From 9af332ef2b27bc54fcf34f6c84de21d27d8c0065 Mon Sep 17 00:00:00 2001 From: Andrew Murray Date: Sat, 25 Jul 2026 16:21:07 +1000 Subject: [PATCH] Do not read any further than necessary --- src/PIL/BmpImagePlugin.py | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/src/PIL/BmpImagePlugin.py b/src/PIL/BmpImagePlugin.py index 907931b926e..24344e876eb 100644 --- a/src/PIL/BmpImagePlugin.py +++ b/src/PIL/BmpImagePlugin.py @@ -371,19 +371,20 @@ def decode(self, buffer: Image.DecoderInput) -> tuple[int, int]: x = len(data) % self.state.xsize else: # absolute mode + data_count = min(dest_length - len(data), byte[0]) if rle4: # 2 pixels per byte, padded up to a whole byte - byte_count = (byte[0] + 1) // 2 + byte_count = (data_count + 1) // 2 bytes_read = self.fd.read(byte_count) for i, byte_read in enumerate(bytes_read): data += o8(byte_read >> 4) - if 2 * i + 1 < byte[0]: + if i * 2 + 1 < data_count: data += o8(byte_read & 0x0F) else: - byte_count = byte[0] + byte_count = data_count bytes_read = self.fd.read(byte_count) data += bytes_read - if len(bytes_read) < byte_count: + if len(bytes_read) < byte_count or len(data) == dest_length: break x += byte[0]