--- Begin Message ---
Package: release.debian.org
Severity: normal
Tags: trixie
X-Debbugs-Cc: [email protected], [email protected]
Control: affects -1 + src:psd-tools
User: [email protected]
Usertags: pu
* CVE-2026-27809: Compression module vulnerabilities (Closes: #1129098)
diffstat for psd-tools-1.10.7+dfsg.1 psd-tools-1.10.7+dfsg.1
changelog | 7
patches/0001-Fix-compression-security-issues-GHSA-24p2-j2jr-386w-.patch | 596
++++++++++
patches/series | 1
3 files changed, 604 insertions(+)
diff -Nru psd-tools-1.10.7+dfsg.1/debian/changelog
psd-tools-1.10.7+dfsg.1/debian/changelog
--- psd-tools-1.10.7+dfsg.1/debian/changelog 2025-04-14 07:35:59.000000000
+0300
+++ psd-tools-1.10.7+dfsg.1/debian/changelog 2026-06-21 20:06:58.000000000
+0300
@@ -1,3 +1,10 @@
+psd-tools (1.10.7+dfsg.1-1+deb13u1) trixie; urgency=medium
+
+ * Non-maintainer upload.
+ * CVE-2026-27809: Compression module vulnerabilities (Closes: #1129098)
+
+ -- Adrian Bunk <[email protected]> Sun, 21 Jun 2026 20:06:58 +0300
+
psd-tools (1.10.7+dfsg.1-1) unstable; urgency=low
* New upstream release.
diff -Nru
psd-tools-1.10.7+dfsg.1/debian/patches/0001-Fix-compression-security-issues-GHSA-24p2-j2jr-386w-.patch
psd-tools-1.10.7+dfsg.1/debian/patches/0001-Fix-compression-security-issues-GHSA-24p2-j2jr-386w-.patch
---
psd-tools-1.10.7+dfsg.1/debian/patches/0001-Fix-compression-security-issues-GHSA-24p2-j2jr-386w-.patch
1970-01-01 02:00:00.000000000 +0200
+++
psd-tools-1.10.7+dfsg.1/debian/patches/0001-Fix-compression-security-issues-GHSA-24p2-j2jr-386w-.patch
2026-06-21 20:06:58.000000000 +0300
@@ -0,0 +1,596 @@
+From 507976f67adf6b4b3315f555098c964f0c00fb9e Mon Sep 17 00:00:00 2001
+From: Kota Yamaguchi <[email protected]>
+Date: Tue, 24 Feb 2026 10:47:06 +0900
+Subject: Fix compression security issues (GHSA-24p2-j2jr-386w) (#549)
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+* Fix crash on invalid RLE compression in decompress()
+
+When a PSD file contains malformed RLE-compressed image data (e.g. a
+literal run that extends past the expected row size), decode_rle() raises
+ValueError which propagated all the way to the user, crashing
+psd.composite() and psd-tools export.
+
+decompress() already had a fallback that replaces failed channels with
+black pixels when result is None, but it never triggered because the
+ValueError from decode_rle() was not caught. Wrap the decode_rle() call
+in a try/except so the existing fallback handles the error gracefully.
+
+Fixes #544
+
+Co-Authored-By: Claude Sonnet 4.6 <[email protected]>
+
+* Make RLE decoder tolerant of non-standard PackBits encoding
+
+Investigation of issue #544 revealed four patterns in the wild that
+Photoshop decodes gracefully but the previous strict decoder rejected:
+
+1. Overflow runs (421 rows): a repeat or copy run whose output would
+ exceed row_size. Decoder now clips to the remaining output space.
+
+2. Truncated copy runs (238 rows): input stream shorter than the
+ declared run length. Decoder copies available bytes and zero-pads.
+
+3. Lone repeat header at end of row (4 rows): Cython decoder crashed
+ with IndexError (uncaught by the ValueError safety net). Fixed by
+ guarding data[i] access for both repeat and copy run headers.
