
|
ed67fe |
data += d
|
|
|
ed67fe |
else:
|
|
|
ed67fe |
raise BLPFormatError("Unsupported alpha encoding %r" % (
|
|
|
ed67fe |
--
|
|
|
ed67fe |
2.31.1
|
|
|
ed67fe |
|