Check PyCapsule_GetPointer and PyBytes_FromStringAndSize return values (#9508)

Author: radarhere

src/_imaging.c

@@ -254,6 +254,9 @@ void
 ReleaseArrowSchemaPyCapsule(PyObject *capsule) {
     struct ArrowSchema *schema =
         (struct ArrowSchema *)PyCapsule_GetPointer(capsule, "arrow_schema");
+    if (!schema) {
+        return;
+    }
     if (schema->release != NULL) {
         schema->release(schema);
     }
@@ -276,6 +279,9 @@ void
 ReleaseArrowArrayPyCapsule(PyObject *capsule) {
     struct ArrowArray *array =
         (struct ArrowArray *)PyCapsule_GetPointer(capsule, "arrow_array");
+    if (!array) {
+        return;
+    }
     if (array->release != NULL) {
         array->release(array);
     }

src/_imagingcms.c

@@ -558,7 +558,13 @@ cms_transform_apply(CmsTransformObject *self, PyObject *args) {
     }
 
     im = (Imaging)PyCapsule_GetPointer(i0, IMAGING_MAGIC);
+    if (!im) {
+        return NULL;
+    }
     imOut = (Imaging)PyCapsule_GetPointer(i1, IMAGING_MAGIC);
+    if (!imOut) {
+        return NULL;
+    }
 
     return Py_BuildValue("i", pyCMSdoTransform(im, imOut, self->transform));
 }

src/_imagingft.c

@@ -948,6 +948,11 @@ font_render(FontObject *self, PyObject *args) {
     }
     im = (Imaging)PyCapsule_GetPointer(imagePtr, IMAGING_MAGIC);
     Py_DECREF(imagePtr);
+    if (!im) {
+        PyMem_Del(glyph_info);
+        Py_DECREF(image);
+        return NULL;
+    }
 
     x_offset = round(x_offset - stroke_width);
     y_offset = round(y_offset - stroke_width);

src/_imagingmath.c

@@ -187,8 +187,17 @@ _unop(PyObject *self, PyObject *args) {
     }
 
     unop = (void *)PyCapsule_GetPointer(op, MATH_FUNC_UNOP_MAGIC);
+    if (!unop) {
+        return NULL;
+    }
     out = (Imaging)PyCapsule_GetPointer(i0, IMAGING_MAGIC);
+    if (!out) {
+        return NULL;
+    }
     im1 = (Imaging)PyCapsule_GetPointer(i1, IMAGING_MAGIC);
+    if (!im1) {
+        return NULL;
+    }
 
     unop(out, im1);
 
@@ -219,9 +228,21 @@ _binop(PyObject *self, PyObject *args) {
     }
 
     binop = (void *)PyCapsule_GetPointer(op, MATH_FUNC_BINOP_MAGIC);
+    if (!binop) {
+        return NULL;
+    }
     out = (Imaging)PyCapsule_GetPointer(i0, IMAGING_MAGIC);
+    if (!out) {
+        return NULL;
+    }
     im1 = (Imaging)PyCapsule_GetPointer(i1, IMAGING_MAGIC);
+    if (!im1) {
+        return NULL;
+    }
     im2 = (Imaging)PyCapsule_GetPointer(i2, IMAGING_MAGIC);
+    if (!im2) {
+        return NULL;
+    }
 
     binop(out, im1, im2);
 

src/_imagingmorph.c

@@ -53,7 +53,13 @@ apply(PyObject *self, PyObject *args) {
     }
 
     imgin = (Imaging)PyCapsule_GetPointer(i0, IMAGING_MAGIC);
+    if (!imgin) {
+        return NULL;
+    }
     imgout = (Imaging)PyCapsule_GetPointer(i1, IMAGING_MAGIC);
+    if (!imgout) {
+        return NULL;
+    }
     width = imgin->xsize;
     height = imgin->ysize;
 
@@ -223,6 +229,9 @@ get_on_pixels(PyObject *self, PyObject *args) {
     }
 
     img = (Imaging)PyCapsule_GetPointer(i0, IMAGING_MAGIC);
+    if (!img) {
+        return NULL;
+    }
     rows = img->image8;
     width = img->xsize;
     height = img->ysize;

src/_webp.c

@@ -262,6 +262,9 @@ _anim_encoder_add(PyObject *self, PyObject *args) {
     }
 
     im = (Imaging)PyCapsule_GetPointer(i0, IMAGING_MAGIC);
+    if (!im) {
+        return NULL;
+    }
 
     // Setup config for this frame
     if (!WebPConfigInit(&config)) {
@@ -610,6 +613,9 @@ WebPEncode_wrapper(PyObject *self, PyObject *args) {
     }
 
     im = (Imaging)PyCapsule_GetPointer(i0, IMAGING_MAGIC);
+    if (!im) {
+        return NULL;
+    }
 
     // Setup config for this frame
     if (!WebPConfigInit(&config)) {

src/display.c

@@ -480,6 +480,9 @@ PyImaging_GrabClipboardWin32(PyObject *self, PyObject *args) {
     GlobalUnlock(handle);
     CloseClipboard();
 
+    if (!result) {
+        return NULL;
+    }
     return Py_BuildValue("zN", format_names[format], result);
 }
 

src/libImaging/Storage.c

@@ -677,9 +677,15 @@ ImagingNewArrow(
     Imaging im;
     struct ArrowSchema *schema =
         (struct ArrowSchema *)PyCapsule_GetPointer(schema_capsule, "arrow_schema");
+    if (!schema) {
+        return NULL;
+    }
 
     struct ArrowArray *external_array =
         (struct ArrowArray *)PyCapsule_GetPointer(array_capsule, "arrow_array");
+    if (!external_array) {
+        return NULL;
+    }
 
     if (xsize < 0 || ysize < 0) {
         return (Imaging)ImagingError_ValueError("bad image size");

src/libImaging/codec_fd.c

@@ -41,6 +41,9 @@ _imaging_write_pyFd(PyObject *fd, char *src, Py_ssize_t bytes) {
     PyObject *byteObj;
 
     byteObj = PyBytes_FromStringAndSize(src, bytes);
+    if (!byteObj) {
+        return -1;
+    }
     result = PyObject_CallMethod(fd, "write", "O", byteObj);
 
     Py_DECREF(byteObj);