#4317: Fix an Array Bounds Read in imageop.rgb2rgb8.
Will backport to 2.4.
diff --git a/Lib/test/test_imageop.py b/Lib/test/test_imageop.py
index 6deaa34..9063b22 100755
--- a/Lib/test/test_imageop.py
+++ b/Lib/test/test_imageop.py
@@ -15,6 +15,7 @@
_VALUES = (1, 2, 2**10, 2**15-1, 2**15, 2**15+1, 2**31-2, 2**31-1)
VALUES = tuple( -x for x in reversed(_VALUES) ) + (0,) + _VALUES
AAAAA = "A" * 1024
+MAX_LEN = 2**20
class InputValidationTests(unittest.TestCase):
@@ -26,7 +27,7 @@
strlen = abs(width * height)
if size:
strlen *= size
- if strlen < 1024:
+ if strlen < MAX_LEN:
data = "A" * strlen
else:
data = AAAAA
diff --git a/Misc/NEWS b/Misc/NEWS
index 1012541..d84ec84 100644
--- a/Misc/NEWS
+++ b/Misc/NEWS
@@ -12,6 +12,8 @@
Core and Builtins
-----------------
+- Issue #4317: Fixed a crash in the imageop.rgb2rgb8() function.
+
- Issue #4230: If ``__getattr__`` is a descriptor, it now functions correctly.
- Issue #4048: The parser module now correctly validates relative imports.
diff --git a/Modules/imageop.c b/Modules/imageop.c
index 61a0c2f..8d0d68f 100644
--- a/Modules/imageop.c
+++ b/Modules/imageop.c
@@ -590,7 +590,7 @@
if ( !PyArg_ParseTuple(args, "s#ii", &cp, &len, &x, &y) )
return 0;
- if ( !check_multiply_size(len*4, x, "x", y, "y", 4) )
+ if ( !check_multiply_size(len, x, "x", y, "y", 4) )
return 0;
nlen = x*y;
if ( !check_multiply(nlen, x, y) )