Skip to content

Conversation

@radarhere
Copy link
Member

Within path_map(), a Python function is called.

Pillow/src/path.c

Lines 393 to 404 in 55a25aa

xy = self->xy;
/* apply function to coordinate set */
for (i = 0; i < self->count; i++) {
double x = xy[i + i];
double y = xy[i + i + 1];
PyObject *item = PyObject_CallFunction(function, "dd", x, y);
if (!item || !PyArg_ParseTuple(item, "dd", &x, &y)) {
Py_XDECREF(item);
return NULL;
}
xy[i + i] = x;

That Python function could, theoretically, make a call to ImagePath.Path.compact(), aka path_compact(), reallocating self->xy.

self->xy = realloc(self->xy, 2 * self->count * sizeof(double));

It would then be incorrect for xy to be accessed again by path_map().

I've added a flag to PyPathObject that is set at the start of the mapping loop, and cleared at the end. If the user's custom Python function calls compact() to reallocate the array in the middle, then a ValueError is raised.

@hugovk hugovk merged commit 07389b2 into python-pillow:main Oct 1, 2024
49 checks passed
@radarhere radarhere deleted the compact_within_map branch October 1, 2024 11:05
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants