From aa75794d700e2ed98e2d35a7be573a4fc736aca2 Mon Sep 17 00:00:00 2001
From: Andrew Murray <radarhere@users.noreply.github.com>
Date: Thu, 23 Jul 2026 00:30:30 +1000
Subject: [PATCH] Raise UserWarning if tag offset too large

---
 Tests/test_file_tiff_metadata.py | 12 ++++++++++++
 src/PIL/TiffImagePlugin.py       |  3 +++
 2 files changed, 15 insertions(+)

diff --git a/Tests/test_file_tiff_metadata.py b/Tests/test_file_tiff_metadata.py
index 322ef5abcc5..a9a367f88c6 100644
--- a/Tests/test_file_tiff_metadata.py
+++ b/Tests/test_file_tiff_metadata.py
@@ -485,6 +485,18 @@ def test_too_many_entries() -> None:
         assert ifd[277] == 4
 
 
+def test_tag_offset() -> None:
+    ifd = TiffImagePlugin.ImageFileDirectory_v2(b"II\x2b\x00" + b"\x00" * 12)
+
+    tag_count = struct.pack("Q", 1)
+    tag = struct.pack("<HHQQ", 0, 1, 9, 2**63)
+    next_offset = struct.pack("Q", 0)
+
+    f = io.BytesIO(tag_count + tag + next_offset)
+    with pytest.warns(UserWarning, match="Tag offset too large"):
+        ifd.load(f)
+
+
 def test_tag_group_data() -> None:
     base_ifd = TiffImagePlugin.ImageFileDirectory_v2()
     interop_ifd = TiffImagePlugin.ImageFileDirectory_v2(group=40965)
diff --git a/src/PIL/TiffImagePlugin.py b/src/PIL/TiffImagePlugin.py
index c3a1852ab9c..db37ab7e4c9 100644
--- a/src/PIL/TiffImagePlugin.py
+++ b/src/PIL/TiffImagePlugin.py
@@ -912,6 +912,9 @@ def load(self, fp: IO[bytes]) -> None:
                     here = fp.tell()
                     (offset,) = self._unpack("Q" if self._bigtiff else "L", data)
                     msg += f" Tag Location: {here} - Data Location: {offset}"
+                    if offset >= 2**63:
+                        warnings.warn("Tag offset too large")
+                        continue
                     fp.seek(offset)
                     data = ImageFile._safe_read(fp, size)
                     fp.seek(here)