From 6cad2f6857ab669139e5d417139b5795fae4afdf Mon Sep 17 00:00:00 2001
From: Lumir Balhar <lbalhar@redhat.com>
Date: Fri, 14 Feb 2020 09:43:57 +0100
Subject: [PATCH] CVE-2020-5312_CVE-2019-16865

---
 .../PIL/PsdImagePlugin.py                          |  6 ++++--
 .../libImaging/FliDecode.c                         | 14 +++++++++++---
 .../libImaging/PcxDecode.c                         |  8 ++++++++
 .../libImaging/RawDecode.c                         | 11 +++++++++--
 4 files changed, 32 insertions(+), 7 deletions(-)

diff --git a/python-imaging-Pillow-d1c6db8/PIL/PsdImagePlugin.py b/python-imaging-Pillow-d1c6db8/PIL/PsdImagePlugin.py
index 2192015..9072875 100644
--- a/python-imaging-Pillow-d1c6db8/PIL/PsdImagePlugin.py
+++ b/python-imaging-Pillow-d1c6db8/PIL/PsdImagePlugin.py
@@ -202,9 +202,11 @@ def _layerinfo(file):
         # skip over blend flags and extra information
         filler = read(12)
         name = ""
-        size = i32(read(4))
+        size = i32(read(4))  # length of the extra data field
         combined = 0
         if size:
+            data_end = file.tell() + size
+
             length = i32(read(4))
             if length:
                 mask_y = i32(read(4)); mask_x = i32(read(4))
@@ -223,7 +225,7 @@ def _layerinfo(file):
                 name = read(length).decode('latin-1', 'replace')
             combined += length + 1
 
-        file.seek(size - combined, 1)
+            file.seek(data_end)
         layers.append((name, mode, (x0, y0, x1, y1)))
 
     # get tiles
diff --git a/python-imaging-Pillow-d1c6db8/libImaging/FliDecode.c b/python-imaging-Pillow-d1c6db8/libImaging/FliDecode.c
index 75eebe8..940171f 100644
--- a/python-imaging-Pillow-d1c6db8/libImaging/FliDecode.c
+++ b/python-imaging-Pillow-d1c6db8/libImaging/FliDecode.c
@@ -30,7 +30,7 @@ ImagingFliDecode(Imaging im, ImagingCodecState state, UINT8* buf, int bytes)
 {
     UINT8* ptr;
     int framesize;
-    int c, chunks;
+    int c, chunks, advance;
     int l, lines;
     int i, j, x = 0, y, ymax;
 
@@ -59,10 +59,16 @@ ImagingFliDecode(Imaging im, ImagingCodecState state, UINT8* buf, int bytes)
 
     chunks = I16(ptr+6);
     ptr += 16;
+	bytes -= 16;
 
     /* Process subchunks */
     for (c = 0; c < chunks; c++) {
-	UINT8 *data = ptr + 6;
+	UINT8* data;
+	if (bytes < 10) {
+	    state->errcode = IMAGING_CODEC_OVERRUN;
+	    return -1;
+	}
+	data = ptr + 6;
 	switch (I16(ptr+4)) {
 	case 4: case 11:
 	    /* FLI COLOR chunk */
@@ -198,7 +204,9 @@ ImagingFliDecode(Imaging im, ImagingCodecState state, UINT8* buf, int bytes)
 	    state->errcode = IMAGING_CODEC_UNKNOWN;
 	    return -1;
 	}
-	ptr += I32(ptr);
+	advance = I32(ptr);
+	ptr += advance;
+	bytes -= advance;
     }
 
     return -1; /* end of frame */
diff --git a/python-imaging-Pillow-d1c6db8/libImaging/PcxDecode.c b/python-imaging-Pillow-d1c6db8/libImaging/PcxDecode.c
index ab82b23..4a1d92a 100644
--- a/python-imaging-Pillow-d1c6db8/libImaging/PcxDecode.c
+++ b/python-imaging-Pillow-d1c6db8/libImaging/PcxDecode.c
@@ -22,6 +22,14 @@ ImagingPcxDecode(Imaging im, ImagingCodecState state, UINT8* buf, int bytes)
     UINT8 n;
     UINT8* ptr;
 
+    if (strcmp(im->mode, "1") == 0 && state->xsize > state->bytes * 8) {
+        state->errcode = IMAGING_CODEC_OVERRUN;
+        return -1;
+    } else if (strcmp(im->mode, "P") == 0 && state->xsize > state->bytes) {
+        state->errcode = IMAGING_CODEC_OVERRUN;
+        return -1;
+    }
+
     ptr = buf;
 
     for (;;) {
diff --git a/python-imaging-Pillow-d1c6db8/libImaging/RawDecode.c b/python-imaging-Pillow-d1c6db8/libImaging/RawDecode.c
index 5aadb2b..b8b667e 100644
--- a/python-imaging-Pillow-d1c6db8/libImaging/RawDecode.c
+++ b/python-imaging-Pillow-d1c6db8/libImaging/RawDecode.c
@@ -33,8 +33,15 @@ ImagingRawDecode(Imaging im, ImagingCodecState state, UINT8* buf, int bytes)
 
 	/* get size of image data and padding */
 	state->bytes = (state->xsize * state->bits + 7) / 8;
-	rawstate->skip = (rawstate->stride) ?
-	    rawstate->stride - state->bytes : 0;
+	if (rawstate->stride) {
+	    rawstate->skip = rawstate->stride - state->bytes;
+	    if (rawstate->skip < 0) {
+	        state->errcode = IMAGING_CODEC_CONFIG;
+	        return -1;
+	    }
+	} else {
+	    rawstate->skip = 0;
+	}
 
 	/* check image orientation */
 	if (state->ystep < 0) {
-- 
2.24.1