search

python-pillow / Pillow

Python Imaging Library (Fork)
https://python-pillow.org
Other
12.35k stars 2.24k forks source link

Cast int before potentially exceeding INT_MAX #8402

Closed radarhere closed 1 month ago

radarhere commented 2 months ago

Resolves #8401

tablen is an integer https://github.com/python-pillow/Pillow/blob/b557876ec3aa4d5d236d8044519f1c613031fbee/src/libImaging/Sgi.h#L22

and before we set it to im->bands * im->ysize, we check that the value will be less than INT_MAX https://github.com/python-pillow/Pillow/blob/b557876ec3aa4d5d236d8044519f1c613031fbee/src/libImaging/SgiRleDecode.c#L170-L172

but we then temporarily multiply it by 8, which might exceed INT_MAX. https://github.com/python-pillow/Pillow/blob/b557876ec3aa4d5d236d8044519f1c613031fbee/src/libImaging/SgiRleDecode.c#L181-L186

So this PR casts it to int64_t before applying the multiplication.