From 4d6e5a0d095cc1567f286e470d7af286a3e8d50e Mon Sep 17 00:00:00 2001
From: Andrew Murray <radarhere@users.noreply.github.com>
Date: Thu, 16 Jun 2022 08:36:43 +1000
Subject: [PATCH] Limit tile size to avoid extending outside image

---
 Tests/images/input_bw_one_band.fpx | Bin 0 -> 33792 bytes
 Tests/images/input_bw_one_band.png | Bin 0 -> 477 bytes
 Tests/test_file_fpx.py             |  11 +++++++++++
 src/PIL/FpxImagePlugin.py          |   9 ++++++---
 4 files changed, 17 insertions(+), 3 deletions(-)
 create mode 100644 Tests/images/input_bw_one_band.fpx
 create mode 100644 Tests/images/input_bw_one_band.png

diff --git a/Tests/images/input_bw_one_band.fpx b/Tests/images/input_bw_one_band.fpx
new file mode 100644
index 0000000000000000000000000000000000000000..9bdc53763fe9459ecc35cd45feabf15d06d6d124
GIT binary patch
literal 33792
zcmeGk2Y6Fe_oSt?3}YE#1}%gcL>p#6;RVnlN(7-GYE_`DmO?2MDXt;{0xm{D6bIA=
zPU?V)qkw`qP(&0I2OtjI8*tG7oIBpiY}5Y#$M3u8dFS4<@44$`yzY9Z-hnkG%?^U8
z^nrLdQC<sb>gYDC6R?sD5Qi0NpC~Uc=R^RkTID3lz&{vk4KaoZh-thN5t0Or#<n)r
z>mbxcI0eCua4G^$0jP&iAE5z4Lj(sxBZS5XO%R$Qkd5Yuod_)uPD3~yAqAl&LMsH4
zX^prILR*A(2<;I%Ah;1aBAkKH3E@nHvk+1dJP4%Q1#wq|ZV25GdLVcadLr~fI2+*{
zgx&~!5EKL-0_pyn%TUP0S3Zu#c`ya>G?;~1$!pcQ;gTDZ*7S32DH-bc>D?}^r;VvK
zr%~-Djhi)X+opXxcZY6Wdvx#V?cb{rB&cgX9yMXY=n?5#-mW)q7(5DVj$clsrHd9W
zSh2il8LVmEdr*rVHj?w<WP5JI#?k~B1~XtXzD6_O12Ky67|}FF$%ibgPaz{VTf9va
zYU1u=s}Wz*)*dm9AI)9DHmFf!W}FS;;_KB&Xz8h$cyZtQvlF|G*tB=6O=1_yuEojN
zy6eF<2`~V1(8n0`pMzPD{sBe|A9=}TmyXRGKW^fL?5zChSI;PzdCjbw=FFRW^ZbPi
zmM$t<wqp6pJDX7)!Z-Qf^nB^YSGI0@b^B{OUVmfvdwcfn{osA+S7KU2w<1tUfOFAv
zK0*o%#wfC39AvWbNX7ZhUo^)%Lh3S-&-B4;!gYQ7ju58)%YB&q6OD?m?vZ`G1|a=P
zOl$X9V&X!l`L74L2M~?+fLaK&{%L(nIa>czX#Lv|$UluKt$&iS%E^-f95ObxgaZoR
z1e_?xDWJaz;6qNsjwKl$KYX};m)%K_lG1q>%@G^E2vcc56NE4V?b(FW5ZI(aL~J?}
