Repository navigation
ImageDraw.arc() segfaults on a tuple subclass whose __len__ is too large #10358
Description
Summary
Passing coordinates as a tuple subclass whose __len__ reports more items than the tuple holds crashes the interpreter.
The same input as a list subclass raises a clean IndexError: list index out of range, so only the tuple path is affected.
Environment
- Pillow 13.0.0
- Python 3.13.5
Reproducer
from PIL import Image, ImageDraw
class MyTuple(tuple):
def __len__(self):
return 10
ImageDraw.Draw(Image.new("RGB", (50, 50))).arc(MyTuple((0.0,)), 0, 90)Segmentation fault (core dumped)
Activity
radarhere commentedon Oct 29, 2026
I think this is similar to #10055, in that you are passing in unrealistic data. Like in #10198, I'm not sure if we should ignore this scenario or not - potentially, if you want to deliberately throw a monkey wrench in the works, that's on you.
theosotr commentedon Oct 29, 2026
Sure. I just noticed the inconsistency with list case, which employs the checked
PyList_GetItemRef:The list branch was switched to
PyList_GetItemRefin 9c576d6.