GHSA-4558-3H8R-V8XP Pillow: P;2L and P;4L decoders may read 1 to 3 bytes past the passed buffer size

Summary On main, even with the guard in 9725, it's possible to have these decoders read 1 to 3 bytes past the end of the passed buffer with a suitable width/height. Details ImagingRawDecode and the P;2L / P;4L unpackers disagree about how many bytes a line of data occupies. The raw decoder derive...

Pillow: P;2L and P;4L decoders may read 1 to 3 bytes past the passed buffer size

Summary On main, even with the guard in 9725, it's possible to have these decoders read 1 to 3 bytes past the end of the passed buffer with a suitable width/height. Details ImagingRawDecode and the P;2L / P;4L unpackers disagree about how many bytes a line of data occupies. The raw decoder derive...