When reading past the end of a scan line, reduce bytes left

python-pillow · May 17, 2022 · c846cc8 · c846cc8
1 parent 184b73e
commit c846cc8
Show file tree

Hide file tree

Showing 3 changed files with 5 additions and 0 deletions.
diff --git a/Tests/images/cross_scan_line_truncated.tga b/Tests/images/cross_scan_line_truncated.tga
diff --git a/Tests/test_file_tga.py b/Tests/test_file_tga.py
@@ -101,6 +101,10 @@ def test_cross_scan_line():
     with Image.open("Tests/images/cross_scan_line.tga") as im:
         assert_image_equal_tofile(im, "Tests/images/cross_scan_line.png")
 
+    with Image.open("Tests/images/cross_scan_line_truncated.tga") as im:
+        with pytest.raises(OSError):
+            im.load()
+
 
 def test_save(tmp_path):
     test_file = "Tests/images/tga_id_field.tga"

diff --git a/src/libImaging/TgaRleDecode.c b/src/libImaging/TgaRleDecode.c
@@ -120,6 +120,7 @@ ImagingTgaRleDecode(Imaging im, ImagingCodecState state, UINT8 *buf, Py_ssize_t
             }
             memcpy(state->buffer + state->x, ptr, n);
             ptr += n;
+            bytes -= n;
             extra_bytes -= n;
         }
     }