zScNbaFA;?vwIlgA>ywUJqKMyy9^!F=(}<b(E;_5yaz;;|I5n#vB|SGcXHr&vO5dqd
zbFwl==V#?kVTaVU-MV-8bnlUx+9}i1t!pQbCv#k<R4nX56)M-Wkbdj=bRL~WX}Hsj
zhUqX7rsDoqfGa;8cc5IPPQo_r#eI=8728?37trpY?t*I9s6uJN{IInLV~zVR8z2)c
z73ICipfj8Jiy7{Zo+qO>zWX4lLZv>ge*J6@rY!dziD|#wAOu70e#5ZWbP9~aY{-2u
zm7VrR51p|m(m(B2Fv^$*B1ymU{2`hwQJ+6j!Gz`cBV#bJSyTF#xHD4e{GpP7Ck~x`
z6If4aEa(&-$F9@4NZ4x%=3nm76hkm!=~rU9znjP=2$Qz0M1*^|Z8c)t$8Bp7;~3f2
zBgXT<R*D$60NZB7h~jq874a^_afs=liAVe$;u?sLA;y9%l7qM;y5L_jVzeLE8Zp|B
zOXYM}j}6)z=p2!I1Yz1UkOlMlwd_r}=eQZYiB3hzsq=rlaoo`~I*YV>P<*=eZ<;%_
zUL#ph{pSYpZ=%uq%Rrzrmg1u}-q*1ERJ^spI|0lA;z5Y<W(Ri#o)eazWUfPc)OU%c
z|JkP4iEpNnzqtrB{>1ko421spN`WD`)^hRAD+_lWZOzf0NBGhTBPM%vL_|CP=)HuP
z{uoEh`wzSStH}DRi~ds(s0_v4PRE|-;9aQPXXTC)x%XtpW~2K#@=yJO(Z+c|B)RV3
zzMbqolxVWh-R~I8y0!<%-7W>r$Jj>0SiDY?;sMx=`KSI=r2n-4k5Vn!&<_@zZ!|Y)
z9*#v!^Du|#c+BME1?Nlhb%<$=(tISHQN!BX<oqKE{e3^mLu&*&?`a*Ao=<?};gr_S
zuMqk!l%e;Mq~jBy*O&W5U*u69h)00e*>wLwb?PtfJFJjA*(6MMqtV0e>Wk(APhgq%
zlNE=XfAVam&Ub{h#e{u6y5i>nKK51~->U~d|9y4n?ui#U|0SmLDm?}FA>25^tv}kY
zWJ&e$T5X@YbudB-j<C!<dtVY{{i*9tU4Kb%tPnp@=(u%3xc(d0-+_ZN7Q(fCyiMzm
z-cQLGq>L|qwyc8LKYd;@L~z6T*XLgvtL59gP1XsA%D-O5?7tZ@*?l%*b^X$LqkG>@
zll*^Mg5JtR9a3!Ck=z8o&x)i~c|OiAgR-e<;00@tzR^N3sh~8jX4a3|7!$+``lk}q
zg^|dF8Hr1?$fcqnMP*2uC1G+;S1ddd$qb1}mdUFU!hlIXXs4v2P+=yhA0!+^Ulo@X
z@=cOlkuU;BMA!SIhEA3=q#oC1SFS8{nF1%1v?yFn=n5`tsezybbI!V9)+bBc1YOaS
zS|phTMzI?8Rau>i)YViOg$K^!l@gq8XsHdIL0%R5CjUHI9x)HkNRjp^aM?qhX=HP|
zTu$XMQ>rf4<TL|^X;ThJk-1<<C?Z+V8G#3>h9NXGd#Vj{pu`|)Mwd)ULw)8)2ysE~
zSIARH?8QYGm1~ntp)Y+%vsyn?!{kU;m|L!nRPIq|t5RG;xL2uKh4@@XZ@?IflooO8
zV?b3Il*BX&RJb%X5X?GEf(uD;DWwx-B;i%HA)@6LNJ6K;{O~pfCcUV#%%i**xkjpV
z%CIm<NSHKPR_Vf|%2q1@z5)m+s!FSs04W`Tgmi+uY9i{y1FJe^V$x6=ECy=mC_-6h
zL!+1zuTwKtxeCo-jV?2<Q9{(D4yg+RNRreLN|LOKp*yKBFj1sfc+ADPKGs!3;k7g_
z(--PSq{)P?8N3_RL+hA1viAmcYM2GhZ7C3-C<tcxfHoSSzmNe$69gI!<v&VwOFv8k
