{"uuid": "15bd4e70-0420-44bf-8889-3a7717e2d351", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-35653", "type": "seen", "source": "https://gist.github.com/skytk926/06ed8dea85486b4187e18ebeac768a83", "content": "#\n# The Python Imaging Library.\n# $Id$\n#\n# PCX file handling\n#\n# This format was originally used by ZSoft's popular PaintBrush\n# program for the IBM PC.  It is also supported by many MS-DOS and\n# Windows applications, including the Windows PaintBrush program in\n# Windows 3.\n#\n# history:\n# 1995-09-01 fl   Created\n# 1996-05-20 fl   Fixed RGB support\n# 1997-01-03 fl   Fixed 2-bit and 4-bit support\n# 1999-02-03 fl   Fixed 8-bit support (broken in 1.0b1)\n# 1999-02-07 fl   Added write support\n# 2002-06-09 fl   Made 2-bit and 4-bit support a bit more robust\n# 2002-07-30 fl   Seek from to current position, not beginning of file\n# 2003-06-03 fl   Extract DPI settings (info[\"dpi\"])\n#\n# Copyright (c) 1997-2003 by Secret Labs AB.\n# Copyright (c) 1995-2003 by Fredrik Lundh.\n#\n# See the README file for information on usage and redistribution.\n#\nfrom __future__ import annotations\n\nimport io\nimport logging\nfrom typing import IO\n\nfrom . import Image, ImageFile, ImagePalette\nfrom ._binary import i16le as i16\nfrom ._binary import o8\nfrom ._binary import o16le as o16\n\nlogger = logging.getLogger(__name__)\n\n\ndef _accept(prefix: bytes) -> bool:\n    return len(prefix) >= 2 and prefix[0] == 10 and prefix[1] in [0, 2, 3, 5]\n\n\n##\n# Image plugin for Paintbrush images.\n\n\nclass PcxImageFile(ImageFile.ImageFile):\n    format = \"PCX\"\n    format_description = \"Paintbrush\"\n\n    def _open(self) -> None:\n        # header\n        assert self.fp is not None\n\n        s = self.fp.read(68)\n        if not _accept(s):\n            msg = \"not a PCX file\"\n            raise SyntaxError(msg)\n\n        # image\n        bbox = i16(s, 4), i16(s, 6), i16(s, 8) + 1, i16(s, 10) + 1\n        if bbox[2] <= bbox[0] or bbox[3] <= bbox[1]:\n            msg = \"bad PCX image size\"\n            raise SyntaxError(msg)\n        logger.debug(\"BBox: %s %s %s %s\", *bbox)\n\n        offset = self.fp.tell() + 60\n\n        # format\n        version = s[1]\n        bits = s[3]\n        planes = s[65]\n        provided_stride = i16(s, 66)\n        logger.debug(\n            \"PCX version %s, bits %s, planes %s, stride %s\",\n            version,\n            bits,\n            planes,\n            provided_stride,\n        )\n\n        self.info[\"dpi\"] = i16(s, 12), i16(s, 14)\n\n        if bits == 1 and planes == 1:\n            mode = rawmode = \"1\"\n\n        elif bits == 1 and planes in (2, 4):\n            mode = \"P\"\n            rawmode = f\"P;{planes}L\"\n            self.palette = ImagePalette.raw(\"RGB\", s[16:64])\n\n        elif version == 5 and bits == 8 and planes == 1:\n            mode = rawmode = \"L\"\n            # FIXME: hey, this doesn't work with the incremental loader !!!\n            self.fp.seek(-769, io.SEEK_END)\n            s = self.fp.read(769)\n            if len(s) == 769 and s[0] == 12:\n                # check if the palette is linear grayscale\n                for i in range(256):\n                    if s[i * 3 + 1 : i * 3 + 4] != o8(i) * 3:\n                        mode = rawmode = \"P\"\n                        break\n                if mode == \"P\":\n                    self.palette = ImagePalette.raw(\"RGB\", s[1:])\n\n        elif version == 5 and bits == 8 and planes == 3:\n            mode = \"RGB\"\n            rawmode = \"RGB;L\"\n\n        else:\n            msg = \"unknown PCX mode\"\n            raise OSError(msg)\n\n        self._mode = mode\n        self._size = bbox[2] - bbox[0], bbox[3] - bbox[1]\n\n        # Don't trust the passed in stride.\n        # Calculate the approximate position for ourselves.