Skip to content

Reject NaN and out-of-range blur radii #9902

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
lazerg wants to merge 2 commits into
base: main
Choose a base branch
from
+15 −1
Open

Reject NaN and out-of-range blur radii #9902

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
5312ee4
Reject NaN and out-of-range blur radii
lazerg Aug 25, 2026
ed5a26f
Avoid comparing a float radius against INT_MAX
lazerg Aug 25, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
9 changes: 9 additions & 0 deletions Tests/test_image_filter.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -235,6 +235,15 @@ def test_invalid_box_blur_filter(radius: int | tuple[int, int]) -> None:
im.filter(box_blur_filter)


@pytest.mark.parametrize("radius", (float("nan"), float("inf"), 2**31))
def test_out_of_range_blur_filter_radius(radius: float) -> None:
im = hopper()
with pytest.raises(ValueError, match="radius"):
im.filter(ImageFilter.BoxBlur(radius))
with pytest.raises(ValueError, match="radius"):
im.filter(ImageFilter.GaussianBlur(radius))


def test_rankfilter_size_1() -> None:
im = Image.new("L", (3, 3), 128)

Expand Down
7 changes: 6 additions & 1 deletion src/libImaging/BoxBlur.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -244,9 +244,14 @@ ImagingBoxBlur(Imaging imOut, Imaging imIn, float xradius, float yradius, int n)
if (n < 1) {
return ImagingError_ValueError("number of passes must be greater than zero");
}
if (xradius < 0 || yradius < 0) {
/* Negated comparisons, so that NaN is rejected as well. */
if (!(xradius >= 0) || !(yradius >= 0)) {

@akx akx Aug 25, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

To a casual reader, this looks like a very odd way to write the thing. If the idea is that this catches NaNs by... off the top of my head, some quirk of how IEEE floats work, a comment would be nice.

EDIT: a comment got added just as I was writing this. Nice!

Even nicer, though, I think, some sort of reusable float-validation function since I'm quite sure there are many other instances of this same class of bug in Pillow.

return ImagingError_ValueError("radius must be >= 0");
}
/* 2**31 and above cannot be converted to an int. */
if (xradius >= 2147483648.0f || yradius >= 2147483648.0f) {
return ImagingError_ValueError("radius too large");
}

if (imIn->mode != imOut->mode || imIn->type != imOut->type ||
imIn->bands != imOut->bands || imIn->xsize != imOut->xsize ||
Expand Down
Loading