Skip to content

Commit

Permalink
Merge pull request #5922 from radarhere/releasenotes
Browse files Browse the repository at this point in the history
  • Loading branch information
hugovk authored Jan 1, 2022
2 parents 032d2dc + f6c7871 commit 1efb1d9
Showing 1 changed file with 21 additions and 3 deletions.
24 changes: 21 additions & 3 deletions docs/releasenotes/9.0.0.rst
Original file line number Diff line number Diff line change
Expand Up @@ -100,10 +100,28 @@ argument will also now be supported, e.g. ``im.show(title="My Image")`` and
Security
========

TODO
^^^^
Ensure JpegImagePlugin stops at the end of a truncated file
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^

TODO
``JpegImagePlugin`` may append an EOF marker to the end of a truncated file, so that
the last segment of the data will still be processed by the decoder.

If the EOF marker is not detected as such however, this could lead to an infinite
loop where ``JpegImagePlugin`` keeps trying to end the file.

Remove consecutive duplicate tiles that only differ by their offset
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^

To prevent attempts to slow down loading times for images, if an image has consecutive
duplicate tiles that only differ by their offset, only load the last tile. Credit to
Google's `OSS-Fuzz`_ project for finding this issue.

Fixed ImagePath.Path array handling
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^

CWE-126 and CWE-665 were found when initializing ``ImagePath.Path``.

.. _OSS-Fuzz: https://github.com/google/oss-fuzz

Other Changes
=============
Expand Down

0 comments on commit 1efb1d9

Please sign in to comment.