Raise error when WMF inch is zero

radarhere · Dec 15, 2024 · a11ed50 · a11ed50
1 parent a7338f8
commit a11ed50
Show file tree

Hide file tree

Showing 2 changed files with 10 additions and 0 deletions.
diff --git a/Tests/test_file_wmf.py b/Tests/test_file_wmf.py
@@ -35,6 +35,13 @@ def test_load() -> None:
             assert im.load()[0, 0] == (255, 255, 255)
 
 
+def test_load_zero_inch() -> None:
+    b = BytesIO(b"\xd7\xcd\xc6\x9a\x00\x00" + b"\x00" * 10)
+    with pytest.raises(ValueError):
+        with Image.open(b):
+            pass
+
+
 def test_register_handler(tmp_path: Path) -> None:
     class TestHandler(ImageFile.StubHandler):
         methodCalled = False

diff --git a/src/PIL/WmfImagePlugin.py b/src/PIL/WmfImagePlugin.py
@@ -92,6 +92,9 @@ def _open(self) -> None:
 
             # get units per inch
             self._inch = word(s, 14)
+            if self._inch == 0:
+                msg = "Invalid inch"
+                raise ValueError(msg)
 
             # get bounding box
             x0 = short(s, 6)