Repository navigation
Validate BMP bit depth and pixel data length before allocating the image - #3223
Merged
JimBobSquarePants merged 3 commits intoOct 27, 2026
Merged
Conversation
An uncompressed bitmap with a bit depth other than 1, 2, 4, 8, 16, 24 or 32 was accepted by Identify, and Load failed with an ImageFormatException or a NotSupportedException depending on the depth. The header reader now rejects such depths with an InvalidImageContentException, so identification and decoding agree. An uncompressed or bit fields header could also declare far more pixel data than the stream holds. The decoder allocated the full pixel buffer before the first row read failed, and a single short row decoded without error. The declared pixel data is now checked against the remaining stream before the image is allocated; only the padding of the last row may be missing.
Member
|
Hi @jafin thank you for these contributions. Could you please raise relevant issues, so we have something to track for release notes. |
3 of 4 tasks
Contributor
Author
|
@JimBobSquarePants no worries, Issues are there now |
Count available complete rows after reserving the final row's pixel bytes. This avoids long overflow for maximum 32-bit BMP dimensions and rejects impossible dimensions before any pixel buffer request in every integrity mode. Retain missing final padding and both stored row orders. Replace the PR's runtime BMP builder and encoder-generated input with 13 fixed files (1228 bytes total). Independently check their headers, lengths, masks, and intended truncations; Pillow also verifies both valid pixel arrays. Extend allocation assertions to detect any Rgba32 allocation, including split buffers, rather than only one allocation the size of the complete image. Current main fails 11 malformed-file cases; the original patch still fails the maximum-dimension regression. Release .NET 10: 392 BMP/ICO/CUR/ANI tests and 50 general format/dimension tests pass with the corrected patch.
4 tasks done
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Prerequisites
Description
Reject unsupported
BI_RGBbit depths during header parsing. BothImage.IdentifyandImage.Loadnow throwInvalidImageContentExceptionfor depths other than 1, 2, 4, 8, 16, 24 and 32.Before allocating pixel storage, check that uncompressed RGB and bit-fields data can contain the declared rows. A tiny file can otherwise request a large image, or leave most of a row unread without an error. Count available rows by division so maximum-width, maximum-height 32-bit headers cannot overflow the length check.
Both checks remain fatal under every
SegmentIntegrityHandlingmode. Invalid pixel layouts and dimensions that cannot fit the available data cannot be decoded safely. RLE data is excluded from the fixed-size check. Missing padding after the final stored row remains supported, including top-down bitmaps.Testing
All new test inputs are stored files. The 13 fixtures total 1,228 bytes and cover invalid RGB depths, truncated RGB and bit-fields data, maximum dimensions, and final-row padding in both row orders. Their headers, masks, lengths and intended truncations were independently checked. Pillow also confirms the pixels in both valid fixtures. Tests use the existing
TestFilecache andTestMemoryAllocator; no input images or BMP payloads are generated during tests.Current
mainfails all 11 malformed-file cases. The original patch still reaches allocation for the maximum-dimension fixture. Allocation assertions now reject any Rgba32 allocation, including split buffers.Release .NET 10 verification:
No tolerances or reference images changed. The branch includes current
main.Fixes #3235.