Skip to content

Fix comparison off-by-one in getModeData/getRawModeData - #9932

Open
akx wants to merge 1 commit into
python-pillow:mainfrom
akx:mode-off-by-one
Open

Fix comparison off-by-one in getModeData/getRawModeData#9932
akx wants to merge 1 commit into
python-pillow:mainfrom
akx:mode-off-by-one

Conversation

@akx

@akx akx commented Aug 31, 2026

Copy link
Copy Markdown
Contributor

Follows up on 9527ce7 (#9256).

As far as I can tell, there is no code path in C or Python that would naturally end up passing in an out-of-bounds ModeID (or RawModeID), since they're are always acquired from findModeID/findRawModeID, which itself will never return such a value. IOW, you'll have to do something silly like in the below reproducer.

Reproducer:

#include "Mode.c"

int
main(void) {
    return getModeData(IMAGING_MODE_I_16N + 1)->name != NULL;
}

Run on c9e4cff (main):

$ clang -fsanitize=address -Isrc/libImaging repro_modeid.c -o repro_modeid && ./repro_modeid
repro_modeid(12664,0x202fea2c0) malloc: nano zone abandoned due to inability to reserve vm space.
=================================================================
==12664==ERROR: AddressSanitizer: global-buffer-overflow on address 0x0001043200e8 at pc 0x00010431cbd8 bp 0x00016bae2d70 sp 0x00016bae2d68
READ of size 8 at 0x0001043200e8 thread T0
    #0 0x00010431cbd4 in main+0x48 (repro_modeid:arm64+0x100000bd4)
    #1 0x000194c86b94  (<unknown module>)

0x0001043200e8 is located 56 bytes before global variable 'RAWMODES' defined in 'repro_modeid.c' (0x000104320120) of size 1352
0x0001043200e8 is located 0 bytes after global variable 'MODES' defined in 'repro_modeid.c' (0x000104320040) of size 168
SUMMARY: AddressSanitizer: global-buffer-overflow (repro_modeid:arm64+0x100000bd4) in main+0x48
fish: Job 1, './repro_modeid' terminated by signal SIGABRT (Abort)

Run on 21774f4:

clang -fsanitize=address -Isrc/libImaging repro_modeid.c -o repro_modeid && ./repro_modeid
repro_modeid(12932,0x202fea2c0) malloc: nano zone abandoned due to inability to reserve vm space.
~/b/Pillow (mode-off-by-one) $

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant