!124 Upgrade to 9.3.0
From: @jianli-97 Reviewed-by: @myeuler Signed-off-by: @myeuler
This commit is contained in:
openeuler-ci-bot
Gitee
commit
3a0c99b3d5
30
0001-python-pillow_sphinx-issues.patch
Normal file
30
0001-python-pillow_sphinx-issues.patch
Normal file
@ -0,0 +1,30 @@
|
||||
From 73338782fc5f18a2e364a43cb2e79b9b7c4a9887 Mon Sep 17 00:00:00 2001
|
||||
From: jianli-97 <lijian2@kylinos.cn>
|
||||
Date: Wed, 7 Dec 2022 13:55:00 +0800
|
||||
Subject: [PATCH] python-pillow_sphinx-issues
|
||||
|
||||
---
|
||||
docs/conf.py | 4 +---
|
||||
1 file changed, 1 insertion(+), 3 deletions(-)
|
||||
|
||||
diff --git a/docs/conf.py b/docs/conf.py
|
||||
index bc67d93..fa12f25 100644
|
||||
--- a/docs/conf.py
|
||||
+++ b/docs/conf.py
|
||||
@@ -28,12 +28,10 @@ needs_sphinx = "2.4"
|
||||
# ones.
|
||||
extensions = [
|
||||
"sphinx_copybutton",
|
||||
- "sphinx_issues",
|
||||
"sphinx_removed_in",
|
||||
"sphinx.ext.autodoc",
|
||||
"sphinx.ext.intersphinx",
|
||||
- "sphinx.ext.viewcode",
|
||||
- "sphinxext.opengraph",
|
||||
+ "sphinx.ext.viewcode"
|
||||
]
|
||||
|
||||
intersphinx_mapping = {"python": ("https://docs.python.org/3", None)}
|
||||
--
|
||||
2.33.0
|
||||
|
||||
25
0001-python-pillow_spinxwarn.patch
Normal file
25
0001-python-pillow_spinxwarn.patch
Normal file
@ -0,0 +1,25 @@
|
||||
From b0678c8f15f0ea0ff0c17b0896b0049b6f9f2992 Mon Sep 17 00:00:00 2001
|
||||
From: jianli-97 <lijian2@kylinos.cn>
|
||||
Date: Wed, 7 Dec 2022 14:01:44 +0800
|
||||
Subject: [PATCH] python-pillow_spinxwarn
|
||||
|
||||
---
|
||||
docs/Makefile | 2 +-
|
||||
1 file changed, 1 insertion(+), 1 deletion(-)
|
||||
|
||||
diff --git a/docs/Makefile b/docs/Makefile
|
||||
index 458299a..535d736 100644
|
||||
--- a/docs/Makefile
|
||||
+++ b/docs/Makefile
|
||||
@@ -47,7 +47,7 @@ install-sphinx:
|
||||
|
||||
html:
|
||||
$(MAKE) install-sphinx
|
||||
- $(SPHINXBUILD) -b html -W --keep-going $(ALLSPHINXOPTS) $(BUILDDIR)/html
|
||||
+ $(SPHINXBUILD) -b html --keep-going $(ALLSPHINXOPTS) $(BUILDDIR)/html
|
||||
@echo
|
||||
@echo "Build finished. The HTML pages are in $(BUILDDIR)/html."
|
||||
|
||||
--
|
||||
2.33.0
|
||||
|
||||
Binary file not shown.
