File CVE-2023-44271.patch of Package python-Pillow.33206

Overview Repositories Revisions Requests Users Attributes Meta

File CVE-2023-44271.patch of Package python-Pillow.33206

Index: Pillow-9.5.0/Tests/test_imagefont.py
===================================================================
--- Pillow-9.5.0.orig/Tests/test_imagefont.py
+++ Pillow-9.5.0/Tests/test_imagefont.py
@@ -1106,6 +1106,25 @@ def test_render_mono_size():
     assert_image_equal_tofile(im, "Tests/images/text_mono.gif")
 
 
+def test_too_many_characters(font):
+    with pytest.raises(ValueError):
+        font.getlength("A" * 1_000_001)
+    with pytest.raises(ValueError):
+        font.getbbox("A" * 1_000_001)
+    with pytest.raises(ValueError):
+        font.getmask2("A" * 1_000_001)
+
+    transposed_font = ImageFont.TransposedFont(font)
+    with pytest.raises(ValueError):
+        transposed_font.getlength("A" * 1_000_001)
+
+    default_font = ImageFont.load_default()
+    with pytest.raises(ValueError):
+        default_font.getlength("A" * 1_000_001)
+    with pytest.raises(ValueError):
+        default_font.getbbox("A" * 1_000_001)
+
+
 @pytest.mark.parametrize(
     "test_file",
     [
Index: Pillow-9.5.0/src/PIL/ImageFont.py
===================================================================
--- Pillow-9.5.0.orig/src/PIL/ImageFont.py
+++ Pillow-9.5.0/src/PIL/ImageFont.py
@@ -54,6 +54,9 @@ def __getattr__(name):
     raise AttributeError(msg)
 
 
+MAX_STRING_LENGTH = 1_000_000
+
+
 try:
     from . import _imagingft as core
 except ImportError as ex:
@@ -65,6 +68,12 @@ except ImportError as ex:
 _UNSPECIFIED = object()
 
 
+def _string_length_check(text):
+    if MAX_STRING_LENGTH is not None and len(text) > MAX_STRING_LENGTH:
+        msg = "too many characters in string"
+        raise ValueError(msg)
+
+
 # FIXME: add support for pilfont2 format (see FontFile.py)
 
 # --------------------------------------------------------------------
@@ -185,6 +194,7 @@ class ImageFont:
 
         :return: ``(left, top, right, bottom)`` bounding box
         """
+        _string_length_check(text)
         width, height = self.font.getsize(text)
         return 0, 0, width, height
 
@@ -195,6 +205,7 @@ class ImageFont:
 
         .. versionadded:: 9.2.0
         """
+        _string_length_check(text)
         width, height = self.font.getsize(text)
         return width
 
@@ -346,6 +357,7 @@ class FreeTypeFont:
 
         :return: Width for horizontal, height for vertical text.
         """
+        _string_length_check(text)
         return self.font.getlength(text, mode, direction, features, language) / 64
 
     def getbbox(
@@ -405,6 +417,7 @@ class FreeTypeFont:
 
         :return: ``(left, top, right, bottom)`` bounding box
         """
+        _string_length_check(text)
         size, offset = self.font.getsize(
             text, mode, direction, features, language, anchor
         )
@@ -749,6 +762,7 @@ class FreeTypeFont:
                  :py:mod:`PIL.Image.core` interface module, and the text offset, the
                  gap between the starting coordinate and the first marking
         """
+        _string_length_check(text)
         if fill is _UNSPECIFIED:
             fill = Image.core.fill
         else:
@@ -912,6 +926,7 @@ class TransposedFont:
         if self.orientation in (Image.Transpose.ROTATE_90, Image.Transpose.ROTATE_270):
             msg = "text length is undefined for text rotated by 90 or 270 degrees"
             raise ValueError(msg)
+        _string_length_check(text)
         return self.font.getlength(text, *args, **kwargs)

Places

File CVE-2023-44271.patch of Package python-Pillow.33206

Places