From 2e2244d195c4fe8b2550afa1add46c0ad2402830 Mon Sep 17 00:00:00 2001 From: Lumir Balhar Date: Wed, 4 Mar 2020 08:55:10 +0100 Subject: [PATCH] CVE-2020-5313 --- python-imaging-Pillow-d1c6db8/libImaging/FliDecode.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/python-imaging-Pillow-d1c6db8/libImaging/FliDecode.c b/python-imaging-Pillow-d1c6db8/libImaging/FliDecode.c index 940171f..5004d39 100644 --- a/python-imaging-Pillow-d1c6db8/libImaging/FliDecode.c +++ b/python-imaging-Pillow-d1c6db8/libImaging/FliDecode.c @@ -40,8 +40,7 @@ ImagingFliDecode(Imaging im, ImagingCodecState state, UINT8* buf, int bytes) return 0; /* We don't decode anything unless we have a full chunk in the - input buffer (on the other hand, the Python part of the driver - makes sure this is always the case) */ + input buffer */ ptr = buf; @@ -52,6 +51,11 @@ ImagingFliDecode(Imaging im, ImagingCodecState state, UINT8* buf, int bytes) /* Make sure this is a frame chunk. The Python driver takes case of other chunk types. */ + if (bytes < 8) { + state->errcode = IMAGING_CODEC_OVERRUN; + return -1; + } + if (I16(ptr+4) != 0xF1FA) { state->errcode = IMAGING_CODEC_UNKNOWN; return -1; -- 2.24.1