When reading past the end of a scan line, reduce bytes left

radarhere · hugovk · commit c846cc881ebe · 2022-05-17T13:17:18.000+03:00
diff --git a/Tests/images/cross_scan_line_truncated.tga b/Tests/images/cross_scan_line_truncated.tga
diff --git a/Tests/test_file_tga.py b/Tests/test_file_tga.py
@@ -101,6 +101,10 @@ def test_cross_scan_line():
     with Image.open("Tests/images/cross_scan_line.tga") as im:
         assert_image_equal_tofile(im, "Tests/images/cross_scan_line.png")
 
+    with Image.open("Tests/images/cross_scan_line_truncated.tga") as im:
+        with pytest.raises(OSError):
+            im.load()
+
 
 def test_save(tmp_path):
     test_file = "Tests/images/tga_id_field.tga"
diff --git a/src/libImaging/TgaRleDecode.c b/src/libImaging/TgaRleDecode.c
@@ -120,6 +120,7 @@ ImagingTgaRleDecode(Imaging im, ImagingCodecState state, UINT8 *buf, Py_ssize_t
             }
             memcpy(state->buffer + state->x, ptr, n);
             ptr += n;
+            bytes -= n;
             extra_bytes -= n;
         }
     }

Original file line number	Diff line number	Diff line change
`@@ -120,6 +120,7 @@ ImagingTgaRleDecode(Imaging im, ImagingCodecState state, UINT8 *buf, Py_ssize_t`
`120`	`120`	`}`
`121`	`121`	`memcpy(state->buffer + state->x, ptr, n);`
`122`	`122`	`ptr += n;`
	`123`	`+ bytes -= n;`
`123`	`124`	`extra_bytes -= n;`
`124`	`125`	`}`
`125`	`126`	`}`