z1I8=}A&k15B0;n?lBFLy16r0s*FtMYUc+S7(hr@1&{@|wp|!*3e^-d#4dIU~=%co%
z){Yj%|5uIWG=?sbehlhtO~j&Kk=v+XeyXDXu_T~M{4*og<=>bATtH#ZmFmt3uD}23
z1`x~I<NHBu7MOM{Nu~q_+nA!H#qK{Q_ZVet^N+m8)_+WXl(`Bf7VGqlarVcWzSug?
zMlV=aDnyGV{S|U#30oPkGGJxE%7B%Ds>(pP&j#@K24R0sj4{L^&~Lg<$arG86|{82
zXQ0Y{|Dnjy64=}}u}w|8i~V><QtgH8p&!|d8auMnm>ox9d6^Qn1TmTDw!4Z~Ww`MX
zrbMNzB&@ojcXp@K4tA&Ao955R%g*#W9R9-cLxo`r`FFVJmy_tt?r=CA9;YMC>rTt?
zXDHd*anQ=b7ShWu&2-zr?M+N{I=z0y<yPDdZ$|cQtBUuBA9UoBe)^#!Wd$Cu-|fJc
z*X?xr)7@@oL1EcW@*lpCzN4sgzF$#XcDvK<PIP&lZUuXkT~a*1G`uo$Ngo_}nTj{j
zJ>2DVdonT|UN?B$?#!Ke-lFodL*Y%JcA{M=DJ}3gluR#{OvRI_*oP}_Pf3Qeu&``T
z*z}d5zTLC#Xh~kS*X{DSGm8Aqf;^8$!4W7)cMiv~i!}ajZ{D6G>(YxbZWk!oirb6I
z9!1HR?@e@qg0*l3JMUSwuGpWLU5tHpxgAag^*tVsQ}Nh6*-D`|?DQ$b_+6QW8Hskk
z-|O^v6J2Q;UPVcB***S5r$0?m(j)5Aw8M4hcG_|5(6Pr$^Vs91wWt&pMbLMVFeJMD
zUboxfp-1%Wd^TeZOCkHUAg>3zDsJp`qRV9;p5{{0(n#M>$}%GQcRACyZ}&UAX=%g#
z0s0F4$TLh)>>h_}Re5<ydfB0M8JS9es9`?};NlOMy{>dzW=9VlEkC+{onPPgAkqOO
z#pzH=j><WHq%@7ToeC5M6s1h6GaT53aONz1D}UDf(Jvrt{e;^u%sgxVu=WpY|FHHC
zEd$p6Y2G8lwNLi_)B21@oB1bmO@97!VBY<|93MO}`LQKQ(6QY!AJX$bW*R+@Re%p}
z((_xyr)QY((Rmn&K+itXbA$8@-c$s7CX${Pq_<HE5a=1H#R$m=D-r0KywwQwVc%hV
zz|MzQJ|7lMT|Uoe#skpKF8pURG$u({Z;vnvfp#Yw`>!_W7a#nai~$qq3qAW77Z(Td
z@$vXyL~1}nLITvRSreaAON6APB&b!Z7Syg?8|u`l19j`xg;P#B1?+Y^oO<f1ker+h
z_3G7w`t|EWg9Z(tVZ(;ta5$h*qejrUabsxGqzN=_+7y~KYX;4mHwUNF2`yT*fYVMp
z4NgD(bVx}_ftD>>LaSD-z~yp5>(;HIO`A5*wryKz*RCD3Z{Hp|bm##1wi!Bh><DL^
zaRzki)CtZ!^GrDFtg`_B$pGM|2hh25XXw(U3v}(;6}oln2Hm@NhaNq80DeLOJ$v?q
zUcGw3*=L^(=bUp6^zPjo`t<38?<5s`uFnU3`}T!?{rW-w{{7+HbI*nI&N~m%($ZkS
zfB|s+`RBvHfdk=!3od{QFT4;24H^V~zaK8T=pq<AcrXkZG6XKZ_+l73bSMlPHVo3!
z(_#4V;V@#v2)N{uOJL;4k#Omym%?S2T?Ut5emP`hWWW_yTme^Jc_mzR)m1QR)F^y(
zb~KC`GX^p<GhysleC~DJI2b>EJWQA{0VYnI2w7QKke!_klO|1qoSYn(Jb5xqnKA`(
zb8}(p)Txk{mj~0PO@ryvr$c^zKFpXg1FpXMYM425CKMDDz^qxb;F@c$fore57OuPQ
zI=KG&>*0nQZUFqG0cOvh4L9C+Bg~mI2X4CQCYU>SF3g)Z59ZIG4>#X@Gb~uJ02VG>
