python-pillow/CVE-2024-28219.patch
wk333 8caca229e5 Fix CVE-2024-28219
(cherry picked from commit 153d5e6d363befe4ac93a207597edd0e4288f12c)
2024-04-07 16:44:55 +08:00

56 lines
1.9 KiB
Diff

From 2a93aba5cfcf6e241ab4f9392c13e3b74032c061 Mon Sep 17 00:00:00 2001
From: Andrew Murray <radarhere@users.noreply.github.com>
Date: Thu, 22 Feb 2024 18:56:26 +1100
Subject: [PATCH] Use strncpy to avoid buffer overflow
Origin: https://github.com/python-pillow/Pillow/commit/2a93aba5cfcf6e241ab4f9392c13e3b74032c061
---
Tests/icc/sGrey-v2-nano.icc | Bin 0 -> 290 bytes
Tests/test_imagecms.py | 5 +++++
src/_imagingcms.c | 9 ++++-----
3 files changed, 9 insertions(+), 5 deletions(-)
create mode 100644 Tests/icc/sGrey-v2-nano.icc
diff --git a/Tests/test_imagecms.py b/Tests/test_imagecms.py
index c80fab75b67..fbd78032e59 100644
--- a/Tests/test_imagecms.py
+++ b/Tests/test_imagecms.py
@@ -593,3 +593,8 @@
)
assert_image_equal(test_image.convert(dst_format[2]), reference_image)
+
+
+def test_long_modes() -> None:
+ p = ImageCms.getOpenProfile("Tests/icc/sGrey-v2-nano.icc")
+ ImageCms.buildTransform(p, p, "ABCDEFGHI", "ABCDEFGHI")
diff --git a/src/_imagingcms.c b/src/_imagingcms.c
index 4d66dcc1085..84b8a7e71f9 100644
--- a/src/_imagingcms.c
+++ b/src/_imagingcms.c
@@ -201,8 +201,8 @@ cms_transform_new(cmsHTRANSFORM transform, char *mode_in, char *mode_out) {
self->transform = transform;
- strcpy(self->mode_in, mode_in);
- strcpy(self->mode_out, mode_out);
+ strncpy(self->mode_in, mode_in, 8);
+ strncpy(self->mode_out, mode_out, 8);
return (PyObject *)self;
}
@@ -242,10 +242,9 @@ findLCMStype(char *PILmode) {
// LabX equivalent like ALab, but not reversed -- no #define in lcms2
return (COLORSPACE_SH(PT_LabV2) | CHANNELS_SH(3) | BYTES_SH(1) | EXTRA_SH(1));
}
-
else {
- /* take a wild guess... but you probably should fail instead. */
- return TYPE_GRAY_8; /* so there's no buffer overrun... */
+ /* take a wild guess... */
+ return TYPE_GRAY_8;
}
}