Fix to upstream bug

Patch based on upstream commit to Pillow 2.7.0 (PIL fork)

Note that this patch includes a test of the fix, which requires an

image file which is copied in from files/png_decompress_dos.png,

since it cannot be patched in.

--- Imaging-1.1.7-orig/PIL/PngImagePlugin.py 2015-01-21 17:45:12.000000000 -0800

+++ Imaging-1.1.7/PIL/PngImagePlugin.py 2015-01-21 19:37:23.000000000 -0800

@@ -68,6 +68,12 @@ _MODES = {

(16,6): ("RGBA", "RGBA;16B"),

}

+def _safe_zlib_decompress(s):

+ dobj = zlib.decompressobj()

+ plaintext = dobj.decompress(s, ImageFile.SAFEBLOCK)

+ if dobj.unconsumed_tail:

+ raise ValueError("Decompressed Data Too Large")

+ return plaintext

# --------------------------------------------------------------------

# Support classes. Suitable for PNG and related formats like MNG etc.

@@ -197,7 +203,7 @@ class PngStream(ChunkStream):

if comp_method != 0:

raise SyntaxError("Unknown compression method %s in iCCP chunk" % comp_method)

try:

- icc_profile = zlib.decompress(s[i+2:])

+ icc_profile = _safe_zlib_decompress(s[i+2:])

except zlib.error:

icc_profile = None # FIXME

self.im_info["icc_profile"] = icc_profile

@@ -293,7 +299,7 @@ class PngStream(ChunkStream):

if comp_method != 0:

raise SyntaxError("Unknown compression method %s in zTXt chunk" % comp_method)

import zlib

- self.im_info[k] = self.im_text[k] = zlib.decompress(v[1:])

+ self.im_info[k] = self.im_text[k] = _safe_zlib_decompress(v[1:])

return s

# --------------------------------------------------------------------

--- Imaging-1.1.7-orig/selftest.py 2015-01-21 17:44:51.000000000 -0800

+++ Imaging-1.1.7/selftest.py 2015-07-02 17:06:23.636751412 -0700

@@ -9,6 +9,7 @@ from PIL import Image

from PIL import ImageDraw

from PIL import ImageFilter

from PIL import ImageMath

+from PIL import PngImagePlugin

try:

Image.core.ping

@@ -146,6 +147,15 @@ def testimage():

>>> im.mode, im.size

('F', (128, 128))

+ Test fix to PNG decompression DOS #1060

+

+ >>> try:

+ ... im = Image.open("Images/png_decompression_dos.png")

+ ... im.load()

+ ... except ValueError as msg:

+ ... print msg

+ Decompressed Data Too Large

+

PIL can do many other things, but I'll leave that for another

day. If you're curious, check the handbook, available from: