Bug 903664

Summary:	<dev-python/pillow-9.5.0: two security issues
Product:	Gentoo Security	Reporter:	Michał Górny <mgorny>
Component:	Vulnerabilities	Assignee:	Gentoo Security <security>
Status:	IN_PROGRESS ---
Severity:	normal	CC:	python
Priority:	Normal
Version:	unspecified
Hardware:	All
OS:	Linux
URL:	https://pillow.readthedocs.io/en/stable/releasenotes/9.5.0.html#security
Whiteboard:	A3 [glsa]
Package list:		Runtime testing required:	---
Bug Depends on:	903663
Bug Blocks:

Description Michał Górny archtester

2023-04-01 16:11:19 UTC

From release notes:

Clear PPM half token after use
==============================
Image files that are small on disk are often prevented from expanding to be big images consuming a large amount of resources simply because they lack the data to populate those resources.

PpmImagePlugin might hold onto the last data read for a pixel value in case the pixel value has not been finished yet. However, that data was not being cleared afterwards, meaning that infinite data could be available to fill any image size. This has been present since Pillow 9.2.0.

That data is now cleared after use.

Saving TIFF tag ImageSourceData
===============================
If Pillow incorrectly saved the TIFF tag ImageSourceData as ASCII instead of UNDEFINED, a segmentation fault was triggered.

The correct tag type will now be used by default instead.