PNG loading degraded

[Florian Wesch]

PNG loading fails for some/all(?) PNG files with the error message 'IOError: cannot identify image file'

The reason for that seems to be that there's a new check like this in a few chunk handlers:

  self.check_text_memory(len(v))

At this point, len is already used an a number value passed in as parameter (see PngImagePlugin.py:311 in chunk_tEXt) so the builtin function len gets shadowed. The call therefore results in a TypeError:

  TypeError: 'int' object is not callable

Package version is
   python-imaging 2.3.0-1ubuntu3.2 on Ubuntu Trusty Tahr.

[Launchpad Janitor (janitor)]

Status changed to 'Confirmed' because the bug affects multiple users.

[Stephen Early (steve-greenend)]

Confirmed: python-pil 2.3.0-1ubuntu3 works as expected, and python-pil 2.3.0-1ubuntu3.2 fails.

[Aaron Griffith (agrif)]

This bug appears to have been introduced with `pillow-CVE-2014-9601.patch` as part of `2.3.0-1ubuntu3.2`.

This patch was sourced (at least partially) from this Pillow commit:

    https://github.com/python-pillow/Pillow/commit/0b75526ffe41a4697231beb8b5740617c98f290b

However, this commit occurs after an earlier commit that changes all instances of `len` to `length`, to prevent shadowing:

    https://github.com/python-pillow/Pillow/commit/d594c0241aabeda6725fefc44ccc7f945c0464c9

As such, it crashes whenever you try to read any PNG with a text chunk. Since this is specifically the use-case the CVE patch was designed for, I find it surprising that apparently nobody tested it.

I have created and attached a patch for `2.3.0-1ubuntu3.2` that works on the PNG's I've tried. Instead of renaming all instances of `len`, it just does the minimal changes needed to get this to work. It's up to you guys whether you'd rather follow upstream or not, but please fix this fast, because this is a pretty serious bug.

[Ubuntu Foundations Team Bug Bot (crichton)]

The attachment "fix for text chunk loading" seems to be a patch. If it isn't, please remove the "patch" flag from the attachment, remove the "patch" tag, and if you are a member of the ~ubuntu-reviewers, unsubscribe the team.

[This is an automated message performed by a Launchpad user owned by ~brian-murray, for any issues please contact him.]

[Emily Ratliff (emilyr)]

 2.3.0-1ubuntu3.3 was released to address this issue.