From bbf391f7d5b39db07a88eea3e217fec07432e077 Mon Sep 17 00:00:00 2001 From: Mira Weller Date: Tue, 8 Sep 2026 15:44:31 +0200 Subject: [PATCH] Block out of bounds image crop dimensions (Z#23245937 / PRT-009) --- src/pretix/base/forms/questions.py | 16 ++++++++++------ 1 file changed, 10 insertions(+), 6 deletions(-) diff --git a/src/pretix/base/forms/questions.py b/src/pretix/base/forms/questions.py index 3bf801ec6c..be5f3914d3 100644 --- a/src/pretix/base/forms/questions.py +++ b/src/pretix/base/forms/questions.py @@ -600,12 +600,16 @@ class PortraitImageField(SizeValidationMixin, ExtValidationMixin, forms.FileFiel image = ImageOps.exif_transpose(image) if f._cropdata: - image = image.crop(( - f._cropdata.get('x', 0), - f._cropdata.get('y', 0), - f._cropdata.get('x', 0) + f._cropdata.get('width', image.width), - f._cropdata.get('y', 0) + f._cropdata.get('height', image.height), - )) + left = int(f._cropdata.get('x', 0)) + top = int(f._cropdata.get('y', 0)) + right = left + int(f._cropdata.get('width', image.width)) + bottom = top + int(f._cropdata.get('height', image.height)) + if left >= image.width or top >= image.height or right > image.width or bottom > image.height: + raise ValidationError( + self.error_messages['max_dimension'], + code='max_dimension', + ) + image = image.crop((left, top, right, bottom)) with BytesIO() as output: # This might use a lot of memory, but temporary files are not a good option since # we don't control the cleanup