Raise UserWarning if TIFF tag offset too large

Tests/test_file_tiff_metadata.py

@@ -485,6 +485,18 @@ def test_too_many_entries() -> None:
         assert ifd[277] == 4
 
 
+def test_tag_offset() -> None:
+    ifd = TiffImagePlugin.ImageFileDirectory_v2(b"II\x2b\x00" + b"\x00" * 12)
+
+    tag_count = struct.pack("Q", 1)
+    tag = struct.pack("<HHQQ", 0, 1, 9, 2**63)
+    next_offset = struct.pack("Q", 0)
+
+    f = io.BytesIO(tag_count + tag + next_offset)
+    with pytest.warns(UserWarning, match="Tag offset too large"):
+        ifd.load(f)
+
+
 def test_tag_group_data() -> None:
     base_ifd = TiffImagePlugin.ImageFileDirectory_v2()
     interop_ifd = TiffImagePlugin.ImageFileDirectory_v2(group=40965)

src/PIL/TiffImagePlugin.py

@@ -912,6 +912,9 @@ def load(self, fp: IO[bytes]) -> None:
                     here = fp.tell()
                     (offset,) = self._unpack("Q" if self._bigtiff else "L", data)
                     msg += f" Tag Location: {here} - Data Location: {offset}"
+                    if offset >= 2**63:
+                        warnings.warn("Tag offset too large")
+                        continue
                     fp.seek(offset)
                     data = ImageFile._safe_read(fp, size)
                     fp.seek(here)