\n        # CVE-2020-35653\n        stride = (self._size[0] * bits + 7) // 8\n\n        # While the specification states that this must be even,\n        # not all images follow this\n        if provided_stride != stride:\n            stride += stride % 2\n\n        bbox = (0, 0) + self.size\n        logger.debug(\"size: %sx%s\", *self.size)\n\n        self.tile = [ImageFile._Tile(\"pcx\", bbox, offset, (rawmode, planes * stride))]\n\n\n# --------------------------------------------------------------------\n# save PCX files\n\n\nSAVE = {\n    # mode: (version, bits, planes, raw mode)\n    \"1\": (2, 1, 1, \"1\"),\n    \"L\": (5, 8, 1, \"L\"),\n    \"P\": (5, 8, 1, \"P\"),\n    \"RGB\": (5, 8, 3, \"RGB;L\"),\n}\n\n\ndef _save(im: Image.Image, fp: IO[bytes], filename: str | bytes) -> None:\n    if im.width == 0 or im.height == 0:\n        msg = \"Cannot write empty image as PCX\"\n        raise ValueError(msg)\n\n    try:\n        version, bits, planes, rawmode = SAVE[im.mode]\n    except KeyError as e:\n        msg = f\"Cannot save {im.mode} images as PCX\"\n        raise ValueError(msg) from e\n\n    # bytes per plane\n    stride = (im.size[0] * bits + 7) // 8\n    # stride should be even\n    stride += stride % 2\n    # Stride needs to be kept in sync with the PcxEncode.c version.\n    # Ideally it should be passed in in the state, but the bytes value\n    # gets overwritten.\n\n    logger.debug(\n        \"PcxImagePlugin._save: xwidth: %d, bits: %d, stride: %d\",\n        im.size[0],\n        bits,\n        stride,\n    )\n\n    # under windows, we could determine the current screen size with\n    # \"Image.core.display_mode()[1]\", but I think that's overkill...\n\n    screen = im.size\n\n    dpi = 100, 100\n\n    # PCX header\n    fp.write(\n        o8(10)\n        + o8(version)\n        + o8(1)\n        + o8(bits)\n        + o16(0)\n        + o16(0)\n        + o16(im.size[0] - 1)\n        + o16(im.size[1] - 1)\n        + o16(dpi[0])\n        + o16(dpi[1])\n        + b\"\\0\" * 24\n        + b\"\\xff\" * 24\n        + b\"\\0\"\n        + o8(planes)\n        + o16(stride)\n        + o16(1)\n        + o16(screen[0])\n        + o16(screen[1])\n        + b\"\\0\" * 54\n    )\n\n    assert fp.tell() == 128\n\n    ImageFile._save(\n        im, fp, [ImageFile._Tile(\"pcx\", (0, 0) + im.size, 0, (rawmode, bits * planes))]\n    )\n\n    if im.mode == \"P\":\n        # colour palette\n        fp.write(o8(12))\n        palette = im.im.getpalette(\"RGB\", \"RGB\")\n        palette += b\"\\x00\" * (768 - len(palette))\n        fp.write(palette)  # 768 bytes\n    elif im.mode == \"L\":\n        # grayscale palette\n        fp.write(o8(12))\n        for i in range(256):\n            fp.write(o8(i) * 3)\n\n\n# --------------------------------------------------------------------\n# registry\n\n\nImage.register_open(PcxImageFile.format, PcxImageFile, _accept)\nImage.register_save(PcxImageFile.format, _save)\n\nImage.register_extension(PcxImageFile.format, \".pcx\")\n\nImage.register_mime(PcxImageFile.format, \"image/x-pcx\")\n\n\n{\n  \"$schema\": \"http://cyclonedx.org/schema/bom-1.7.schema.json\",\n  \"bomFormat\": \"CycloneDX\",\n  \"specVersion\": \"1.7\",\n  \"serialNumber\": \"urn:uuid:e11ef76f-c1f5-4768-929c-1cc6d6bab343\",\n  \"version\": 1,\n  \"metadata\": {\n    \"timestamp\": \"2026-07-01T09:47:40Z\",\n    \"lifecycles\": [\n      {\n        \"phase\": \"build\"\n      }\n    ],\n    \"tools\": {\n      \"components\": [\n        {\n          \"type\": \"application\",\n          \"name\": \"generate-sbom.py\",\n          \"group\": \"pillow\"\n        }\n      ]\n    },\n    \"component\": {\n      \"bom-ref\": \"pkg:pypi/pillow@12.3.0\",\n      \"type\": \"library\",\n      \"name\": \"Pillow\",\n      \"version\": \"12.3.0\",\n      \"description\": \"Python Imaging Library (fork)\",\n      \"licenses\": [\n        {\n          \"license\": {\n            \"id\": \"MIT-CMU\"\n          }\n        }\n      ],\n      \"purl\": \"pkg:pypi/pillow@12.3.0\",\n      \"externalReferences\": [\n        {\n          \"type\": \"website\",\n          \"url\": \"https://python-pillow.github.io\"\n        },\n        {\n          \"type\": \"vcs\",\n          \"url\": \"https://github.com/python-pillow/Pillow\"\n        },\n        {\n          \"type\": \"documentation\",\n          \"url\": \"https://pillow.readthedocs.io\"\n        },\n        {\n          \"type\": \"security-contact\",\n          \"url\": \"https://github.com/python-pillow/Pillow/security/policy\"\n        }\n      ]\n    }\n  },\n  \"components\": [\n    {\n      \"bom-ref\": \"pkg:pypi/pillow@12.3.0#c-ext/PIL._avif\",\n      \"type\": \"library\",\n      \"name\": \"PIL._avif\",\n      \"version\": \"12.3.0\",\n      \"description\": \"AVIF image format extension\",\n      \"licenses\": [\n        {\n          \"license\": {\n            \"id\": \"MIT-CMU\"\n          }\n        }\n      ],\n      \"purl\": \"pkg:pypi/pillow@12.3.0#c-ext/PIL._avif\"\n    },\n    {\n      \"bom-ref\": \"pkg:pypi/pillow@12.3.0#c-ext/PIL._imaging\",\n      \"type\": \"library\",\n      \"name\": \"PIL._imaging\",\n      \"version\": \"12.3.0\",\n      \"description\": \"Core image processing extension (decode, encode, map, display, outline, path, libImaging)\",\n      \"licenses\": [\n        {\n          \"license\": {\n            \"id\": \"MIT-CMU\"\n          }\n        }\n      ],\n      \"purl\": \"pkg:pypi/pillow@12.3.0#c-ext/PIL._imaging\"\n    },\n    {\n      \"bom-ref\": \"pkg:pypi/pillow@12.3.0#c-ext/PIL._imagingcms\",\n      \"type\": \"library\",\n      \"name\": \"PIL._imagingcms\",\n      \"version\": \"12.3.0\",\n      \"description\": \"LittleCMS2 colour management extension\",\n      \"licenses\": [\n        {\n          \"license\": {\n            \"id\": \"MIT-CMU\"\n          }\n        }\n      ],\n      \"purl\": \"pkg:pypi/pillow@12.3.0#c-ext/PIL._imagingcms\"\n    },\n    {\n      \"bom-ref\": \"pkg:pypi/pillow@12.3.0#c-ext/PIL._imagingft\",\n      \"type\": \"library\",\n      \"name\": \"PIL._imagingft\",\n      \"version\": \"12.3.0\",\n      \"description\": \"FreeType font rendering extension\",\n      \"licenses\": [\n        {\n          \"license\": {\n            \"id\": \"MIT-CMU\"\n          }\n        }\n      ],\n      \"purl\": \"pkg:pypi/pillow@12.3.0#c-ext/PIL._imagingft\"\n    },\n    {\n      \"bom-ref\": \"pkg:pypi/pillow@12.3.0#c-ext/PIL._imagingmath\",\n      \"type\": \"library\",\n      \"name\": \"PIL._imagingmath\",\n      \"version\": \"12.3.0\",\n      \"description\": \"Image math operations extension\",\n      \"licenses\": [\n        {\n          \"license\": {\n            \"id\": \"MIT-CMU\"\n          }\n        }\n      ],\n      \"purl\": \"pkg:pypi/pillow@12.3.0#c-ext/PIL._imagingmath\"\n    },\n    {\n      \"bom-ref\": \"pkg:pypi/pillow@12.3.0#c-ext/PIL._imagingmorph\",\n      \"type\": \"library\",\n      \"name\": \"PIL._imagingmorph\",\n      \"version\": \"12.3.0\",\n      \"description\": \"Image morphology extension\",\n      \"licenses\": [\n        {\n          \"license\": {\n            \"id\": \"MIT-CMU\"\n          }\n        }\n      ],\n      \"purl\": \"pkg:pypi/pillow@12.3.0#c-ext/PIL._imagingmorph\"\n    },\n    {\n      \"bom-ref\": \"pkg:pypi/pillow@12.3.0#c-ext/PIL._imagingtk\",\n      \"type\": \"library\",\n      \"name\": \"PIL._imagingtk\",\n      \"version\": \"12.3.0\",\n      \"description\": \"Tk/Tcl display extension\",\n      \"licenses\": [\n        {\n          \"license\": {\n            \"id\": \"MIT-CMU\"\n          }\n        }\n      ],\n      \"purl\": \"pkg:pypi/pillow@12.3.0#c-ext/PIL._imagingtk\"\n    },\n    {\n      \"bom-ref\": \"pkg:pypi/pillow@12.3.0#c-ext/PIL._webp\",\n      \"type\": \"library\",\n      \"name\": \"PIL._webp\",\n      \"version\": \"12.3.0\",\n      \"description\": \"WebP image format extension\",\n      \"licenses\": [\n        {\n          \"license\": {\n            \"id\": \"MIT-CMU\"\n          }\n        }\n      ],\n      \"purl\": \"pkg:pypi/pillow@12.3.0#c-ext/PIL._webp\"\n    },\n    {\n      \"bom-ref\": \"pkg:pypi/pillow@12.3.0#thirdparty/fribidi-shim\",\n      \"type\": \"library\",\n      \"name\": \"fribidi-shim\",\n      \"version\": \"1.x\",\n      \"description\": \"FriBiDi runtime-loading shim (vendored in src/thirdparty/fribidi-shim/); loads libfribidi dynamically\",\n      \"licenses\": [\n        {\n          \"license\": {\n            \"id\": \"LGPL-2.1-or-later\"\n          }\n        }\n      ],\n      \"hashes\": [\n        {\n          \"alg\": \"SHA-256\",\n          \"content\": \"7e8cfa78dcd21cebeb0ad91c0cd23e0dba6496c0fbd66e1ec3d25c5b1b365d11\"\n        }\n      ],\n      \"pedigree\": {\n        \"notes\": \"Pillow-authored shim; not taken from an upstream project.\"\n      },\n      \"externalReferences\": [\n        {\n          \"type\": \"website\",\n          \"url\": \"https://github.com/fribidi/fribidi\"\n        }\n      ]\n    },\n    {\n      \"bom-ref\": \"pkg:github/python/pythoncapi-compat\",\n      \"type\": \"library\",\n      \"name\": \"pythoncapi_compat\",\n      \"description\": \"Backport header for new CPython C-API functions (vendored in src/thirdparty/pythoncapi_compat.h)\",\n      \"licenses\": [\n        {\n          \"license\": {\n            \"id\": \"0BSD\"\n          }\n        }\n      ],\n      \"hashes\": [\n        {\n          \"alg\": \"SHA-256\",\n          \"content\": \"97b0e62657965bd01a783b93422a6f7138d64c48546657feacc218ec8319ee0b\"\n        }\n      ],\n      \"pedigree\": {\n        \"notes\": \"Vendored unmodified from upstream python/pythoncapi-compat.\"\n      },\n      \"externalReferences\": [\n        {\n          \"type\": \"vcs\",\n          \"url\": \"https://github.com/python/pythoncapi-compat\"\n        }\n      ]\n    },\n    {\n      \"bom-ref\": \"pkg:pypi/pillow@12.3.0#thirdparty/raqm\",\n      \"type\": \"library\",\n      \"name\": \"raqm\",\n      \"version\": \"0.10.5\",\n      \"description\": \"Complex text layout library (vendored in src/thirdparty/raqm/)\",\n      \"licenses\": [\n        {\n          \"license\": {\n            \"id\": \"MIT\"\n          }\n        }\n      ],\n      \"hashes\": [\n        {\n          \"alg\": \"SHA-256\",\n          \"content\": \"5549e7458674077ca4794033ade277910ba0ad6989651787eba1a8b5513a9f9d\"\n        }\n      ],\n      \"pedigree\": {\n        \"ancestors\": [\n          {\n            \"bom-ref\": \"pkg:github/HOST-Oman/libraqm@0.10.5#upstream\",\n            \"type\": \"library\",\n            \"name\": \"raqm\",\n            \"version\": \"0.10.5\",\n            \"purl\": \"pkg:github/HOST-Oman/libraqm@0.10.5\",\n            \"externalReferences\": [\n              {\n                \"type\": \"distribution\",\n                \"url\": \"https://github.com/HOST-Oman/libraqm/releases/tag/v0.10.5\"\n              }\n            ]\n          }\n        ],\n        \"patches\": [\n          {\n            \"type\": \"unofficial\",\n            \"diff\": {\n              \"text\": {\n                \"content\": \"LS0tIGEvc3JjL3JhcW0tdmVyc2lvbi5oLmluCisrKyBiL3NyYy9yYXFtLXZlcnNpb24uaApAQCAtMzEsMTQgKzMxLDE0IEBACiAjaWZuZGVmIF9SQVFNX1ZFUlNJT05fSF8KICNkZWZpbmUgX1JBUU1fVkVSU0lPTl9IXwogCi0jZGVmaW5lIFJBUU1fVkVSU0lPTl9NQUpPUiBAUkFRTV9WRVJTSU9OX01BSk9SQAotI2RlZmluZSBSQVFNX1ZFUlNJT05fTUlOT1IgQFJBUU1fVkVSU0lPTl9NSU5PUkAKLSNkZWZpbmUgUkFRTV9WRVJTSU9OX01JQ1JPIEBSQVFNX1ZFUlNJT05fTUlDUk9ACisjZGVmaW5lIFJBUU1fVkVSU0lPTl9NQUpPUiAwCisjZGVmaW5lIFJBUU1fVkVSU0lPTl9NSU5PUiAxMAorI2RlZmluZSBSQVFNX1ZFUlNJT05fTUlDUk8gNQogCi0jZGVmaW5lIFJBUU1fVkVSU0lPTl9TVFJJTkcgIkBSQVFNX1ZFUlNJT05AIgorI2RlZmluZSBSQVFNX1ZFUlNJT05fU1RSSU5HICIwLjEwLjUiCiAKICNkZWZpbmUgUkFRTV9WRVJTSU9OX0FUTEVBU1QobWFqb3IsbWlub3IsbWljcm8pIFwKLQkoKG1ham9yKSoxMDAwMCsobWlub3IpKjEwMCsobWljcm8pIDw9IFwKLQkgUkFRTV9WRVJTSU9OX01BSk9SKjEwMDAwK1JBUU1fVkVSU0lPTl9NSU5PUioxMDArUkFRTV9WRVJTSU9OX01JQ1JPKQorICAgICgobWFqb3IpKjEwMDAwKyhtaW5vcikqMTAwKyhtaWNybykgPD0gXAorICAgICBSQVFNX1ZFUlNJT05fTUFKT1IqMTAwMDArUkFRTV9WRVJTSU9OX01JTk9SKjEwMCtSQVFNX1ZFUlNJT05fTUlDUk8pCiAKICNlbmRpZiAvKiBfUkFRTV9WRVJTSU9OX0hfICovCg==\",\n                \"encoding\": \"base64\"\n              }\n            }\n          },\n          {\n            \"type\": \"unofficial\",\n            \"diff\": {\n              \"text\": {\n                \"content\": \"LS0tIGEvc3JjL3JhcW0uYworKysgYi9zcmMvcmFxbS5jCkBAIC0zNiw3ICszNiwxMSBAQAogI2luY2x1ZGUgPFNoZWVuQmlkaS5oPgogI2VuZGlmCiAjZWxzZQorI2lmZGVmIEhBVkVfRlJJQklESV9TWVNURU0KICNpbmNsdWRlIDxmcmliaWRpLmg+CisjZWxzZQorI2luY2x1ZGUgIi4uL2ZyaWJpZGktc2hpbS9mcmliaWRpLmgiCisjZW5kaWYKICNlbmRpZgogCiAjaW5jbHVkZSA8aGIuaD4K\",\n                \"encoding\": \"base64\"\n              }\n            }\n          }\n        ],\n        \"notes\": \"Vendored from upstream HOST-Oman/libraqm v0.10.5 with two Pillow-specific modifications: (1) raqm-version.h.in was pre-processed into raqm-version.h with version placeholders replaced by literal values; (2) raqm.c wraps the  include in an #ifdef HAVE_FRIBIDI_SYSTEM guard so Pillow's bundled fribidi-shim is used when a system FriBiDi is absent.\"\n      },\n      \"externalReferences\": [\n        {\n          \"type\": \"vcs\",\n          \"url\": \"https://github.com/python-pillow/Pillow/tree/main/src/thirdparty/raqm\"\n        }\n      ]\n    },\n    {\n      \"bom-ref\": \"pkg:generic/freetype2\",\n      \"type\": \"library\",\n      \"name\": \"FreeType\",\n      \"version\": \"2.14.3\",\n      \"scope\": \"optional\",\n      \"description\": \"Font rendering (optional, used by PIL._imagingft). Required for text/font support.\",\n      \"licenses\": [\n        {\n          \"license\": {\n            \"id\": \"FTL\"\n          }\n        }\n      ],\n      \"externalReferences\": [\n        {\n          \"type\": \"website\",\n          \"url\": \"https://freetype.org\"\n        },\n        {\n          \"type\": \"distribution\",\n          \"url\": \"https://download.savannah.gnu.org/releases/freetype/\"\n        }\n      ]\n    },\n    {\n      \"bom-ref\": \"pkg:generic/fribidi\",\n      \"type\": \"library\",\n      \"name\": \"FriBiDi\",\n      \"version\": \"1.0.16\",\n      \"scope\": \"optional\",\n      \"description\": \"Unicode bidi algorithm library (optional, loaded at runtime by fribidi-shim).\",\n      \"licenses\": [\n        {\n          \"license\": {\n            \"id\": \"LGPL-2.1-or-later\"\n          }\n        }\n      ],\n      \"externalReferences\": [\n        {\n          \"type\": \"website\",\n          \"url\": \"https://github.com/fribidi/fribidi\"\n        },\n        {\n          \"type\": \"distribution\",\n          \"url\": \"https://github.com/fribidi/fribidi/releases\"\n        }\n      ]\n    },\n    {\n      \"bom-ref\": \"pkg:generic/harfbuzz\",\n      \"type\": \"library\",\n      \"name\": \"HarfBuzz\",\n      \"version\": \"14.2.1\",\n      \"scope\": \"optional\",\n      \"description\": \"Text shaping (optional, required by libraqm for complex text layout).\",\n      \"licenses\": [\n        {\n          \"license\": {\n            \"id\": \"MIT\"\n          }\n        }\n      ],\n      \"externalReferences\": [\n        {\n          \"type\": \"website\",\n          \"url\": \"https://harfbuzz.github.io\"\n        },\n        {\n          \"type\": \"distribution\",\n          \"url\": \"https://github.com/harfbuzz/harfbuzz/releases\"\n        }\n      ]\n    },\n    {\n      \"bom-ref\": \"pkg:generic/libavif\",\n      \"type\": \"library\",\n      \"name\": \"libavif\",\n      \"version\": \"1.4.2\",\n      \"scope\": \"optional\",\n      \"description\": \"AVIF codec (optional, used by PIL._avif).