@ -1,79 +0,0 @@
|
||||
From 9ae8f6b7aa8ea4638cb675267cd20c5425dcfafc Mon Sep 17 00:00:00 2001
|
||||
From: qz_cx <wangqingzheng@kylinos.cn>
|
||||
Date: Thu, 17 Nov 2022 10:28:59 +0800
|
||||
Subject: [PATCH] Merge pull request #6700 from
|
||||
hugovk/security-samples_per_pixel-sec
|
||||
|
||||
hugovk committed
|
||||
Prevent DOS with large SAMPLESPERPIXEL in Tiff IFD
|
||||
A large value in the SAMPLESPERPIXEL tag could lead to a memory and
|
||||
runtime DOS in TiffImagePlugin.py when setting up the context for
|
||||
image decoding.
|
||||
---
|
||||
Tests/test_file_tiff.py | 14 +++++++++++++-
|
||||
src/PIL/TiffImagePlugin.py | 10 ++++++++++
|
||||
2 files changed, 23 insertions(+), 1 deletion(-)
|
||||
|
||||
diff --git a/Tests/test_file_tiff.py b/Tests/test_file_tiff.py
|
||||
index 5801e17..57fabfa 100644
|
||||
--- a/Tests/test_file_tiff.py
|
||||
+++ b/Tests/test_file_tiff.py
|
||||
@@ -3,7 +3,7 @@ from io import BytesIO
|
||||
|
||||
import pytest
|
||||
|
||||
-from PIL import Image, ImageFile, TiffImagePlugin
|
||||
+from PIL import Image, ImageFile, TiffImagePlugin, UnidentifiedImageError
|
||||
from PIL.TiffImagePlugin import RESOLUTION_UNIT, X_RESOLUTION, Y_RESOLUTION
|
||||
|
||||
from .helper import (
|
||||
@@ -734,6 +734,18 @@ class TestFileTiff:
|
||||
im.load()
|
||||
ImageFile.LOAD_TRUNCATED_IMAGES = False
|
||||
|
||||
+ @pytest.mark.parametrize(
|
||||
+ "test_file",
|
||||
+ [
|
||||
+ "Tests/images/oom-225817ca0f8c663be7ab4b9e717b02c661e66834.tif",
|
||||
+ ],
|
||||
+ )
|
||||
+ @pytest.mark.timeout(2)
|
||||
+ def test_oom(self, test_file):
|
||||
+ with pytest.raises(UnidentifiedImageError):
|
||||
+ with pytest.warns(UserWarning):
|
||||
+ with Image.open(test_file):
|
||||
+ pass
|
||||
|
||||
@pytest.mark.skipif(not is_win32(), reason="Windows only")
|
||||
class TestFileTiffW32:
|
||||
diff --git a/src/PIL/TiffImagePlugin.py b/src/PIL/TiffImagePlugin.py
|
||||
index 5df5c4f..f2afe63 100644
|
||||
--- a/src/PIL/TiffImagePlugin.py
|
||||
+++ b/src/PIL/TiffImagePlugin.py
|
||||
@@ -252,6 +252,8 @@ OPEN_INFO = {
|
||||
(MM, 8, (1,), 1, (8, 8, 8), ()): ("LAB", "LAB"),
|
||||
}
|
||||
|
||||
+MAX_SAMPLESPERPIXEL = max(len(key_tp[4]) for key_tp in OPEN_INFO.keys())
|
||||
+
|
||||
PREFIXES = [
|
||||
b"MM\x00\x2A", # Valid TIFF header with big-endian byte order
|
||||
b"II\x2A\x00", # Valid TIFF header with little-endian byte order
|
||||
@@ -1310,6 +1312,14 @@ class TiffImageFile(ImageFile.ImageFile):
|
||||
SAMPLESPERPIXEL,
|
||||
3 if self._compression == "tiff_jpeg" and photo in (2, 6) else 1,
|
||||
)
|
||||
+
|
||||
+ if samplesPerPixel > MAX_SAMPLESPERPIXEL:
|
||||
+ # DOS check, samplesPerPixel can be a Long, and we extend the tuple below
