ImagingResampleHorizontal mallocs two buffers:
kk = malloc(xsize * kmax * sizeof(float));
...
xbounds = malloc(xsize * 2 * sizeof(int));
xsize is trusted user input. These multiplications can overflow, leading the malloc'd buffer to be undersized. These allocations are followed by a loop that writes out of bounds. This can lead to corruption on the heap of the Python process with attacker controlled data (exploiting this would be really cool, as the loop contains some serious floaty arithmetic). It's possible someone has an image resizing service using Pillow. :)
See the following proof of concept:
from PIL import Image
im = Image.open("cat.jpg").convert("L")
xsize = 0x100000008 / 4
ysize = 0x1337 # unrelated
im.im.resize((xsize, ysize), Image.LINEAR) # any resampling filter will do here
where "cat.jpg" is your favorite valid cat picture.
ImagingResampleHorizontalmallocs two buffers:xsizeis trusted user input. These multiplications can overflow, leading the malloc'd buffer to be undersized. These allocations are followed by a loop that writes out of bounds. This can lead to corruption on the heap of the Python process with attacker controlled data (exploiting this would be really cool, as the loop contains some serious floaty arithmetic). It's possible someone has an image resizing service using Pillow. :)See the following proof of concept:
where "cat.jpg" is your favorite valid cat picture.