thumbor / remotecv / 39877628186

94%

push

github

Bound image pixel count and drop dead Pillow flags (#118)

image.py assigned PilImage.IGNORE_DECODING_ERRORS and PilImage.MAXBLOCK,
neither of which exists in PIL.Image, so both lines were no-ops. The except
clause around PilImage.open only caught IOError, so a DecompressionBombError
(a plain Exception subclass) escaped parse_image, and any image under
Pillow's error threshold but above its warning threshold went on to load(),
a PNG re-encode, cv2.imdecode and the OpenCV conversions, which allocate
several full-size copies for a file that can be a few kilobytes on disk.

parse_image now treats DecompressionBombError as an unreadable image, from
open() and from load(), where containers such as ICNS first size their embedded
image, and skips images above --max-image-pixels (MAX_IMAGE_PIXELS, default
Pillow's 89478485, 0 disables it, negative values are refused) before decoding.
Pillow's own MAX_IMAGE_PIXELS follows the option, since Pillow refuses anything
above twice that value by itself and would otherwise keep 0 or a higher limit
from taking effect; that global is shared with any other Pillow user in the
process. Images in the 89M to 178M pixel band now return no detections instead
of being processed. This change is stacked on #117 and should merge after it.

11 of 11 new or added lines in 2 files covered. (100.0%)

490 of 579 relevant lines covered (84.63%)

4.23 hits per line