packages/python-pillow
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

modify CVE-2021-27921/CVE-2021-27922/CVE-2021-27923

Browse Source
This commit is contained in:
shirely16 2021-08-10 09:35:29 +08:00
parent 82717c6408
commit cedf635e7c
2 changed files with 32 additions and 21 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

48
backport-CVE-2021-27921_CVE-2021-27922_CVE-2021-27923.patch
View File

@ -10,17 +10,20 @@ memory allocations.
This is fixed for all locations where individual *ImageFile classes This is fixed for all locations where individual *ImageFile classes
are created without going through the usual Image.open method. are created without going through the usual Image.open method.
Conflict:NA
Reference:https://github.com/python-pillow/Pillow/commit/480f6819b592d7f07b9a9a52a7656c10bbe07442
--- ---
src/PIL/BlpImagePlugin.py | 1 +
src/PIL/BlpImagePlugin.py | 1 + src/PIL/IcnsImagePlugin.py | 2 ++
src/PIL/IcnsImagePlugin.py | 2 ++ src/PIL/IcoImagePlugin.py | 1 +
src/PIL/IcoImagePlugin.py | 1 +
3 files changed, 4 insertions(+) 3 files changed, 4 insertions(+)
diff -Nuar Pillow-8.1.1-old/src/PIL/BlpImagePlugin.py Pillow-8.1.1/src/PIL/BlpImagePlugin.py diff --git a/src/PIL/BlpImagePlugin.py b/src/PIL/BlpImagePlugin.py
--- Pillow-8.1.1-old/src/PIL/BlpImagePlugin.py 2021-03-13 16:44:33.159000000 +0800 index d5d7c0e..88aae80 100644
+++ Pillow-8.1.1/src/PIL/BlpImagePlugin.py 2021-03-13 16:51:52.803000000 +0800 --- a/src/PIL/BlpImagePlugin.py
@@ -353,6 +353,7 @@ +++ b/src/PIL/BlpImagePlugin.py
@@ -353,6 +353,7 @@ class BLP1Decoder(_BLPBaseDecoder):
data = jpeg_header + data data = jpeg_header + data
data = BytesIO(data) data = BytesIO(data)
image = JpegImageFile(data) image = JpegImageFile(data)
@ -28,10 +31,11 @@ diff -Nuar Pillow-8.1.1-old/src/PIL/BlpImagePlugin.py Pillow-8.1.1/src/PIL/BlpIm
self.tile = image.tile # :/ self.tile = image.tile # :/
self.fd = image.fp self.fd = image.fp
self.mode = image.mode self.mode = image.mode
diff -Nuar Pillow-8.1.1-old/src/PIL/IcnsImagePlugin.py Pillow-8.1.1/src/PIL/IcnsImagePlugin.py diff --git a/src/PIL/IcnsImagePlugin.py b/src/PIL/IcnsImagePlugin.py
--- Pillow-8.1.1-old/src/PIL/IcnsImagePlugin.py 2021-03-13 16:44:33.160000000 +0800 index 2a63d75..ca6a0ad 100644
+++ Pillow-8.1.1/src/PIL/IcnsImagePlugin.py 2021-03-13 16:54:10.925000000 +0800 --- a/src/PIL/IcnsImagePlugin.py
@@ -105,6 +105,7 @@ +++ b/src/PIL/IcnsImagePlugin.py
@@ -105,6 +105,7 @@ def read_png_or_jpeg2000(fobj, start_length, size):
if sig[:8] == b"\x89PNG\x0d\x0a\x1a\x0a": if sig[:8] == b"\x89PNG\x0d\x0a\x1a\x0a":
fobj.seek(start) fobj.seek(start)
im = PngImagePlugin.PngImageFile(fobj) im = PngImagePlugin.PngImageFile(fobj)
@ -39,18 +43,19 @@ diff -Nuar Pillow-8.1.1-old/src/PIL/IcnsImagePlugin.py Pillow-8.1.1/src/PIL/Icns
return {"RGBA": im} return {"RGBA": im}
elif ( elif (
sig[:4] == b"\xff\x4f\xff\x51" sig[:4] == b"\xff\x4f\xff\x51"
@@ -120,6 +121,7 @@ @@ -121,6 +122,7 @@ def read_png_or_jpeg2000(fobj, start_length, size):
fobj.seek(start)
jp2kstream = fobj.read(length) jp2kstream = fobj.read(length)
f = io.BytesIO(jp2kstream) f = io.BytesIO(jp2kstream)
+ Image._decompression_bomb_check(im.size)
im = Jpeg2KImagePlugin.Jpeg2KImageFile(f) im = Jpeg2KImagePlugin.Jpeg2KImageFile(f)
+ Image._decompression_bomb_check(im.size)
if im.mode != "RGBA": if im.mode != "RGBA":
im = im.convert("RGBA") im = im.convert("RGBA")
diff -Nuar Pillow-8.1.1-old/src/PIL/IcoImagePlugin.py Pillow-8.1.1/src/PIL/IcoImagePlugin.py return {"RGBA": im}
--- Pillow-8.1.1-old/src/PIL/IcoImagePlugin.py 2021-03-13 16:44:33.160000000 +0800 diff --git a/src/PIL/IcoImagePlugin.py b/src/PIL/IcoImagePlugin.py
+++ Pillow-8.1.1/src/PIL/IcoImagePlugin.py 2021-03-13 16:55:31.306000000 +0800 index e1bfa7a..5634bf8 100644
@@ -178,6 +178,7 @@ --- a/src/PIL/IcoImagePlugin.py
+++ b/src/PIL/IcoImagePlugin.py
@@ -178,6 +178,7 @@ class IcoFile:
if data[:8] == PngImagePlugin._MAGIC: if data[:8] == PngImagePlugin._MAGIC:
# png frame # png frame
im = PngImagePlugin.PngImageFile(self.buf) im = PngImagePlugin.PngImageFile(self.buf)
@ -58,3 +63,6 @@ diff -Nuar Pillow-8.1.1-old/src/PIL/IcoImagePlugin.py Pillow-8.1.1/src/PIL/IcoIm
else: else:
# XOR + AND mask bmp frame # XOR + AND mask bmp frame
im = BmpImagePlugin.DibImageFile(self.buf) im = BmpImagePlugin.DibImageFile(self.buf)
--
2.27.0

5
python-pillow.spec
View File

@ -5,7 +5,7 @@
Name: python-pillow Name: python-pillow
Version: 8.1.1 Version: 8.1.1
Release: 5 Release: 6
Summary: Python image processing library Summary: Python image processing library
License: MIT License: MIT
URL: http://python-pillow.github.io/ URL: http://python-pillow.github.io/
@ -159,6 +159,9 @@ popd
%{python3_sitearch}/PIL/__pycache__/ImageQt* %{python3_sitearch}/PIL/__pycache__/ImageQt*
%changelog %changelog
* Tue Aug 10 2021 hanhui <hanhui15@huawei.com> - 8.1.1-6
- Type:modify CVE-2021-27921CVE-2021-27922CVE-2021-27923
* Thu Jul 15 2021 liuyumeng <liuyumeng5@huawei.com> -8.1.1-5 * Thu Jul 15 2021 liuyumeng <liuyumeng5@huawei.com> -8.1.1-5
- Type:bugfix - Type:bugfix
- CVE:CVE-2021-34552 - CVE:CVE-2021-34552