\",\n      \"licenses\": [\n        {\n          \"license\": {\n            \"id\": \"BSD-2-Clause\"\n          }\n        }\n      ],\n      \"externalReferences\": [\n        {\n          \"type\": \"website\",\n          \"url\": \"https://github.com/AOMediaCodec/libavif\"\n        },\n        {\n          \"type\": \"distribution\",\n          \"url\": \"https://github.com/AOMediaCodec/libavif/releases\"\n        }\n      ]\n    },\n    {\n      \"bom-ref\": \"pkg:generic/libimagequant\",\n      \"type\": \"library\",\n      \"name\": \"libimagequant\",\n      \"version\": \"4.4.1\",\n      \"scope\": \"optional\",\n      \"description\": \"Improved colour quantization (optional).\",\n      \"licenses\": [\n        {\n          \"license\": {\n            \"id\": \"GPL-3.0-or-later\"\n          }\n        }\n      ],\n      \"externalReferences\": [\n        {\n          \"type\": \"website\",\n          \"url\": \"https://pngquant.org/lib/\"\n        },\n        {\n          \"type\": \"distribution\",\n          \"url\": \"https://github.com/ImageOptim/libimagequant/tags\"\n        }\n      ]\n    },\n    {\n      \"bom-ref\": \"pkg:generic/libjpeg\",\n      \"type\": \"library\",\n      \"name\": \"libjpeg / libjpeg-turbo\",\n      \"version\": \"3.1.4.1\",\n      \"description\": \"JPEG codec (required by default; disable with -C jpeg=disable).\",\n      \"licenses\": [\n        {\n          \"license\": {\n            \"id\": \"IJG\"\n          }\n        },\n        {\n          \"license\": {\n            \"id\": \"BSD-3-Clause\"\n          }\n        }\n      ],\n      \"externalReferences\": [\n        {\n          \"type\": \"website\",\n          \"url\": \"https://ijg.org\"\n        },\n        {\n          \"type\": \"website\",\n          \"url\": \"https://libjpeg-turbo.org\"\n        },\n        {\n          \"type\": \"distribution\",\n          \"url\": \"https://github.com/libjpeg-turbo/libjpeg-turbo/releases\"\n        }\n      ]\n    },\n    {\n      \"bom-ref\": \"pkg:generic/libtiff\",\n      \"type\": \"library\",\n      \"name\": \"libtiff\",\n      \"version\": \"4.7.1\",\n      \"scope\": \"optional\",\n      \"description\": \"TIFF codec (optional).\",\n      \"licenses\": [\n        {\n          \"license\": {\n            \"id\": \"libtiff\"\n          }\n        }\n      ],\n      \"pedigree\": {\n        \"ancestors\": [\n          {\n            \"bom-ref\": \"pkg:generic/libtiff@4.7.1#upstream\",\n            \"type\": \"library\",\n            \"name\": \"libtiff\",\n            \"version\": \"4.7.1\",\n            \"purl\": \"pkg:generic/libtiff@4.7.1\",\n            \"externalReferences\": [\n              {\n                \"type\": \"distribution\",\n                \"url\": \"https://gitlab.com/libtiff/libtiff/-/tags/v4.7.1\"\n              }\n            ]\n          }\n        ],\n        \"patches\": [\n          {\n            \"type\": \"cherry-pick\",\n            \"diff\": {\n              \"text\": {\n                \"content\": \"Y29tbWl0IDc4MmExMWQ2YjViNjFjNmRjMjFlNzE0OTUwYTRhZjViZjg5ZjAyM2MKQXV0aG9yOiBFdmVuIFJvdWF1bHQgPGV2ZW4ucm91YXVsdEBzcGF0aWFseXMuY29tPgpEYXRlOiAgIFN1biBGZWIgMjIgMjM6MzI6NDcgMjAyNiArMDEwMAoKICAgIFRJRkZSZWFkUkdCQUltYWdlKCk6IHByZXZlbnQgaW50ZWdlciBvdmVyZmxvdyBhbmQgbGF0ZXIgaGVhcCBvdmVyZmxvdyBvbiBpbWFnZXMgd2l0aCBodWdlIHdpZHRoIGluIFlDYkNyIHRpbGUgZGVjb2RpbmcgZnVuY3Rpb25zCgogICAgRml4ZXMgaHR0cHM6Ly9naXRsYWIuY29tL2xpYnRpZmYvbGlidGlmZi8tL2lzc3Vlcy83ODcKCmRpZmYgLS1naXQgYS9saWJ0aWZmL3RpZl9nZXRpbWFnZS5jIGIvbGlidGlmZi90aWZfZ2V0aW1hZ2UuYwppbmRleCA0NTQzZGRkYS4uZmE4MmQwOTEgMTAwNjQ0Ci0tLSBsaWJ0aWZmL3RpZl9nZXRpbWFnZS5jCisrKyBsaWJ0aWZmL3RpZl9nZXRpbWFnZS5jCkBAIC0yMjI0LDcgKzIyMjQsNyBAQCBERUNMQVJFQ29udGlnUHV0RnVuYyhwdXRjb250aWc4Yml0WUNiQ3I0NHRpbGUpCiAgICAgdWludDMyX3QgKmNwMSA9IGNwICsgdyArIHRvc2tldzsKICAgICB1aW50MzJfdCAqY3AyID0gY3AxICsgdyArIHRvc2tldzsKICAgICB1aW50MzJfdCAqY3AzID0gY3AyICsgdyArIHRvc2tldzsKLSAgICBpbnQzMl90IGluY3IgPSAzICogdyArIDQgKiB0b3NrZXc7CisgICAgY29uc3QgdG1zaXplX3QgaW5jciA9IDMgKiAodG1zaXplX3QpdyArIDQgKiAodG1zaXplX3QpdG9za2V3OwoKICAgICAodm9pZCl5OwogICAgIC8qIGFkanVzdCBmcm9tc2tldyAqLwpAQCAtMjM2NCw3ICsyMzY0LDcgQEAgREVDTEFSRUNvbnRpZ1B1dEZ1bmMocHV0Y29udGlnOGJpdFlDYkNyNDR0aWxlKQogREVDTEFSRUNvbnRpZ1B1dEZ1bmMocHV0Y29udGlnOGJpdFlDYkNyNDJ0aWxlKQogewogICAgIHVpbnQzMl90ICpjcDEgPSBjcCArIHcgKyB0b3NrZXc7Ci0gICAgaW50MzJfdCBpbmNyID0gMiAqIHRvc2tldyArIHc7CisgICAgY29uc3QgdG1zaXplX3QgaW5jciA9IDIgKiAodG1zaXplX3QpdG9za2V3ICsgdzsKCiAgICAgKHZvaWQpeTsKICAgICBmcm9tc2tldyA9IChmcm9tc2tldyAvIDQpICogKDQgKiAyICsgMik7CkBAIC0yNTIyLDcgKzI1MjIsNyBAQCBERUNMQVJFQ29udGlnUHV0RnVuYyhwdXRjb250aWc4Yml0WUNiQ3I0MXRpbGUpCiBERUNMQVJFQ29udGlnUHV0RnVuYyhwdXRjb250aWc4Yml0WUNiQ3IyMnRpbGUpCiB7CiAgICAgdWludDMyX3QgKmNwMjsKLSAgICBpbnQzMl90IGluY3IgPSAyICogdG9za2V3ICsgdzsKKyAgICBjb25zdCB0bXNpemVfdCBpbmNyID0gMiAqICh0bXNpemVfdCl0b3NrZXcgKyB3OwogICAgICh2b2lkKXk7CiAgICAgZnJvbXNrZXcgPSAoZnJvbXNrZXcgLyAyKSAqICgyICogMiArIDIpOwogICAgIGNwMiA9IGNwICsgdyArIHRvc2tldzsKQEAgLTI2MjUsNyArMjYyNSw3IEBAIERFQ0xBUkVDb250aWdQdXRGdW5jKHB1dGNvbnRpZzhiaXRZQ2JDcjIxdGlsZSkKIERFQ0xBUkVDb250aWdQdXRGdW5jKHB1dGNvbnRpZzhiaXRZQ2JDcjEydGlsZSkKIHsKICAgICB1aW50MzJfdCAqY3AyOwotICAgIGludDMyX3QgaW5jciA9IDIgKiB0b3NrZXcgKyB3OworICAgIGNvbnN0IHRtc2l6ZV90IGluY3IgPSAyICogKHRtc2l6ZV90KXRvc2tldyArIHc7CiAgICAgKHZvaWQpeTsKICAgICBmcm9tc2tldyA9IChmcm9tc2tldyAvIDEpICogKDEgKiAyICsgMik7CiAgICAgY3AyID0gY3AgKyB3ICsgdG9za2V3Owo=\",\n                \"encoding\": \"base64\"\n              }\n            }\n          }\n        ],\n        \"notes\": \"Vendored from upstream libtiff v4.7.1 with a commit from master cherry-picked to fix CVE-2026-4775.\"\n      },\n      \"externalReferences\": [\n        {\n          \"type\": \"website\",\n          \"url\": \"https://libtiff.gitlab.io/libtiff/\"\n        },\n        {\n          \"type\": \"distribution\",\n          \"url\": \"https://download.osgeo.org/libtiff/\"\n        }\n      ]\n    },\n    {\n      \"bom-ref\": \"pkg:generic/libwebp\",\n      \"type\": \"library\",\n      \"name\": \"libwebp\",\n      \"version\": \"1.6.0\",\n      \"scope\": \"optional\",\n      \"description\": \"WebP codec (optional, used by PIL._webp).\",\n      \"licenses\": [\n        {\n          \"license\": {\n            \"id\": \"BSD-3-Clause\"\n          }\n        }\n      ],\n      \"externalReferences\": [\n        {\n          \"type\": \"website\",\n          \"url\": \"https://chromium.googlesource.com/webm/libwebp\"\n        },\n        {\n          \"type\": \"distribution\",\n          \"url\": \"https://chromium.googlesource.com/webm/libwebp\"\n        }\n      ]\n    },\n    {\n      \"bom-ref\": \"pkg:generic/libxcb\",\n      \"type\": \"library\",\n      \"name\": \"libxcb\",\n      \"version\": \"1.17.0\",\n      \"scope\": \"optional\",\n      \"description\": \"X11 screen-grab support (optional, used by PIL._imaging on macOS and Linux).\",\n      \"licenses\": [\n        {\n          \"license\": {\n            \"id\": \"X11\"\n          }\n        }\n      ],\n      \"externalReferences\": [\n        {\n          \"type\": \"website\",\n          \"url\": \"https://xcb.freedesktop.org\"\n        },\n        {\n          \"type\": \"distribution\",\n          \"url\": \"https://xcb.freedesktop.org/dist/\"\n        }\n      ]\n    },\n    {\n      \"bom-ref\": \"pkg:generic/littlecms2\",\n      \"type\": \"library\",\n      \"name\": \"Little CMS 2\",\n      \"version\": \"2.19.1\",\n      \"scope\": \"optional\",\n      \"description\": \"Colour management (optional, used by PIL._imagingcms).\",\n      \"licenses\": [\n        {\n          \"license\": {\n            \"id\": \"MIT\"\n          }\n        }\n      ],\n      \"externalReferences\": [\n        {\n          \"type\": \"website\",\n          \"url\": \"https://www.littlecms.com\"\n        },\n        {\n          \"type\": \"distribution\",\n          \"url\": \"https://github.com/mm2/Little-CMS/releases\"\n        }\n      ]\n    },\n    {\n      \"bom-ref\": \"pkg:generic/openjpeg\",\n      \"type\": \"library\",\n      \"name\": \"OpenJPEG\",\n      \"version\": \"2.5.4\",\n      \"scope\": \"optional\",\n      \"description\": \"JPEG 2000 codec (optional).