Repository: python-pillow/Pillow

Issue:
[JPEG 2000] OverflowError is raised when the size is too large
Hi, I am recently fuzzing this library and found the test case which raises OverflowError.

### What did you do?

```python

from PIL import Image
import io

# assumes the current directory is the root of this repository.
with open('Tests/images/16bit.cropped.j2k', 'rb') as f:
    data = bytearray(f.read())

# Change the main header of codestream
data[8:12] = b"\xff\x00\x00\x00"  # xsiz
data[12:16] = b"\x00\x00\x00\x00"  # ysiz
data[16:20] = b"\x00\x00\x00\x00"  # xosiz
data[20:24] = b"\x00\x00\x00\x01"  # yosiz

# OverflowError is raised
with Image.open(io.BytesIO(data)) as img:
    img.load()

```

### What did you expect to happen?

Maybe ValueError is better.

### What actually happened?

```
Traceback (most recent call last):
  File "issue4.py", line 17, in <module>
    img.load()
  File "/usr/local/lib/python3.8/site-packages/PIL/Jpeg2KImagePlugin.py", line 278, in load
    return ImageFile.ImageFile.load(self)
  File "/usr/local/lib/python3.8/site-packages/PIL/ImageFile.py", line 201, in load
    self.load_prepare()
  File "/usr/local/lib/python3.8/site-packages/PIL/ImageFile.py", line 271, in load_prepare
    self.im = Image.core.new(self.mode, self.size)
OverflowError: signed integer is greater than maximum
```

The size of ImageFile is `(4278190080, -1)`. The first element of size is too large for `PyArg_ParseTuple`. Also, the test case passes through the bomb check because the second element is negative.

### What are your OS, Python and Pillow versions?

* OS: Debian GNU/Linux 11 (bullseye)
* Python: 3.8.13
* Pillow: 9.1.0



Discussion:
It doesn't address your main concern, but I've created #6269 to prevent the negative height.

Resolving patch:
diff --git a/src/PIL/ImageFile.py b/src/PIL/ImageFile.py
--- a/src/PIL/ImageFile.py
+++ b/src/PIL/ImageFile.py
@@ -123,7 +123,7 @@ def __init__(self, fp=None, filename=None):
             ) as v:
                 raise SyntaxError(v) from v
 
-            if not self.mode or self.size[0] <= 0:
+            if not self.mode or self.size[0] <= 0 or self.size[1] <= 0:
                 raise SyntaxError("not identified by this driver")
         except BaseException:
             # close the file only if we have opened it this constructor


Test patch:
diff --git a/Tests/images/zero_height.j2k b/Tests/images/zero_height.j2k
new file mode 100644
Binary files /dev/null and b/Tests/images/zero_height.j2k differ
diff --git a/Tests/test_imagefile.py b/Tests/test_imagefile.py
--- a/Tests/test_imagefile.py
+++ b/Tests/test_imagefile.py
@@ -2,7 +2,15 @@
 
 import pytest
 
-from PIL import BmpImagePlugin, EpsImagePlugin, Image, ImageFile, _binary, features
+from PIL import (
+    BmpImagePlugin,
+    EpsImagePlugin,
+    Image,
+    ImageFile,
+    UnidentifiedImageError,
+    _binary,
+    features,
+)
 
 from .helper import (
     assert_image,
@@ -377,3 +385,7 @@ def test_encode(self):
 
         with pytest.raises(NotImplementedError):
             encoder.encode_to_file(None, None)
+
+    def test_zero_height(self):
+        with pytest.raises(UnidentifiedImageError):
+            Image.open("Tests/images/zero_height.j2k")