mirror of
https://github.com/openembedded/meta-openembedded.git
synced 2026-10-21 20:19:33 +00:00
Rohini Sangam
30683c653d
Pick patch from [1] also mentioned at NVD report in [2] [1] https://github.com/python-pillow/Pillow/commit/eada3cbd7fb9963ee90673fb7b5270124a0d5f4b [2] https://nvd.nist.gov/vuln/detail/cve-2026-59198 Signed-off-by: Rohini Sangam <rsangam@mvista.com> Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
61 lines
2.0 KiB
Diff
61 lines
2.0 KiB
Diff
From eada3cbd7fb9963ee90673fb7b5270124a0d5f4b Mon Sep 17 00:00:00 2001
|
|
From: Andrew Murray <3112309+radarhere@users.noreply.github.com>
|
|
Date: Tue, 23 Jun 2026 09:46:33 +1000
|
|
Subject: [PATCH] Prevent saving 1 mode images as TGA with run-length
|
|
encoding
|
|
(#9709)
|
|
|
|
CVE: CVE-2026-59198
|
|
Upstream-Status: Backport [https://github.com/python-pillow/Pillow/commit/eada3cbd7fb9963ee90673fb7b5270124a0d5f4b]
|
|
|
|
Signed-off-by: Rohini Sangam <rsangam@mvista.com>
|
|
---
|
|
Tests/test_file_tga.py | 12 +++++++++++-
|
|
src/PIL/TgaImagePlugin.py | 4 ++++
|
|
2 files changed, 15 insertions(+), 1 deletion(-)
|
|
|
|
diff --git a/Tests/test_file_tga.py b/Tests/test_file_tga.py
|
|
index ff6dab00d..c03282142 100644
|
|
--- a/Tests/test_file_tga.py
|
|
+++ b/Tests/test_file_tga.py
|
|
@@ -147,10 +147,20 @@ def test_save_wrong_mode(tmp_path: Path) -> None:
|
|
im = hopper("PA")
|
|
out = str(tmp_path / "temp.tga")
|
|
|
|
- with pytest.raises(OSError):
|
|
+ with pytest.raises(OSError, match="cannot write mode PA as TGA"):
|
|
im.save(out)
|
|
|
|
|
|
+def test_save_1_mode_rle(tmp_path: Path) -> None:
|
|
+ im = Image.new("1", (1, 1))
|
|
+ out = tmp_path / "temp.tga"
|
|
+
|
|
+ with pytest.raises(
|
|
+ OSError, match="cannot write mode 1 as TGA with run-length encoding"
|
|
+ ):
|
|
+ im.save(out, compression="tga_rle")
|
|
+
|
|
+
|
|
def test_save_mapdepth() -> None:
|
|
# This image has been manually hexedited from 200x32_p_bl_raw.tga
|
|
# to include an origin
|
|
diff --git a/src/PIL/TgaImagePlugin.py b/src/PIL/TgaImagePlugin.py
|
|
index 401a83f9f..e8fd297cf 100644
|
|
--- a/src/PIL/TgaImagePlugin.py
|
|
+++ b/src/PIL/TgaImagePlugin.py
|
|
@@ -191,6 +191,10 @@ def _save(im: Image.Image, fp: IO[bytes], filename: str) -> None:
|
|
compression = im.encoderinfo.get("compression", im.info.get("compression"))
|
|
rle = compression == "tga_rle"
|
|
if rle:
|
|
+ if im.mode == "1":
|
|
+ msg = f"cannot write mode {im.mode} as TGA with run-length encoding"
|
|
+ raise OSError(msg)
|
|
+
|
|
imagetype += 8
|
|
|
|
id_section = im.encoderinfo.get("id_section", im.info.get("id_section", ""))
|
|
--
|
|
2.44.4
|
|
|