|
||||
+ logger.error(
|
||||
+ "More samples per pixel than can be decoded: %s", samplesPerPixel
|
||||
+ )
|
||||
+ raise SyntaxError("Invalid value for samples per pixel")
|
||||
+
|
||||
if len(bps_tuple) != samplesPerPixel:
|
||||
raise SyntaxError("unknown data organization")
|
||||
|
||||
--
|
||||
2.33.0
|
||||
|
||||
@ -1,30 +0,0 @@
|
||||
From fe32501922ef5e1be9a7d307132719bd5d52ca35 Mon Sep 17 00:00:00 2001
|
||||
From: Andrew Murray <radarhere@users.noreply.github.com>
|
||||
Date: Fri, 14 Jan 2022 10:16:35 +1100
|
||||
Subject: [PATCH] Corrected allocation
|
||||
|
||||
Conflict:NA
|
||||
Reference:https://github.com/python-pillow/Pillow/pull/5958/commits/fe32501922ef5e1be9a7d307132719bd5d52ca35
|
||||
|
||||
This patch is the rear patch of CVE-2022-22815,CVE-2022-22816
|
||||
|
||||
---
|
||||
src/path.c | 2 +-
|
||||
1 file changed, 1 insertion(+), 1 deletion(-)
|
||||
|
||||
diff --git a/src/path.c b/src/path.c
|
||||
index dea274e..1180406 100644
|
||||
--- a/src/path.c
|
||||
+++ b/src/path.c
|
||||
@@ -57,7 +57,7 @@ alloc_array(Py_ssize_t count) {
|
||||
if ((unsigned long long)count > (SIZE_MAX / (2 * sizeof(double))) - 1) {
|
||||
return ImagingError_MemoryError();
|
||||
}
|
||||
- xy = calloc(2 * count * sizeof(double) + 1, sizeof(double));
|
||||
+ xy = calloc(2 * count + 1, sizeof(double));
|
||||
if (!xy) {
|
||||
ImagingError_MemoryError();
|
||||
}
|
||||
--
|
||||
2.27.0
|
||||
|
||||
Binary file not shown.
@ -4,19 +4,15 @@
|
||||
%global with_docs 0
|
||||
|
||||
Name: python-pillow
|
||||
Version: 9.0.1
|
||||
Release: 3
|
||||
Version: 9.3.0
|
||||
Release: 1
|
||||
Summary: Python image processing library
|
||||
License: MIT
|
||||
URL: http://python-pillow.github.io/
|
||||
Source0: https://github.com/python-pillow/Pillow/archive/%{version}/Pillow-%{version}.tar.gz
|
||||
Source1: oom-225817ca0f8c663be7ab4b9e717b02c661e66834.tif
|
||||
Source0: https://github.com/python-pillow/Pillow/archive/refs/tags/%{version}.tar.gz
|
||||
|
||||
Patch0: python-pillow_spinxwarn.patch
|
||||
Patch1: python-pillow_sphinx-issues.patch
|
||||
|
||||
Patch6000: backport-Corrected-memory-allocation.patch
|
||||
Patch6001: CVE-2022-45199.patch
|
||||
Patch0: 0001-python-pillow_spinxwarn.patch
|
||||
Patch1: 0001-python-pillow_sphinx-issues.patch
|
||||
|
||||
BuildRequires: freetype-devel ghostscript lcms2-devel libimagequant-devel libjpeg-devel libtiff-devel
|
||||
BuildRequires: libwebp-devel openjpeg2-devel tk-devel zlib-devel python3-cffi python3-devel python3-numpy python3-olefile
|
||||
@ -96,7 +92,6 @@ Provides: python3-imaging-qt = %{version}-%{release}
|
||||
Qt pillow image wrapper.
