Merge pull request matplotlib#32036 from meeseeksmachine/auto-backport-of-pr-31894-on-v3.11.x

Backport PR matplotlib#31894 on branch v3.11.x (check transform mesh shape in _get_transform_mesh)

Author: timhoffm

lib/matplotlib/tests/test_image.py

@@ -1681,6 +1681,23 @@ def test__resample_valid_output():
         resample(np.zeros((9, 9)), out)
 
 
+def test__resample_nonaffine_mesh_shape():
+    # A non-affine transform whose inverse returns the wrong number of mesh
+    # points must be rejected rather than read past the mesh buffer.
+    class BadMeshTransform(Transform):
+        input_dims = output_dims = 2
+
+        def inverted(self):
+            return self
+
+        def transform(self, values):
+            return np.zeros((1, 2))
+
+    with pytest.raises(RuntimeError, match="mesh array should have shape"):
+        mpl._image.resample(np.zeros((9, 9)), np.zeros((9, 9)),
+                            BadMeshTransform())
+
+
 @pytest.mark.parametrize("data, interpolation, expected",
     [(np.array([[0.1, 0.3, 0.2]]), mimage.NEAREST,
       np.array([[0.1, 0.1, 0.1, 0.3, 0.3, 0.3, 0.3, 0.2, 0.2, 0.2]])),

src/_image_wrapper.cpp

@@ -86,6 +86,15 @@ _get_transform_mesh(const py::object& transform, const py::ssize_t *dims)
                 output_mesh_array.ndim()));
     }
 
+    // An undersized mesh would be read out of bounds by the resampler.
+    if (output_mesh_array.shape(0) != mesh_dims[0] ||
+            output_mesh_array.shape(1) != mesh_dims[1]) {
+        throw std::runtime_error(
+            "Inverse transformed mesh array should have shape ({}, {}) not ({}, {})"_s.format(
+                mesh_dims[0], mesh_dims[1],
+                output_mesh_array.shape(0), output_mesh_array.shape(1)));
+    }
+
     return output_mesh_array;
 }