diff --git a/Tests/test_file_tiff_metadata.py b/Tests/test_file_tiff_metadata.py index 322ef5abcc5..a9a367f88c6 100644 --- a/Tests/test_file_tiff_metadata.py +++ b/Tests/test_file_tiff_metadata.py @@ -485,6 +485,18 @@ def test_too_many_entries() -> None: assert ifd[277] == 4 +def test_tag_offset() -> None: + ifd = TiffImagePlugin.ImageFileDirectory_v2(b"II\x2b\x00" + b"\x00" * 12) + + tag_count = struct.pack("Q", 1) + tag = struct.pack(" None: base_ifd = TiffImagePlugin.ImageFileDirectory_v2() interop_ifd = TiffImagePlugin.ImageFileDirectory_v2(group=40965) diff --git a/src/PIL/TiffImagePlugin.py b/src/PIL/TiffImagePlugin.py index c3a1852ab9c..db37ab7e4c9 100644 --- a/src/PIL/TiffImagePlugin.py +++ b/src/PIL/TiffImagePlugin.py @@ -912,6 +912,9 @@ def load(self, fp: IO[bytes]) -> None: here = fp.tell() (offset,) = self._unpack("Q" if self._bigtiff else "L", data) msg += f" Tag Location: {here} - Data Location: {offset}" + if offset >= 2**63: + warnings.warn("Tag offset too large") + continue fp.seek(offset) data = ImageFile._safe_read(fp, size) fp.seek(here)