#4317: Fix an Array Bounds Read in imageop.rgb2rgb8.

Backport of r67266

diff --git a/Lib/test/test_imageop.py b/Lib/test/test_imageop.py
index 0cdda3d87907e2ec2a2328b0570cffa0ffcd688f..d28c03a2dfffb0c3efb6e8e99cd47efe8ce008b6 100755 (executable)
--- a/Lib/test/test_imageop.py
+++ b/Lib/test/test_imageop.py
@@ -13,6 +13,7 @@ SIZES = (1, 2, 3, 4)
 _VALUES = (1, 2, 2**10, 2**15-1, 2**15, 2**15+1, 2**31-2, 2**31-1)
 VALUES = tuple( -x for x in reversed(_VALUES) ) + (0,) + _VALUES
 AAAAA = "A" * 1024
+MAX_LEN = 2**20
 
 
 class InputValidationTests(unittest.TestCase):
@@ -24,7 +25,7 @@ class InputValidationTests(unittest.TestCase):
                 strlen = abs(width * height)
                 if size:
                     strlen *= size
-                if strlen < 1024:
+                if strlen < MAX_LEN:
                     data = "A" * strlen
                 else:
                     data = AAAAA

diff --git a/Misc/NEWS b/Misc/NEWS
index 3d6a8014a08fdbe44351eb949ed51138d16ae07d..788f6549a2f1bc3277d95a41278dba69a4c5ab41 100644 (file)
--- a/Misc/NEWS
+++ b/Misc/NEWS
@@ -12,6 +12,8 @@ What's New in Python 2.4.6c1?
 Core and builtins
 -----------------
 
+- Issue #4317: Fixed a crash in the imageop.rgb2rgb8() function.
+
 - Issue #4230: Fix a crash when a class has a custom __getattr__ and an
   __getattribute__ method that deletes the __getattr__ attribute.
 

diff --git a/Modules/imageop.c b/Modules/imageop.c
index b756f7dc419c8a5af9db461b5bd871342cf4a2b8..d746474da17d29841ad132acd20e050cc728e78c 100644 (file)
--- a/Modules/imageop.c
+++ b/Modules/imageop.c
@@ -590,7 +590,7 @@ imageop_rgb2rgb8(PyObject *self, PyObject *args)
        if ( !PyArg_ParseTuple(args, "s#ii", &cp, &len, &x, &y) )
                return 0;
 
-       if ( !check_multiply_size(len*4, x, "x", y, "y", 4) )
+       if ( !check_multiply_size(len, x, "x", y, "y", 4) )
                return 0;
        nlen = x*y;
        if ( !check_multiply(nlen, x, y) )