Skip to content

Commit

Permalink
Merge pull request #7928 from python-pillow/lcms
Browse files Browse the repository at this point in the history
  • Loading branch information
hugovk authored Apr 1, 2024
2 parents 5beb0b6 + aeb51cb commit 2776126
Show file tree
Hide file tree
Showing 4 changed files with 13 additions and 14 deletions.
Binary file added Tests/icc/sGrey-v2-nano.icc
Binary file not shown.
5 changes: 5 additions & 0 deletions Tests/test_imagecms.py
Original file line number Diff line number Diff line change
Expand Up @@ -661,6 +661,11 @@ def test_auxiliary_channels_isolated() -> None:
assert_image_equal(test_image.convert(dst_format[2]), reference_image)


def test_long_modes() -> None:
p = ImageCms.getOpenProfile("Tests/icc/sGrey-v2-nano.icc")
ImageCms.buildTransform(p, p, "ABCDEFGHI", "ABCDEFGHI")


@pytest.mark.parametrize("mode", ("RGB", "RGBA", "RGBX"))
def test_rgb_lab(mode: str) -> None:
im = Image.new(mode, (1, 1))
Expand Down
13 changes: 4 additions & 9 deletions docs/releasenotes/10.3.0.rst
Original file line number Diff line number Diff line change
Expand Up @@ -14,16 +14,11 @@ ImageMath eval()
not recommended to process expressions without considering this.
:py:meth:`~PIL.ImageMath.lambda_eval` is a more secure alternative.

:cve:`YYYY-XXXXX`: TODO
^^^^^^^^^^^^^^^^^^^^^^^
:cve:`2024-28219`: Fix buffer overflow in ``_imagingcms.c``
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^

TODO

Backwards Incompatible Changes
==============================

TODO
^^^^
In ``_imagingcms.c``, two ``strcpy`` calls were able to copy too much data into fixed
length strings. This has been fixed by using ``strncpy`` instead.

Deprecations
============
Expand Down
9 changes: 4 additions & 5 deletions src/_imagingcms.c
Original file line number Diff line number Diff line change
Expand Up @@ -201,8 +201,8 @@ cms_transform_new(cmsHTRANSFORM transform, char *mode_in, char *mode_out) {

self->transform = transform;

strcpy(self->mode_in, mode_in);
strcpy(self->mode_out, mode_out);
strncpy(self->mode_in, mode_in, 8);
strncpy(self->mode_out, mode_out, 8);

return (PyObject *)self;
}
Expand Down Expand Up @@ -242,10 +242,9 @@ findLCMStype(char *PILmode) {
// LabX equivalent like ALab, but not reversed -- no #define in lcms2
return (COLORSPACE_SH(PT_LabV2) | CHANNELS_SH(3) | BYTES_SH(1) | EXTRA_SH(1));
}

else {
/* take a wild guess... but you probably should fail instead. */
return TYPE_GRAY_8; /* so there's no buffer overrun... */
/* take a wild guess... */
return TYPE_GRAY_8;
}
}

Expand Down

0 comments on commit 2776126

Please sign in to comment.