cesnimda
58 lines
2.1 KiB
Python
58 lines
2.1 KiB
Python
"""Bounded regressions for upload-parser advisories, without hostile large allocations."""
|
|
|
|
import io
|
|
import struct
|
|
import subprocess
|
|
import sys
|
|
import zlib
|
|
|
|
import pytest
|
|
from PIL import Image
|
|
|
|
|
|
def test_truncated_pdf_xref_finishes_without_exhausting_parser_timeout():
|
|
# GHSA-39mj-jf6j-2qj3: an incomplete xref's final short line must not spin.
|
|
script = """
|
|
import io
|
|
from pypdf import PdfReader
|
|
from pypdf.errors import PdfReadError
|
|
body = b'%PDF-1.0\\n 1 0 obj<</Type/Catalog/Pages 2 0 R>>endobj\\n 2 0 obj<</Type/Pages/Kids[]/Count 0>>endobj\\n'
|
|
tail = b'\\n startxref\\n%d\\n%%%%EOF' % len(body)
|
|
try:
|
|
PdfReader(io.BytesIO(body + b'xref\\n 0 3\\n 0000000000 65535 f \\n' + tail))
|
|
except PdfReadError:
|
|
print('rejected')
|
|
else:
|
|
raise AssertionError('Incomplete xref was accepted')
|
|
"""
|
|
result = subprocess.run([sys.executable, "-c", script], capture_output=True, text=True, timeout=5)
|
|
assert result.returncode == 0, result.stderr
|
|
assert result.stdout.strip() == "rejected"
|
|
|
|
|
|
def test_apng_rejects_oversized_canvas_before_background_allocation(monkeypatch):
|
|
# GHSA-5xm2-6676-qcp9, scaled to64 pixels so the RED case stays harmless.
|
|
def chunk(kind, data):
|
|
return struct.pack(">I", len(data)) + kind + data + struct.pack(">I", zlib.crc32(kind + data))
|
|
|
|
png = (
|
|
b"\x89PNG\r\n\x1a\n"
|
|
+ chunk(b"IHDR", struct.pack(">IIBBBBB", 8, 8, 8, 6, 0, 0, 0))
|
|
+ chunk(b"acTL", struct.pack(">II", 2, 0))
|
|
+ chunk(b"fcTL", struct.pack(">IIIIIHHBB", 0, 1, 1, 0, 0, 1, 10, 1, 0))
|
|
+ chunk(b"IDAT", zlib.compress(b"\x00\x00\x00\x00\x00"))
|
|
+ chunk(b"IEND", b"")
|
|
)
|
|
monkeypatch.setattr(Image, "MAX_IMAGE_PIXELS", 16)
|
|
fills = []
|
|
original_fill = Image.core.fill
|
|
|
|
def record_fill(mode, size, *args):
|
|
fills.append(size)
|
|
return original_fill(mode, size, *args)
|
|
|
|
monkeypatch.setattr(Image.core, "fill", record_fill)
|
|
with pytest.raises(Image.DecompressionBombError):
|
|
Image.open(io.BytesIO(png))
|
|
assert (8, 8) not in fills, "An oversized canvas was allocated before bomb rejection"
|