|
||||
%prep
|
||||
%autosetup -p1 -n Pillow-%{version}
|
||||
cp %{SOURCE1} Tests/images/
|
||||
|
||||
%build
|
||||
|
||||
@ -155,6 +150,9 @@ pytest --ignore=_build.python2 --ignore=_build.python3 --ignore=_build.pypy3 -v
|
||||
%{python3_sitearch}/PIL/__pycache__/ImageQt*
|
||||
|
||||
%changelog
|
||||
* Wed Dec 7 2022 lijian <lijian2@kylinos.cn> - 9.3.0-1
|
||||
- Upgrade to 9.3.0
|
||||
|
||||
* Thu Nov 17 2022 qz_cx <wangqingzheng@kylinos.cn> - 9.0.1-3
|
||||
- Type:CVE
|
||||
- ID:NA
|
||||
@ -173,15 +171,15 @@ pytest --ignore=_build.python2 --ignore=_build.python3 --ignore=_build.pypy3 -v
|
||||
* Thu Aug 19 2021 hanhui <hanhui15@huawei.com> - 8.1.2-2
|
||||
- DESC: enable test case from setup.py
|
||||
|
||||
* Wed Jul 14 2021 OpenStack_SIG <openstack@openeuler.org> - 8.1.2-1
|
||||
- Update to 8.1.2
|
||||
|
||||
* Thu Jul 15 2021 liuyumeng <liuyumeng5@huawei.com> - 8.1.1-6
|
||||
- Type:bugfix
|
||||
- CVE:CVE-2021-34552
|
||||
- SUG:NA
|
||||
- DESC: incorporate community patch
|
||||
|
||||
* Wed Jul 14 2021 OpenStack_SIG <openstack@openeuler.org> - 8.1.2-1
|
||||
- Update to 8.1.2
|
||||
|
||||
* Tue Jul 6 2021 hanhui <hanhui15@huawei.com> - 8.1.1-5
|
||||
- Type:bugfix
|
||||
- CVE:CVE-2021-28675 CVE-2021-28676 CVE-2021-28677 CVE-2021-28678 CVE-2021-25287 CVE-2021-25288
|
||||
|
||||
@ -1,17 +0,0 @@
|
||||
diff -rupN --no-dereference Pillow-9.0.1/docs/conf.py Pillow-9.0.1-new/docs/conf.py
|
||||
--- Pillow-9.0.1/docs/conf.py 2022-02-03 00:45:27.000000000 +0100
|
||||
+++ Pillow-9.0.1-new/docs/conf.py 2022-02-23 09:06:33.169472252 +0100
|
||||
@@ -30,12 +30,10 @@ needs_sphinx = "2.4"
|
||||
# ones.
|
||||
extensions = [
|
||||
"sphinx_copybutton",
|
||||
- "sphinx_issues",
|
||||
"sphinx_removed_in",
|
||||
"sphinx.ext.autodoc",
|
||||
"sphinx.ext.intersphinx",
|
||||
- "sphinx.ext.viewcode",
|
||||
- "sphinxext.opengraph",
|
||||
+ "sphinx.ext.viewcode"
|
||||
]
|
||||
|
||||
intersphinx_mapping = {"python": ("https://docs.python.org/3", None)}
|
||||
@ -1,12 +0,0 @@
|
||||
diff -rupN --no-dereference Pillow-9.0.1/docs/Makefile Pillow-9.0.1-new/docs/Makefile
|
||||
--- Pillow-9.0.1/docs/Makefile 2022-02-03 00:45:27.000000000 +0100
|
||||
+++ Pillow-9.0.1-new/docs/Makefile 2022-02-23 09:06:33.060472214 +0100
|
||||
@@ -42,7 +42,7 @@ clean:
|
||||
-rm -rf $(BUILDDIR)/*
|
||||
|
||||
html:
|
||||
- $(SPHINXBUILD) -b html -W --keep-going $(ALLSPHINXOPTS) $(BUILDDIR)/html
|
||||
+ $(SPHINXBUILD) -b html --keep-going $(ALLSPHINXOPTS) $(BUILDDIR)/html
|
||||
@echo
|
||||
@echo "Build finished. The HTML pages are in $(BUILDDIR)/html."
|
||||
|
||||
Loading…
x
Reference in New Issue
Block a user