Fix OOB read in getlist() and putdata() when __len__ overstates length

Tests/test_image_point.py

@@ -2,6 +2,8 @@
 
 import pytest
 
+from PIL import Image
+
 from .helper import assert_image_equal, hopper
 
 
@@ -62,3 +64,59 @@ def test_f_mode() -> None:
     im = hopper("F")
     with pytest.raises(ValueError):
         im.point([])
+
+
+def test_overstated_length() -> None:
+    # shouldn't segfault
+    # see https://github.com/python-pillow/Pillow/issues/9892
+
+    class OverstatedLengthSequence:
+        def __len__(self) -> int:
+            return 256
+
+        def __getitem__(self, index: int) -> float:
+            if index >= 8:
+                raise IndexError
+            return float(index)
+
+    im = Image.new("L", (4, 4))
+    with pytest.raises(ValueError):
+        im.point(OverstatedLengthSequence(), "F")  # type: ignore[arg-type]
+
+
+def test_unsized_sequence() -> None:
+    # a table that only implements __getitem__ (no __len__) is a common shape
+    # for custom point tables; PySequence_Size() fails for it, so the cheap
+    # pre-check must fall back to materializing instead of erroring out
+    class UnsizedSequence:
+        def __getitem__(self, index: int) -> float:
+            if index >= 256:
+                raise IndexError
+            return float(index)
+
+    im = Image.new("L", (4, 4))
+    out = im.point(UnsizedSequence(), "F")  # type: ignore[arg-type]
+    assert_image_equal(out, im.point(list(range(256)), "F"))
+
+
+def test_raising_length() -> None:
+    # only the TypeError from an unsized sequence may be swallowed by the
+    # pre-check; any other error from __len__ has to reach the caller
+    class RaisingLengthSequence:
+        def __init__(self) -> None:
+            self.calls = 0
+
+        def __len__(self) -> int:
+            self.calls += 1
+            if self.calls == 1:
+                raise RuntimeError
+            return 256
+
+        def __getitem__(self, index: int) -> float:
+            if index >= 256:
+                raise IndexError
+            return float(index)
+
+    im = Image.new("L", (4, 4))
+    with pytest.raises(RuntimeError):
+        im.point(RaisingLengthSequence(), "F")  # type: ignore[arg-type]

Tests/test_image_putdata.py

@@ -99,6 +99,70 @@ def test_array_F() -> None:
     assert len(im.get_flattened_data()) == len(arr)
 
 
+def test_overstated_length() -> None:
+    # shouldn't segfault
+    # see https://github.com/python-pillow/Pillow/issues/9892
+
+    class OverstatedLengthSequence:
+        def __len__(self) -> int:
+            return 16
+
+        def __getitem__(self, index: int) -> float:
+            if index >= 2:
+                raise IndexError
+            return float(index + 1)
+
+    im = Image.new("L", (4, 4))
+    im.putdata(OverstatedLengthSequence())  # type: ignore[arg-type]
+    assert im.get_flattened_data()[:2] == (1, 2)
+
+
+def test_too_many_entries() -> None:
+    # an honest, correctly-reported sequence that is simply longer than the
+    # image still has to be rejected, before or after materialization
+    im = Image.new("L", (4, 4))
+    with pytest.raises(TypeError):
+        im.putdata(list(range(17)))
+
+
+def test_unsized_sequence() -> None:
+    # a sequence that only implements __getitem__ (no __len__) is common for
+    # custom point-table-like objects; PySequence_Size() fails for it, so the
+    # cheap pre-check must fall back to materializing instead of erroring out
+    class UnsizedSequence:
+        def __getitem__(self, index: int) -> int:
+            if index >= 4:
+                raise IndexError
+            return index
+
+    im = Image.new("L", (2, 2))
+    im.putdata(UnsizedSequence())  # type: ignore[arg-type]
+    assert im.get_flattened_data() == (0, 1, 2, 3)
+
+
+def test_raising_length() -> None:
+    # only the TypeError from an unsized sequence may be swallowed by the
+    # pre-check; any other error from __len__ has to reach the caller
+    class RaisingLengthSequence:
+        def __init__(self) -> None:
+            self.calls = 0
+
+        def __len__(self) -> int:
+            self.calls += 1
+            if self.calls == 1:
+                raise RuntimeError
+            return 4
+
+        def __getitem__(self, index: int) -> int:
+            if index >= 4:
+                raise IndexError
+            return index
+
+    im = Image.new("L", (2, 2))
+    with pytest.raises(RuntimeError):
+        im.putdata(RaisingLengthSequence())  # type: ignore[arg-type]
+
+
 def test_not_flattened() -> None:
     im = Image.new("L", (1, 1))
     with pytest.raises(TypeError):

