| 1 | From 13f2c5ae14901c89c38f898496102afd9daeaf6d Mon Sep 17 00:00:00 2001
|
| 2 | From: Eric Soroos <[email protected]>
|
| 3 | Date: Fri, 28 Oct 2022 14:11:25 +0200
|
| 4 | Subject: [PATCH 1/5] Prevent DOS with large SAMPLESPERPIXEL in Tiff IFD
|
| 5 |
|
| 6 | A large value in the SAMPLESPERPIXEL tag could lead to a memory and
|
| 7 | runtime DOS in TiffImagePlugin.py when setting up the context for
|
| 8 | image decoding.
|
| 9 |
|
| 10 | diff --git a/src/PIL/TiffImagePlugin.py b/src/PIL/TiffImagePlugin.py
|
| 11 | index 04a63bd2b44..46166fc6335 100644
|
| 12 | |
| 13 | |
| 14 | @@ -257,6 +257,8 @@
|
| 15 | (MM, 8, (1,), 1, (8, 8, 8), ()): ("LAB", "LAB"),
|
| 16 | }
|
| 17 |
|
| 18 | +MAX_SAMPLESPERPIXEL = max(len(key_tp[4]) for key_tp in OPEN_INFO.keys())
|
| 19 | +
|
| 20 | PREFIXES = [
|
| 21 | b"MM\x00\x2A", # Valid TIFF header with big-endian byte order
|
| 22 | b"II\x2A\x00", # Valid TIFF header with little-endian byte order
|
| 23 | @@ -1396,6 +1398,12 @@ def _setup(self):
|
| 24 | SAMPLESPERPIXEL,
|
| 25 | 3 if self._compression == "tiff_jpeg" and photo in (2, 6) else 1,
|
| 26 | )
|
| 27 | +
|
| 28 | + if samples_per_pixel > MAX_SAMPLESPERPIXEL:
|
| 29 | + # DOS check, samples_per_pixel can be a Long, and we extend the tuple below
|
| 30 | + logger.error("More samples per pixel than can be decoded: %s", samples_per_pixel)
|
| 31 | + raise SyntaxError("Invalid value for samples per pixel")
|
| 32 | +
|
| 33 | if samples_per_pixel < bps_actual_count:
|
| 34 | # If a file has more values in bps_tuple than expected,
|
| 35 | # remove the excess.
|
| 36 |
|