Fix 6-byte out-of-bounds (OOB) read. The previous bounds check in
FliDecode.cincorrectly calculated the required read buffer size when copying a chunk, potentially reading six extra bytes off the end of the allocated buffer from the heap. Present since Pillow 7.1.0. This bug was found by Google’s OSS-Fuzz CIFuzz runs.
Python 3.10 wheels#
Pillow now includes binary wheels for Python 3.10.
The Python 3.10 release candidate was released on 2021-08-03 with the final release due 2021-10-04 (PEP 619). The CPython core team strongly encourages maintainers of third-party Python projects to prepare for 3.10 compatibility. And as there are no ABI changes planned we are releasing wheels to help others prepare for 3.10, and ensure Pillow can be used immediately on release day of 3.10.0 final.