Pillow Image Export Memory Leak Vulnerability Analysis and Fix

Pillow 导出图像导致内存泄漏漏洞总结 漏洞概述 当 环境变量设置为大于 1 的值时，Pillow 在导出图像到数组（如 NumPy）时，会因未对齐的内存分配导致内存泄漏。该问题源于 Pillow 在内部处理图像数据时，若对齐值大于 1，则会在像素数据前后填充额外字节，而这些填充字节在导出过程中未被正确释放，从而造成内存泄漏。 影响范围 受影响版本：11.2.1 – 13.0.0 已修复版本：13.0.1+ 严重性评分：CVSS 6.3/10（中等） 影响组件：Pillow 图像导出功能（特别是 或 方法） 触发条件：需设置 修复方案 升级 Pillow 至 13.0.1 或更高版本。 若无法立即升级，可临时将 设置为 1（默认值），避免触发漏洞。 官方建议：此漏洞仅在特定配置下触发，且无远程利用风险，但可能影响长期运行的服务或高负载图像处理场景。 POC 代码（完整提取） ```python import os os.environ["PILLOW_ALIGNMENT"] = "16" from PIL import Image Image is 16x16, so there will be 16 bytes of padding; all bytes are all 0 Image is 16x17, so there will be 16 bytes of padding; all bytes are all 0 Image is 16x18, so there will be 16 bytes of padding; all bytes are all 0 Image is 16x19, so there will be 16 bytes of padding; all bytes are all 0 Image is 16x20, so there will be 16 bytes of padding; all bytes are all 0 Image is 16x21, so there will be 16 bytes of padding; all bytes are all 0 Image is 16x22, so there will be 16 bytes of padding; all bytes are all 0 Image is 16x23, so there will be 16 bytes of padding; all bytes are all 0 Image is 16x24, so there will be 16 bytes of padding; all bytes are all 0 Image is 16x25, so there will be 16 bytes of padding; all bytes are all 0 Image is 16x26, so there will be 16 bytes of padding; all bytes are all 0 Image is 16x27, so there will be 16 bytes of padding; all bytes are all 0 Image is 16x28, so there will be 16 bytes of padding; all bytes are all 0 Image is 16x29, so there will be 16 bytes of padding; all bytes are all 0 Image is 16x30, so there will be 16 bytes of padding; all bytes are all 0 Image is 16x31, so there will be 16 bytes of padding; all bytes are all 0 Image is 16x32, so there will be 16 bytes of padding; all bytes are all 0 Image is 16x33, so there will be 16 bytes of padding; all bytes are all 0 Image is 16x34, so there will be 16 bytes of padding; all bytes are all 0 Image is 16x35, so there will be 16 bytes of padding; all bytes are all 0 Image is 16x36, so there will be 16 bytes of padding; all bytes are all 0 Image is 16x37, so there will be 16 bytes of padding; all bytes are all 0 Image is 16x38, so there will be 16 bytes of padding; all bytes are all 0 Image is 16x39, so there will be 16 bytes of padding; all bytes are all 0 Image is 16x40, so there will be 16 bytes of padding; all bytes are all 0 Image is 16x41, so there will be 16 bytes of padding; all bytes are all 0 Image is 16x42, so there will be 16 bytes of padding; all bytes are all 0 Image is 16x43, so there will be 16 bytes of padding; all bytes are all 0 Image is 16x44, so there will be 16 bytes of padding; all bytes are all 0 Image is 16x45, so there will be 16 bytes of padding; all bytes are all 0 Image is 16x46, so there will be 16 bytes of padding; all bytes are all 0 Image is 16x47, so there will be 16 bytes of padding; all bytes are all 0 Image is 16x48, so there will be 16 bytes of padding; all bytes are all 0 Image is 16x49, so there will be 16 bytes of padding; all bytes are all 0 Image is 16x50, so there will be 16 bytes of padding; all bytes are all 0 Image is 16x51, so there will be 16 bytes of padding; all bytes are all 0 Image is 16x52, so there will be 16 bytes of padding; all bytes are all 0 Image is 16x53, so there will be 16 bytes of padding; all bytes are all 0 Image is 16x54, so there will be 16 bytes of padding; all bytes are all 0 Image is 16x55, so there will be 16 bytes of padding; all bytes are all 0 Image is 16x56, so there will be 16 bytes of padding; all bytes are all 0 Image is 16x57, so there will be 16 bytes of padding; all bytes are all 0 Image is 16x58, so there will be 16 bytes of padding; all bytes are all 0 Image is 16x59, so there will be 16 bytes of padding; all bytes are all 0 Image is 16x60, so there will be 16 bytes of padding; all bytes are all 0 Image is 16x61, so there will be 16 bytes of padding; all bytes are all 0 Image is 16x62, so there will be 16 bytes of padding; all bytes are all 0 Image is 16x63, so there will be 16 bytes of padding; all bytes are all 0 Image is 16x64, so there will be 16 bytes of padding; all bytes are all 0 Image is 16x65, so there will be 16 bytes of padding; all bytes are all 0 Image is 16x66, so there will be 16 bytes of padding; all bytes are all 0 Image is 16x67, so there will be 16 bytes of padding; all bytes are all 0 Image is 16x68, so there will be 16 bytes of padding; all bytes are all 0 Image is 16x69, so there will be 16 bytes of padding; all bytes are all 0 Image is 16x70, so there will be 16 bytes of padding; all bytes are all 0 Image is 16x71, so there will be 16 bytes of padding; all bytes are all 0 Image is 16x72, so there will be 16 bytes of padding; all bytes are all 0 Image is 16x73, so there will be 16 bytes of padding; all bytes are all 0 Image is 16x74, so there will be 16 bytes of padding; all bytes are all 0 Image is 16x75, so there will be 16 bytes of padding; all bytes are all 0 Image is 16x76, so there will be 16 bytes of padding; all bytes are all 0 Image is 16

Goal Reached Thanks to every supporter — we hit 100%!

Pillow Image Export Memory Leak Vulnerability Analysis and Fix

More from this source