Skip to content

Commit 94cc03e

Browse files
authored
Avoid divide-by-zero crash in RankFilter (#9755)
2 parents 5638dca + 9f7010d commit 94cc03e

3 files changed

Lines changed: 14 additions & 1 deletion

File tree

Tests/test_image_filter.py

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -228,3 +228,13 @@ def test_invalid_box_blur_filter(radius: int | tuple[int, int]) -> None:
228228
box_blur_filter.radius = radius
229229
with pytest.raises(ValueError):
230230
im.filter(box_blur_filter)
231+
232+
233+
def test_rankfilter_size_1() -> None:
234+
im = Image.new("L", (3, 3), 128)
235+
236+
# Size 1 should not crash (margin is 0)
237+
assert im.filter(ImageFilter.MinFilter(1)).getpixel((1, 1)) == 128
238+
assert im.filter(ImageFilter.MaxFilter(1)).getpixel((1, 1)) == 128
239+
assert im.filter(ImageFilter.MedianFilter(1)).getpixel((1, 1)) == 128
240+
assert im.filter(ImageFilter.RankFilter(1, 0)).getpixel((1, 1)) == 128

src/_imaging.c

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1115,6 +1115,9 @@ _expand_image(ImagingObject *self, PyObject *args) {
11151115
return NULL;
11161116
}
11171117

1118+
if (m == 0) {
1119+
return PyImagingNew(ImagingCopy(self->image));
1120+
}
11181121
return PyImagingNew(ImagingExpand(self->image, m));
11191122
}
11201123

src/libImaging/Filter.c

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -56,7 +56,7 @@ ImagingExpand(Imaging imIn, int margin) {
5656
if (margin < 0) {
5757
return (Imaging)ImagingError_ValueError("bad kernel size");
5858
}
59-
if (margin > INT_MAX / (margin * (int)sizeof(FLOAT32))) {
59+
if (margin > 0 && margin > INT_MAX / (margin * (int)sizeof(FLOAT32))) {
6060
return (Imaging)ImagingError_ValueError("filter size too large");
6161
}
6262

0 commit comments

Comments
 (0)