From 80bdd470c917f5d419a881a725677e3dcf5f40a5 Mon Sep 17 00:00:00 2001 From: Andrew Murray Date: Thu, 23 Jul 2026 23:20:58 +1000 Subject: [PATCH] Consider new position, not just offset --- Tests/test_file_jpeg2k.py | 2 +- src/PIL/Jpeg2KImagePlugin.py | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/Tests/test_file_jpeg2k.py b/Tests/test_file_jpeg2k.py index 0f045fba1ba..6cfbcd269f7 100644 --- a/Tests/test_file_jpeg2k.py +++ b/Tests/test_file_jpeg2k.py @@ -234,7 +234,7 @@ def test_oversized_box_length() -> None: data = ( b"\x00\x00\x00\x0cjP \x0d\x0a\x87\x0a" # JP2 signature box + struct.pack(">I4s", 1, b"") # box with 64-bit length - + struct.pack(">Q", 16 + 2**63) # length beyond the seek range + + struct.pack(">Q", 2**63 - 12) # length beyond the seek range ) with pytest.raises(SyntaxError, match="Box length too large"): Jpeg2KImagePlugin.Jpeg2KImageFile(BytesIO(data)) diff --git a/src/PIL/Jpeg2KImagePlugin.py b/src/PIL/Jpeg2KImagePlugin.py index e2f70d11fdd..9941e6deb9c 100644 --- a/src/PIL/Jpeg2KImagePlugin.py +++ b/src/PIL/Jpeg2KImagePlugin.py @@ -83,7 +83,7 @@ def has_next_box(self) -> bool: def next_box_type(self) -> bytes: # Skip the rest of the box if it has not been read if self.remaining_in_box > 0: - if self.remaining_in_box >= 2**63: + if self.fp.tell() + self.remaining_in_box >= 2**63: msg = "Box length too large" raise SyntaxError(msg) self.fp.seek(self.remaining_in_box, os.SEEK_CUR)