56 lines
1.9 KiB
Diff
56 lines
1.9 KiB
Diff
From 2a93aba5cfcf6e241ab4f9392c13e3b74032c061 Mon Sep 17 00:00:00 2001
|
|
From: Andrew Murray <radarhere@users.noreply.github.com>
|
|
Date: Thu, 22 Feb 2024 18:56:26 +1100
|
|
Subject: [PATCH] Use strncpy to avoid buffer overflow
|
|
|
|
Origin: https://github.com/python-pillow/Pillow/commit/2a93aba5cfcf6e241ab4f9392c13e3b74032c061
|
|
|
|
---
|
|
Tests/icc/sGrey-v2-nano.icc | Bin 0 -> 290 bytes
|
|
Tests/test_imagecms.py | 5 +++++
|
|
src/_imagingcms.c | 9 ++++-----
|
|
3 files changed, 9 insertions(+), 5 deletions(-)
|
|
create mode 100644 Tests/icc/sGrey-v2-nano.icc
|
|
|
|
diff --git a/Tests/test_imagecms.py b/Tests/test_imagecms.py
|
|
index c80fab75b67..fbd78032e59 100644
|
|
--- a/Tests/test_imagecms.py
|
|
+++ b/Tests/test_imagecms.py
|
|
@@ -593,3 +593,8 @@
|
|
)
|
|
|
|
assert_image_equal(test_image.convert(dst_format[2]), reference_image)
|
|
+
|
|
+
|
|
+def test_long_modes() -> None:
|
|
+ p = ImageCms.getOpenProfile("Tests/icc/sGrey-v2-nano.icc")
|
|
+ ImageCms.buildTransform(p, p, "ABCDEFGHI", "ABCDEFGHI")
|
|
diff --git a/src/_imagingcms.c b/src/_imagingcms.c
|
|
index 4d66dcc1085..84b8a7e71f9 100644
|
|
--- a/src/_imagingcms.c
|
|
+++ b/src/_imagingcms.c
|
|
@@ -201,8 +201,8 @@ cms_transform_new(cmsHTRANSFORM transform, char *mode_in, char *mode_out) {
|
|
|
|
self->transform = transform;
|
|
|
|
- strcpy(self->mode_in, mode_in);
|
|
- strcpy(self->mode_out, mode_out);
|
|
+ strncpy(self->mode_in, mode_in, 8);
|
|
+ strncpy(self->mode_out, mode_out, 8);
|
|
|
|
return (PyObject *)self;
|
|
}
|
|
@@ -242,10 +242,9 @@ findLCMStype(char *PILmode) {
|
|
// LabX equivalent like ALab, but not reversed -- no #define in lcms2
|
|
return (COLORSPACE_SH(PT_LabV2) | CHANNELS_SH(3) | BYTES_SH(1) | EXTRA_SH(1));
|
|
}
|
|
-
|
|
else {
|
|
- /* take a wild guess... but you probably should fail instead. */
|
|
- return TYPE_GRAY_8; /* so there's no buffer overrun... */
|
|
+ /* take a wild guess... */
|
|
+ return TYPE_GRAY_8;
|
|
}
|
|
}
|
|
|