Pillow fails to open small PNGs with "Decompressed Data Too Large" - PIL opens successfully

[ccazabon]

What did you do?

Calling Image.load() on a file containing a 230x230 8-bit RGB PNG image.

What did you expect to happen?

Image successfully opened.

What actually happened?

An exception "ValueError: Decompressed Data Too Large" is thrown. Interestingly, PIL 2.3.0 successfully opens the same images. The images appear fine and open successfully in other software as well.

Relevant portion of the stack trace is:

File '.../<application>.py', line 533 in thumbnail
  img = PIL.Image.open(filename)
File '.../Pillow-3.2.0-py2.7-linux-x86_64.egg/PIL/Image.py', line 2299 in open
  im = _open_core(fp, filename, prefix)
File '.../Pillow-3.2.0-py2.7-linux-x86_64.egg/PIL/Image.py', line 2289 in _open_core
  im = factory(fp, filename)
File '.../Pillow-3.2.0-py2.7-linux-x86_64.egg/PIL/ImageFile.py', line 97 in __init__
  self._open()
File '.../Pillow-3.2.0-py2.7-linux-x86_64.egg/PIL/PngImagePlugin.py', line 507 in _open
  s = self.png.call(cid, pos, length)
File '.../Pillow-3.2.0-py2.7-linux-x86_64.egg/PIL/PngImagePlugin.py', line 136 in call
  return getattr(self, "chunk_" + cid.decode('ascii'))(pos, length)
File '.../Pillow-3.2.0-py2.7-linux-x86_64.egg/PIL/PngImagePlugin.py', line 305 in chunk_iCCP
  icc_profile = _safe_zlib_decompress(s[i+2:])
File '.../Pillow-3.2.0-py2.7-linux-x86_64.egg/PIL/PngImagePlugin.py', line 90 in _safe_zlib_decompress
  raise ValueError("Decompressed Data Too Large")
ValueError: Decompressed Data Too Large

What versions of Pillow and Python are you using?

64-bit Python 2.7 on x86_64 Linux.

Problem occurs with both Pillow 3.2.0, and newest release Pillow 4.0.0.

Sample image demonstrating the problem attached.

[wiredfool]

That's a tiny image with huge metadata. It's 1.3 megs on disk, including a compressed icc profile that decompresses to 1.8 megs. Pillow limits metadata size to protect against decompression bombs. http://pillow.readthedocs.io/en/4.0.x/handbook/image-file-formats.html?highlight=decompression#png

If you set ImageFile.LOAD_TRUNCATED_IMAGES to true, it will suppress the error (but still not read the large metadata). Alternately, you can change set the values here: https://github.com/python-pillow/Pillow/blob/master/PIL/PngImagePlugin.py#L74

[ccazabon]

We run into this problem with client-uploaded files regularly; it's not just one client or one bad image. I don't know what software they're using (I haven't looked at the metadata), but it must be fairly common.

I'll bump MAX_TEXT_CHUNK to something larger but still reasonable. Thanks.

[ccazabon]

For what it's worth, I already had LOAD_TRUNCATED_IMAGES set when these exceptions are thrown.

[hugovk]

This was introduced by this PR #1060 for this CVE https://www.cvedetails.com/cve/CVE-2014-9601/

---

Also ImageMagick has problems with that image:

$ identify /tmp/54f95752-0312-11e7-9ac9-0ebd4f8d03fb.png 
/tmp/54f95752-0312-11e7-9ac9-0ebd4f8d03fb.png PNG 230x230 230x230+0+0 8-bit sRGB 1.388MB 0.020u 0:02.009
identify: iCCP: profile 'ICC Profile': 'CMYK': invalid ICC profile color space `/tmp/54f95752-0312-11e7-9ac9-0ebd4f8d03fb.png' @ warning/png.c/MagickPNGWarningHandler/1656.

ExifTool says:

$ exiftool 54f95752-0312-11e7-9ac9-0ebd4f8d03fb.png 
ExifTool Version Number         : 10.40
File Name                       : 54f95752-0312-11e7-9ac9-0ebd4f8d03fb.png
Directory                       : .
File Size                       : 1355 kB
File Modification Date/Time     : 2017:03:07 16:44:54+02:00
File Access Date/Time           : 2017:03:07 22:03:01+02:00
File Inode Change Date/Time     : 2017:03:07 21:25:32+02:00
File Permissions                : rw-r--r--
File Type                       : PNG
File Type Extension             : png
MIME Type                       : image/png
Image Width                     : 230
Image Height                    : 230
Bit Depth                       : 8
Color Type                      : RGB
Compression                     : Deflate/Inflate
Filter                          : Adaptive
Interlace                       : Noninterlaced
Profile Name                    : ICC Profile
Profile CMM Type                : 
Profile Version                 : 2.4.0
Profile Class                   : Output Device Profile
Color Space Data                : CMYK
Profile Connection Space        : Lab
Profile Date Time               : 2009:04:22 10:00:00
Profile File Signature          : acsp
Primary Platform                : Unknown ()
CMM Flags                       : Not Embedded, Independent
Device Manufacturer             : 
Device Model                    : 
Device Attributes               : Reflective, Glossy, Positive, Color
Rendering Intent                : Perceptual
Connection Space Illuminant     : 0.9642 1 0.82491
Profile Creator                 : HDM
Profile ID                      : fa354010a03bb6e606d2fe88447a5669
A To B0                         : (Binary data 396852 bytes, use -b option to extract)
A To B1                         : (Binary data 396852 bytes, use -b option to extract)
A To B2                         : (Binary data 396852 bytes, use -b option to extract)
B To A0                         : (Binary data 291132 bytes, use -b option to extract)
B To A1                         : (Binary data 291132 bytes, use -b option to extract)
B To A2                         : (Binary data 291132 bytes, use -b option to extract)
Profile Copyright               : This profile is made available by ECI European Color Initiative, with permission of Heidelberger Druckmaschinen AG, and may be used, embedded, exchanged, and shared without restriction. It may not be altered or sold without written permission of ECI European Color Initiative. Color Tool 3.5.0 - (c) Copyright 2000-2008 Heidelberger Druckmaschinen AG. All Rights Reserved.
Profile Description             : PSO Uncoated ISO12647 (ECI)
Gamut                           : (Binary data 33840 bytes, use -b option to extract)
Gray Tone Reproduction Curve    : (Binary data 524 bytes, use -b option to extract)
Char Target                     : (Binary data 126675 bytes, use -b option to extract)
Media White Point               : 0.84589 0.8774 0.74747
Image Size                      : 230x230
Megapixels                      : 0.053