search

python-pillow / Pillow

Python Imaging Library (Fork)
https://python-pillow.org
Other
12.32k stars 2.23k forks source link

Raise an error if path is compacted during mapping #8416

Closed radarhere closed 1 month ago

radarhere commented 1 month ago

Within path_map(), a Python function is called. https://github.com/python-pillow/Pillow/blob/55a25aa4b1c91ae50ce29c13dffaa808a250ddbb/src/path.c#L393-L404

That Python function could, theoretically, make a call to ImagePath.Path.compact(), aka path_compact(), reallocating self->xy. https://github.com/python-pillow/Pillow/blob/55a25aa4b1c91ae50ce29c13dffaa808a250ddbb/src/path.c#L300

It would then be incorrect for xy to be accessed again by path_map().

I've added a flag to PyPathObject that is set at the start of the mapping loop, and cleared at the end. If the user's custom Python function calls compact() to reallocate the array in the middle, then a ValueError is raised.