\",\n      \"licenses\": [\n        {\n          \"license\": {\n            \"id\": \"BSD-2-Clause\"\n          }\n        }\n      ],\n      \"externalReferences\": [\n        {\n          \"type\": \"website\",\n          \"url\": \"https://www.openjpeg.org\"\n        },\n        {\n          \"type\": \"distribution\",\n          \"url\": \"https://github.com/uclouvain/openjpeg/releases\"\n        }\n      ]\n    },\n    {\n      \"bom-ref\": \"pkg:pypi/pybind11\",\n      \"type\": \"library\",\n      \"name\": \"pybind11\",\n      \"scope\": \"excluded\",\n      \"description\": \"Parallel C compilation library (build-time dependency).\",\n      \"licenses\": [\n        {\n          \"license\": {\n            \"id\": \"BSD-3-Clause\"\n          }\n        }\n      ],\n      \"externalReferences\": [\n        {\n          \"type\": \"website\",\n          \"url\": \"https://pybind11.readthedocs.io\"\n        },\n        {\n          \"type\": \"distribution\",\n          \"url\": \"https://github.com/pybind/pybind11/releases\"\n        }\n      ]\n    },\n    {\n      \"bom-ref\": \"pkg:generic/zlib\",\n      \"type\": \"library\",\n      \"name\": \"zlib\",\n      \"version\": \"2.3.3\",\n      \"description\": \"Deflate/PNG compression (required by default; disable with -C zlib=disable).\",\n      \"licenses\": [\n        {\n          \"license\": {\n            \"id\": \"Zlib\"\n          }\n        }\n      ],\n      \"externalReferences\": [\n        {\n          \"type\": \"website\",\n          \"url\": \"https://zlib.net\"\n        },\n        {\n          \"type\": \"distribution\",\n          \"url\": \"https://zlib.net\"\n        }\n      ]\n    }\n  ],\n  \"dependencies\": [\n    {\n      \"ref\": \"pkg:pypi/pillow@12.3.0\",\n      \"dependsOn\": [\n        \"pkg:pypi/pillow@12.3.0#c-ext/PIL._avif\",\n        \"pkg:pypi/pillow@12.3.0#c-ext/PIL._imaging\",\n        \"pkg:pypi/pillow@12.3.0#c-ext/PIL._imagingcms\",\n        \"pkg:pypi/pillow@12.3.0#c-ext/PIL._imagingft\",\n        \"pkg:pypi/pillow@12.3.0#c-ext/PIL._imagingmath\",\n        \"pkg:pypi/pillow@12.3.0#c-ext/PIL._imagingmorph\",\n        \"pkg:pypi/pillow@12.3.0#c-ext/PIL._imagingtk\",\n        \"pkg:pypi/pillow@12.3.0#c-ext/PIL._webp\"\n      ]\n    },\n    {\n      \"ref\": \"pkg:pypi/pillow@12.3.0#c-ext/PIL._avif\",\n      \"dependsOn\": [\n        \"pkg:generic/libavif\"\n      ]\n    },\n    {\n      \"ref\": \"pkg:pypi/pillow@12.3.0#c-ext/PIL._imaging\",\n      \"dependsOn\": [\n        \"pkg:generic/libimagequant\",\n        \"pkg:generic/libjpeg\",\n        \"pkg:generic/libtiff\",\n        \"pkg:generic/libxcb\",\n        \"pkg:generic/openjpeg\",\n        \"pkg:generic/zlib\"\n      ]\n    },\n    {\n      \"ref\": \"pkg:pypi/pillow@12.3.0#c-ext/PIL._imagingcms\",\n      \"dependsOn\": [\n        \"pkg:generic/littlecms2\"\n      ]\n    },\n    {\n      \"ref\": \"pkg:pypi/pillow@12.3.0#c-ext/PIL._imagingft\",\n      \"dependsOn\": [\n        \"pkg:generic/freetype2\",\n        \"pkg:generic/fribidi\",\n        \"pkg:generic/harfbuzz\",\n        \"pkg:pypi/pillow@12.3.0#thirdparty/fribidi-shim\",\n        \"pkg:pypi/pillow@12.3.0#thirdparty/raqm\"\n      ]\n    },\n    {\n      \"ref\": \"pkg:pypi/pillow@12.3.0#c-ext/PIL._webp\",\n      \"dependsOn\": [\n        \"pkg:generic/libwebp\"\n      ]\n    },\n    {\n      \"ref\": \"pkg:pypi/pillow@12.3.0#thirdparty/raqm\",\n      \"dependsOn\": [\n        \"pkg:generic/harfbuzz\",\n        \"pkg:pypi/pillow@12.3.0#thirdparty/fribidi-shim\"\n      ]\n    }\n  ]\n}\n", "creation_timestamp": "2026-10-02T12:26:42.000000Z"}