src/_imaging.c

@@ -443,25 +443,39 @@ getlist_impl(PyObject *arg, Py_ssize_t *length, const char *wrong_length, int ty
         return NULL;
     }
 
-    n = PySequence_Size(arg);
+    if (length && wrong_length) {
+        Py_ssize_t reported = PySequence_Size(arg);
+        if (reported < 0) {
+            if (!PyErr_ExceptionMatches(PyExc_TypeError)) {
+                return NULL;
+            }
+            PyErr_Clear();
+        } else if (reported != *length) {
+            PyErr_SetString(PyExc_ValueError, wrong_length);
+            return NULL;
+        }
+    }
+
+    seq = PySequence_Fast(arg, must_be_sequence);
+    if (!seq) {
+        return NULL;
+    }
+
+    n = PySequence_Fast_GET_SIZE(seq);
     if (length && wrong_length && n != *length) {
         PyErr_SetString(PyExc_ValueError, wrong_length);
+        Py_DECREF(seq);
         return NULL;
     }
 
     /* malloc check ok, type & ff is just a sizeof(something)
        calloc checks for overflow */
     list = calloc(n, type & 0xff);
     if (!list) {
+        Py_DECREF(seq);
         return ImagingError_MemoryError();
     }
 
-    seq = PySequence_Fast(arg, must_be_sequence);
-    if (!seq) {
-        free(list);
-        return NULL;
-    }
-
     for (i = 0; i < n; i++) {
         op = PySequence_Fast_GET_ITEM(seq, i);
         // DRY, branch prediction is going to work _really_ well
@@ -1636,8 +1650,28 @@ _putdata(ImagingObject *self, PyObject *args) {
 
     image = self->image;
 
-    n = PyObject_Length(data);
+    if (image->image8 && PyBytes_Check(data)) {
+        n = PyBytes_GET_SIZE(data);
+    } else {
+        Py_ssize_t reported = PySequence_Size(data);
+        if (reported < 0) {
+            if (!PyErr_ExceptionMatches(PyExc_TypeError)) {
+                return NULL;
+            }
+            PyErr_Clear();
+        } else if (reported > (Py_ssize_t)image->xsize * (Py_ssize_t)image->ysize) {
+            PyErr_SetString(PyExc_TypeError, "too many data entries");
+            return NULL;
+        }
+
+        seq = PySequence_Fast(data, must_be_sequence);
+        if (!seq) {
+            return NULL;
+        }
+        n = PySequence_Fast_GET_SIZE(seq);
+    }
     if (n > (Py_ssize_t)image->xsize * (Py_ssize_t)image->ysize) {
+        Py_XDECREF(seq);
         PyErr_SetString(PyExc_TypeError, "too many data entries");
         return NULL;
     }
@@ -1678,10 +1712,6 @@ _putdata(ImagingObject *self, PyObject *args) {
                 }
             }
         } else {
-            seq = PySequence_Fast(data, must_be_sequence);
-            if (!seq) {
-                return NULL;
-            }
             double value;
             int bigendian = 0;
             if (image->type == IMAGING_TYPE_I16) {
@@ -1715,10 +1745,6 @@ _putdata(ImagingObject *self, PyObject *args) {
         }
     } else {
         /* 32-bit images */
-        seq = PySequence_Fast(data, must_be_sequence);
-        if (!seq) {
-            return NULL;
-        }
         switch (image->type) {
             case IMAGING_TYPE_INT32:
                 for (i = x = y = 0; i < n; i++) {