From f39b0ae6624eb2d7c5c5d651d9bb5fdbd96a8675 Mon Sep 17 00:00:00 2001
From: Andrew Murray <3112309+radarhere@users.noreply.github.com>
Date: Sun, 21 Jun 2026 14:06:24 +1000
Subject: [PATCH] Add decompression bomb check to GdImageFile (#9693)

---
 Tests/test_file_gd.py  | 8 +++++++-
 src/PIL/GdImageFile.py | 3 ++-
 2 files changed, 9 insertions(+), 2 deletions(-)

Index: pillow-11.3.0/Tests/test_file_gd.py
===================================================================
--- pillow-11.3.0.orig/Tests/test_file_gd.py
+++ pillow-11.3.0/Tests/test_file_gd.py
@@ -1,8 +1,10 @@
 from __future__ import annotations
 
+from io import BytesIO
+
 import pytest
 
-from PIL import GdImageFile, UnidentifiedImageError
+from PIL import GdImageFile, Image, UnidentifiedImageError, _binary
 
 from .helper import assert_image_similar_tofile
 
@@ -21,6 +23,12 @@ def test_bad_mode() -> None:
         GdImageFile.open(TEST_GD_FILE, "bad mode")
 
 
+def test_decompression_bomb() -> None:
+    b = BytesIO(_binary.o16be(65535) + _binary.o16be(50000) + _binary.o16be(50000))
+    with pytest.raises(Image.DecompressionBombError):
+        GdImageFile.open(b)
+
+
 def test_invalid_file() -> None:
     invalid_file = "Tests/images/flower.jpg"
 
Index: pillow-11.3.0/src/PIL/GdImageFile.py
===================================================================
--- pillow-11.3.0.orig/src/PIL/GdImageFile.py
+++ pillow-11.3.0/src/PIL/GdImageFile.py
@@ -29,7 +29,7 @@ from __future__ import annotations
 
 from typing import IO
 
-from . import ImageFile, ImagePalette, UnidentifiedImageError
+from . import Image, ImageFile, ImagePalette, UnidentifiedImageError
 from ._binary import i16be as i16
 from ._binary import i32be as i32
 from ._typing import StrOrBytesPath
@@ -58,6 +58,7 @@ class GdImageFile(ImageFile.ImageFile):
 
         self._mode = "P"
         self._size = i16(s, 2), i16(s, 4)
+        Image._decompression_bomb_check(self.size)
 
         true_color = s[6]
         true_color_offset = 2 if true_color else 0