Skip to content

Reject non-numeric elements inside list coords#9526

Open
hugovk wants to merge 1 commit intopython-pillow:mainfrom
hugovk:assign_item_to_array
Open

Reject non-numeric elements inside list coords#9526
hugovk wants to merge 1 commit intopython-pillow:mainfrom
hugovk:assign_item_to_array

Conversation

@hugovk
Copy link
Copy Markdown
Member

@hugovk hugovk commented Apr 1, 2026

No description provided.

@hugovk hugovk force-pushed the assign_item_to_array branch from 1056c63 to 55b880b Compare April 1, 2026 08:27
@radarhere radarhere added the 🤖-assisted AI-assisted label Apr 1, 2026
Co-authored-by: Andrew Murray <3112309+radarhere@users.noreply.github.com>
@hugovk hugovk force-pushed the assign_item_to_array branch from 55b880b to 7abe38d Compare April 1, 2026 08:32
and :py:meth:`~PIL.ImageDraw.ImageDraw.line` could cause a heap buffer overflow,
as nested lists were recursively unpacked beyond the allocated buffer.
Coordinate lists are now validated to contain exactly two numeric coordinates.
This was introduced in Pillow 12.0.0.
Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
This was introduced in Pillow 12.0.0.
This was introduced in Pillow 11.2.1.

I think this was actually introduced in #8800 in 11.2.1

Copy link
Copy Markdown
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks, will let the current CI pass then add this and merge.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

🤖-assisted AI-assisted

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants