Skip to content

Fix buffer overflow when saving compressed DDS images #9041

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 4 commits into from
Jun 27, 2025

Conversation

radarhere
Copy link
Member

No description provided.

radarhere added a commit to radarhere/Pillow that referenced this pull request Jun 27, 2025
radarhere added a commit to radarhere/Pillow that referenced this pull request Jun 27, 2025
radarhere added a commit to radarhere/Pillow that referenced this pull request Jun 27, 2025
@radarhere radarhere merged commit ef98b35 into python-pillow:main Jun 27, 2025
57 checks passed
@radarhere radarhere deleted the bcn branch June 27, 2025 14:30
radarhere added a commit that referenced this pull request Jun 27, 2025
Co-authored-by: Hugo van Kemenade <[email protected]>
@marbens-arch
Copy link

marbens-arch commented Jul 1, 2025

PoC made by the discoverer (not me):

image

import argparse
from PIL import Image

parser = argparse.ArgumentParser()
parser.add_argument('image')

args = parser.parse_args()

im = Image.open(args.image)
im = im.convert('RGBA')

img440 = im.resize((440,440))

img440.save('image.dds', 'DDS', pixel_format='DXT1')

python3 pillow_bcn_bug.py image.png (where image.png is the path to the bird picture) outputs:

double free or corruption (!prev)
Aborted (core dumped)

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

4 participants