Skip to content

Fix OOB read in getlist() and putdata() when __len__ overstates length - #9893

Open
lazerg wants to merge 2 commits into
python-pillow:mainfrom
lazerg:fix/issue-9892-getlist-putdata-oob-read
Open

Fix OOB read in getlist() and putdata() when __len__ overstates length#9893
lazerg wants to merge 2 commits into
python-pillow:mainfrom
lazerg:fix/issue-9892-getlist-putdata-oob-read

Conversation

@lazerg

@lazerg lazerg commented Aug 23, 2026

Copy link
Copy Markdown

Fixes #9892.

Changes proposed in this pull request:

  • getlist() and _putdata() read the sequence length before calling PySequence_Fast(). A custom sequence whose __len__ reports more items than __getitem__ actually produces makes the later loop read past the materialized list, which segfaults.
  • Both functions now take the length from the materialized PySequence_Fast result instead, so they never index past what was actually built.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

getlist()/_putdata(): OOB read when __len__ overstates materialized items

1 participant