Issue #24264: Fixed buffer overflow in the imageop module.

Lib/test/test_imageop.py

@@ -61,7 +61,9 @@ class InputValidationTests(unittest.TestCase):
         self.check("rgb82rgb")
         self.check("rgb2grey")
         self.check("grey2rgb")
-
+        # Issue #24264: Buffer overflow
+        with self.assertRaises(imageop.error):
+            imageop.grey2rgb('A'*256, 1, 129)
 
 def test_main():
 

Misc/NEWS

@@ -26,6 +26,8 @@ Core and Builtins
 Library
 -------
 
+- Issue #24264: Fixed buffer overflow in the imageop module.
+
 - Issue #5633: Fixed timeit when the statement is a string and the setup is not.
 
 - Issue #24326: Fixed audioop.ratecv() with non-default weightB argument.

Modules/imageop.c

@@ -50,8 +50,11 @@ check_multiply_size(int product, int x, const char* xname, int y, const char* yn
         return 0;
     if ( !check_coordonnate(y, yname) )
         return 0;
-    if ( size == (product / y) / x )
-        return 1;
+    if ( product % y == 0 ) {
+        product /= y;
+        if ( product % x == 0 && size == product / x )
+            return 1;
+    }
     PyErr_SetString(ImageopError, "String has incorrect length");
     return 0;
 }