z2#Xdif?IC61#Z3dR=Dl9+u-)wZ-+bXxC0h1UJOf?EP<s<m%_4T%b=*J2$nBj4l7oy
zfIIKJ6IQNV33uIf7u<dK-LPuaD!AvKd*I%C?}hvByASTa|9)7#dNr(Bvj&Qbi{XI>
z9)JfQd=MUb=plIc;fLXoM;?K-YuCcMb?e~KM<0d99(xQPfBbQH;)y5V$tRzLr=EHW
z)~{a=B_$>B^wUqnGtWE&&p!JsJonsluwlan*tl^cl$Msl^UpsIn>KBN7hZS)UVQOI
zc<H5=;N_QJ2K=N9HgDbxTefV0ty{OkE3do)ufF;!Y}>XCwr}4Kuf6sf?AWmbUVr^{
zc;k&X;LSJRgty*$3wG|@32(psHoWuBJFsilE_nCdcVYML-SFOf@4=oud*J=|--i!A
z_yG3q-3$Bn?Sl_L{186+=p)#_e?NTu@yGDVC!fHlpMDCTefAj~IB)<C9y|z#4jqEe
zKmQyKA3h9UeDMW*`Q?}J)mLA^*I$1PM~)nUZ@&2kzWw%F`0l&!;QQ~thaZ0U0e<}P
zNBHTdpWx@8e}-Rv`2~Lc^;h`qx8LCR-+zZc{`doq9z6=jjva&J$B)CGfBp%7{q-08
z{rBJS&p-dbi4!Miuh4G;(QW5?jcDrRgZbf=D4axNRg<Y^`??H83|$MVGPTIReW{F9
z(vf`#*MZ8~{%_dVx=>v`2$CXxlro30<VNTQ4nY;!mxkFmXj6zcW%MY-mS812qVpjK
zK-aCxTh`fC<KqsDfmY^sReIYz8Qf--+t<2pa;Y_`rimH*7OG{CH#DRM_JmE_piC(g
z8e>qD3liXw@~f&Kn_NP+RCdIQuuXDY*<?aC8LmVhboPVBLUyGOEr_6^!H8@r1!FLp
z-mnnTlcMMjU#g)T=#5o}{UA1xgkGg%QB|Azi9(WM>Ipj>k#OLsFcWG*LZwv-2uujU
zXpPgPOD4&TYf%dxQAu0JVA6~&Y%&>Xi(`@}vS{ffG%DjUP9^M9Oj?(8Rh?h7&AjnQ
zm?s&L8km+CUA)NUwp9<JB4s4jWkqk9jIuUItjP&PC0huh2ss`oYcLU6BaD))NqWqq
zW{cA$m*Hx+&%LN!U==~r<%0*Ui&R%Ns-UjuplXFGYJ$j;Nr3Z&6k~D$o@tg|VM|{Z
zB*_sD$WfKsr_O3YGLO9fj6v>XkI1_kkyb+iY>*s7Iw>i`?DNzy3qqd6RS~93f<)1g
zHFGQw<Y-YCl{HCbLT5wx*NKy?a3x(bj2BjPqM~Xh8=@elL512CwohH-X2_oCDJSu(
zCcvGMFo|g)G7D1J7?GhB&=8I#U2UQ*R%g+$hNMVQ!d!+?WH5R*uj?Y!n9`bNT2eHb
zYPYXCC!g3|*$3)5^7N4)f&EDuF-ct@X-Tp<mQ<1x)&$baX&fDsO(W9hZlooHo=Q~p
zM9c!Au;iF1frf>x|F(TCLJC$!E26-dbTn#_kO1Ov0TDVwLX#mP=-Y<6j>9bK+gk3q
z51j+Ojq0|q_Z76RCB(#LJtA7z_)SWYnk<{#AX#SOCi{_0aK0KHHF+PX!m4Uh&r$Qw
z^&?%Y+kO!LJR4$eif|2LoMs?Zs3G%0gCOgg0U}~cM4{0uT%$09*r&lDPRxZ_31+A&
z?FU53j8{qg0j4E^yO6D_$JJ`TlBubJ`4A~l)$O9X?MLdLflt9$-#7D_Ue#CY`(JIU
zS>OL!-~U?Q|NiU0|J61Gt7c`u%7B#tD+5*rtPEHgurgp}z{-G?0V@Mm2CNKN8L%>7
cWx&dSl>sXQRtBsLRBHyT?|-ZMn_q74KNZQI-v9sr

