Reachable assert in FtexImagePlugin.py

[nevercodecorrect]

Hi,

What did you do?

In testing the Image.open(), I found a minor issue with a reachable assert that is inconsistent with the code's primary use of raising an error. I am wondering whether this is intended.

What did you expect to happen?

Pillow should reject the unsupported/malformed FTEX file using its normal image-format error handling, such as raising UnidentifiedImageError.
An explicit check raising SyntaxError may be appropriate here because Image.open() treats that as a plugin rejecting the input:

if format_count != 1:
       msg = f"Unsupported FTEX format count: {format_count}"
       raise SyntaxError(msg)

What actually happened?

FtexImagePlugin._open() raises an uncaught AssertionError:

  Traceback (most recent call last):
    File "repro.py", line 9, in <module>
      Image.open(io.BytesIO(data))
    File ".../PIL/Image.py", line 3693, in open
      im = _open_core(
    File ".../PIL/Image.py", line 3673, in _open_core
      im = factory(fp, filename)
    File ".../PIL/ImageFile.py", line 150, in __init__
      self._open()
    File ".../PIL/FtexImagePlugin.py", line 85, in _open
      assert format_count == 1
  AssertionError

What are your OS, Python and Pillow versions?

• OS: Ubuntu 22.04.5
• Python: 3.10.12
• Pillow: 12.2.0

 --------------------------------------------------------------------
  Pillow 12.2.0
  Python 3.10.12 (main, Jun 22 2026, 18:55:27) [GCC 11.4.0]
  --------------------------------------------------------------------
  Python executable is /usr/bin/python3
  System Python files loaded from /usr
  --------------------------------------------------------------------
  Python Pillow modules loaded from /home/xxxx/.local/lib/python3.10/site-packages/PIL
  Binary Pillow modules loaded from /home/xxxx/.local/lib/python3.10/site-packages/PIL
  --------------------------------------------------------------------
  --- PIL CORE support ok, compiled for 12.2.0
  *** TKINTER support not installed
  --- FREETYPE2 support ok, loaded 2.14.3
  --- LITTLECMS2 support ok, loaded 2.18
  --- WEBP support ok, loaded 1.6.0
  --- AVIF support ok, loaded 1.4.1
  --- JPEG support ok, compiled for libjpeg-turbo 3.1.4.1
  --- OPENJPEG (JPEG2000) support ok, loaded 2.5.4
  --- ZLIB (PNG/ZIP) support ok, loaded 1.2.11, compiled for zlib-ng 2.3.3
  --- LIBTIFF support ok, loaded 4.7.1
  --- RAQM (Bidirectional Text) support ok, loaded 0.10.3,
      fribidi 1.0.8, harfbuzz 13.2.1
  *** LIBIMAGEQUANT support not installed
  --- XCB support ok
  --------------------------------------------------------------------

import io
import struct
from PIL import Image
# FTEX header:
# magic, version, width, height, mipmap_count, format_count,
# compression format, data offset
data = struct.pack(
      "<4s7i",
      b"FTEX",
      1,
      1,
      1,
      1,
      2,  # The plugin only supports format_count == 1
      0,
      0,
  )
Image.open(io.BytesIO(data))

[radarhere]

#9805 has just been created.

Did you find an actual image that allowed you to trigger this?

[nevercodecorrect]

Hi,
Given the script below to generate and decode a FTEX image with a 64*64 texture.
python script.py will trigger the assertion Error
python -O script.py will have `decode OK: RGB (64, 64)

Attached file ftex_multiformat_valid.ftu.zip can also trigger aseert.
And it also seems to decode properly with Image.open while using -O option. with output <PIL.FtexImagePlugin.FtexImageFile image mode=RGB size=128x96 at 0x7FB4C7EA4BB0>

import struct
from PIL import Image

W = H = 64  # multiple of 4 -> every DXT1 block is full


def make_pixels():
    return [
        (x * 255 // (W - 1), y * 255 // (H - 1), 255 - x * 255 // (W - 1))
        for y in range(H) for x in range(W)
    ]


def to565(r, g, b):
    return ((r >> 3) << 11) | ((g >> 2) << 5) | (b >> 3)


def from565(c):
    r, g, b = (c >> 11) & 31, (c >> 5) & 63, c & 31
    return (r << 3) | (r >> 2), (g << 2) | (g >> 4), (b << 3) | (b >> 2)


def dxt1(px):  # a correct, if simple, BC1 encoder
    out = bytearray()
    for by in range(0, H, 4):
        for bx in range(0, W, 4):
            blk = [px[(by + j) * W + bx + i] for j in range(4) for i in range(4)]
            hi = to565(max(p[0] for p in blk), max(p[1] for p in blk), max(p[2] for p in blk))
            lo = to565(min(p[0] for p in blk), min(p[1] for p in blk), min(p[2] for p in blk))
            c0, c1 = (hi, lo) if hi > lo else (lo, hi if hi != lo else (lo ^ 1))
            e0, e1 = from565(c0), from565(c1)
            pal = [e0, e1,
                   tuple((2 * e0[k] + e1[k]) // 3 for k in range(3)),
                   tuple((e0[k] + 2 * e1[k]) // 3 for k in range(3))]
            bits = 0
            for i, p in enumerate(blk):
                bits |= min(range(4), key=lambda k: sum((p[j] - pal[k][j]) ** 2 for j in range(3))) << (2 * i)
            out += struct.pack("<HHI", c0, c1, bits)
    return bytes(out)


def build_ftex():
    px = make_pixels()
    raw = bytes(c for p in px for c in p)          # uncompressed RGB
    comp = dxt1(px)                                # DXT1
    hdr = struct.pack("<4s5I", b"FTEX", 1, W, H, 1, 2)   # <- format_count = 2
    off0 = 24 + 2 * 8
    blk0 = struct.pack("<I", len(raw)) + raw
    off1 = off0 + len(blk0)
    blk1 = struct.pack("<I", len(comp)) + comp
    directory = struct.pack("<2I", 1, off0) + struct.pack("<2I", 0, off1)  # {uncompressed}, {DXT1}
    return hdr + directory + blk0 + blk1


data = build_ftex()
im = Image.open(io.BytesIO(data))
im.load()
print("decoded OK:", im.mode, im.size)   # only reached under `python -O`

[radarhere]

The image contained within ftex_multiformat_valid.ftu.zip is an image that you found, that was not created specifically to trigger this bug? Is the image one that we can include in our test suite and distribute under the Pillow license?

Part of the reason I'm interested is because

Pillow/src/PIL/FtexImagePlugin.py

Lines 83 to 84 in e7a7ea8

	# Only support single-format files.
	# I don't know of any multi-format file.

casts doubt on the whether this would practically occur.

Also, what image specification did you use as reference when creating your script?

[nevercodecorrect]

Hi, the image was created by me to trigger the bug. I used the code of FtexImagePlugin.py to craft this malformed input. I did not find any image file in the wild, and did not find a specification after a quick search.
I assume it is a wrong guard type for type check.