Merge pull request #6431 from radarhere/png_srgb

Raise ValueError if PNG sRGB chunk is truncated
python-pillow · Jul 11, 2022 · 3e852ee · 3e852ee
2 parents 4db2ed3 + 40a0999
commit 3e852ee
Show file tree

Hide file tree

Showing 2 changed files with 7 additions and 1 deletion.
diff --git a/Tests/test_file_png.py b/Tests/test_file_png.py
@@ -635,7 +635,9 @@ def test_padded_idat(self):
 
             assert_image_equal_tofile(im, "Tests/images/bw_gradient.png")
 
-    @pytest.mark.parametrize("cid", (b"IHDR", b"pHYs", b"acTL", b"fcTL", b"fdAT"))
+    @pytest.mark.parametrize(
+        "cid", (b"IHDR", b"sRGB", b"pHYs", b"acTL", b"fcTL", b"fdAT")
+    )
     def test_truncated_chunks(self, cid):
         fp = BytesIO()
         with PngImagePlugin.PngStream(fp) as png:

diff --git a/src/PIL/PngImagePlugin.py b/src/PIL/PngImagePlugin.py
@@ -509,6 +509,10 @@ def chunk_sRGB(self, pos, length):
         # 3 absolute colorimetric
 
         s = ImageFile._safe_read(self.fp, length)
+        if length < 1:
+            if ImageFile.LOAD_TRUNCATED_IMAGES:
+                return s
+            raise ValueError("Truncated sRGB chunk")
         self.im_info["srgb"] = s[0]
         return s