literal 0
HcmV?d00001

diff --git a/Tests/images/input_bw_one_band.png b/Tests/images/input_bw_one_band.png
new file mode 100644
index 0000000000000000000000000000000000000000..6b4c1f37696a847dc9859da93af8c6e1eec52eb7
GIT binary patch
literal 477
zcmV<30V4j1P)<h;3K|Lk000e1NJLTq002e+001rs00000u;MUp0004`Nkl<Zc$~de
zQL+Oe2uphZJLi3ffQnmfJJ0ECN5qf-D)9Z#554{a<ZY1OM&V`jX@_k3x{sW7&_K^&
z1Qg_Nb0hl*l5R39k0twtrJFvfl#Gm1yP+k_8BjL{Or*F(wgNNBfvBbLUh^)e4*(z_
zweDcE3KT(bz~KZz(L(l5|4S1gQ0DeCuU3%e#-IeStq=e$T5wp~kD$pw<X~w#j>jUe
z_XDE!potni8@oajKyE?{?8Z%ECs8g#)@9yoW@kcW;BZE9i>uIBPxe}^*M_-BtxHm)
z#&%_c(lJ}*c-uLY21#*P)t4(WiBB@7Z5?@LleG0V##ncOo~JrrDW-9e3m8SXEG41k
zQ1ooVS<teWGBbWvXwIisP2*NomGaGTy`|MGCOIx_CUe#``zO7Rm*~J_xzOtpY!UM8
z{sqv7yQjNfmGKlOPlt!?4r8IS)b1E-d<7qSei|>tIZKToK&(#R4kiwC;vq;Z`ffXh
z2d$enH~Se(8Tk+^-q;G|m{7a}n>3st$)Emhao@qT5)o=Y?C2a(a)+nVz8CffiPcI%
TjOZMM00000NkvXXu0mjf^4ivS

literal 0
HcmV?d00001

diff --git a/Tests/test_file_fpx.py b/Tests/test_file_fpx.py
index 818565f88b3..fa22e90f660 100644
--- a/Tests/test_file_fpx.py
+++ b/Tests/test_file_fpx.py
@@ -2,11 +2,22 @@
 
 from PIL import Image
 
+from .helper import assert_image_equal_tofile
+
 FpxImagePlugin = pytest.importorskip(
     "PIL.FpxImagePlugin", reason="olefile not installed"
 )
 
 
+def test_sanity():
+    with Image.open("Tests/images/input_bw_one_band.fpx") as im:
+        assert im.mode == "L"
+        assert im.size == (70, 46)
+        assert im.format == "FPX"
+
+        assert_image_equal_tofile(im, "Tests/images/input_bw_one_band.png")
+
+
 def test_invalid_file():
     # Test an invalid OLE file
     invalid_file = "Tests/images/flower.jpg"
diff --git a/src/PIL/FpxImagePlugin.py b/src/PIL/FpxImagePlugin.py
index f955b234769..a55376d0e08 100644
--- a/src/PIL/FpxImagePlugin.py
+++ b/src/PIL/FpxImagePlugin.py
@@ -154,13 +154,16 @@ def _open_subimage(self, index=1, subimage=0):
 
         for i in range(0, len(s), length):
 
+            x1 = min(xsize, x + xtile)
+            y1 = min(ysize, y + ytile)
+
             compression = i32(s, i + 8)
 
             if compression == 0:
                 self.tile.append(
                     (
                         "raw",
-                        (x, y, x + xtile, y + ytile),
+                        (x, y, x1, y1),
                         i32(s, i) + 28,
                         (self.rawmode,),
                     )
@@ -172,7 +175,7 @@ def _open_subimage(self, index=1, subimage=0):
                 self.tile.append(
                     (
                         "fill",
-                        (x, y, x + xtile, y + ytile),
+                        (x, y, x1, y1),
                         i32(s, i) + 28,
                         (self.rawmode, s[12:16]),
                     )
@@ -201,7 +204,7 @@ def _open_subimage(self, index=1, subimage=0):
                 self.tile.append(
                     (
                         "jpeg",
-                        (x, y, x + xtile, y + ytile),
+                        (x, y, x1, y1),
                         i32(s, i) + 28,
                         (rawmode, jpegmode),
                     )