python-imaging/Pillow — pull request #325 by manisandro (2013-08-28 18:21:02+00:00)
Title: Fix bytes which should be bytearray

The statement

bytePalette = bytes([i//3 for i in range(768)])

added to Image.py@convert In pull request #154 creates a palette of length 3510, while it should be 768. When calling ImagingUnpackRGB (in Unpack.c) through putpalette (_imaging.c@_putpalette), this results out-of-bounds array writes, and causes memory corruptions, as reported here [1] and here [2].

I think that simply changing `bytes` to `bytearray` should fix the issue, but the author of the code (d-schmidt) should probably verify the change.

[1] https://bugzilla.redhat.com/show_bug.cgi?id=1001122
[2] https://bugzilla.redhat.com/show_bug.cgi?id=995783