+
+4. Short output rows (8 rows): all input consumed before row_size bytes
+ decoded. Pre-allocated zero-filled buffer handles this for free.
+
+Both rle.py and _rle.pyx are updated with matching logic; the Cython
+extension is rebuilt. The safety-net except in decompress() now also
+catches IndexError and emits a structured logger.warning instead of the
+previous silent swallow.
+
+Tests: renamed test_malicious → test_tolerant_decode with correct
+expected values; added five new low-level decode() tolerance tests;
+updated test_decompress_invalid_rle_fallback_to_black to assert the
+correct clipped output now that the decoder succeeds instead of falling
+back to black.
+
+Co-Authored-By: Claude Sonnet 4.6 <[email protected]>
+
+* Fix compression security issues (GHSA-24p2-j2jr-386w)
+
+Address five remaining findings from the security review of the
+compression module:
+
+1. ZIP bomb protection: replace bare zlib.decompress() with a new
+ _safe_zlib_decompress() helper that uses zlib.decompressobj with
+ a hard max_length cap. Decompressed output exceeding the expected
+ channel size now falls back to a black channel (consistent with the
+ existing tolerant RLE behaviour) instead of exhausting memory.
+
+2. Dimension bounds validation: decompress() now validates width,
+ height, and depth against Adobe-spec limits before any allocation
+ (width/height in [1, 300000], depth in {1, 8, 16, 32}).
+
+3. assert -> raise: the 'assert len(result) == length' guard is
+ replaced with an explicit 'if … raise ValueError' so it cannot be
+ silently disabled with python -O.
+
+4. PSDDecompressionWarning: a new UserWarning subclass is emitted
+ (alongside the existing logger.warning) whenever any codec falls
+ back to a black channel. Re-exported from psd_tools.__init__ so
+ callers can filter or escalate it via warnings.filterwarnings.
+
+5. Cython type fix (_rle.pyx): all loop indices in decode() changed
+ from 'cdef int' to 'cdef Py_ssize_t', eliminating the signed-int /
+ Py_ssize_t mismatch that caused undefined behaviour for row sizes
+ > INT_MAX. encode() zero-length branch now returns the explicit
+ empty std::string instead of relying on implicit memoryview coercion.
+
+Dev: add cython and setuptools to the dev dependency group so the
+Cython extension can be rebuilt locally.
+
+Co-Authored-By: Claude Sonnet 4.6 <[email protected]>
+
+* style: apply ruff formatting to compression/__init__.py
+
+Wrap long _warn_decompress_failure call for ZIP_WITH_PREDICTION to
+satisfy the line-length rule that failed CI.
+
+Co-Authored-By: Claude Sonnet 4.6 <[email protected]>
+
+---------
+
+Co-authored-by: Claude Sonnet 4.6 <[email protected]>
+---
+ src/psd_tools/__init__.py | 3 +-
+ src/psd_tools/compression/__init__.py | 101 ++++++++++++++--
+ src/psd_tools/compression/_rle.pyx | 48 ++++----
+ src/psd_tools/compression/rle.py | 38 +++---
+ .../psd_tools/compression/test_compression.py | 113 ++++++++++++++++++
+ tests/psd_tools/compression/test_rle.py | 34 +++---
+ 6 files changed, 273 insertions(+), 64 deletions(-)
+
+diff --git a/src/psd_tools/__init__.py b/src/psd_tools/__init__.py
+index ccfdcc5..a556666 100644
+--- a/src/psd_tools/__init__.py
++++ b/src/psd_tools/__init__.py
+@@ -1,4 +1,5 @@
+ from psd_tools.api.psd_image import PSDImage
++from psd_tools.compression import PSDDecompressionWarning
+ from psd_tools.version import __version__
+
+-__all__ = ["PSDImage", "__version__"]
++__all__ = ["PSDImage", "PSDDecompressionWarning", "__version__"]
+diff --git a/src/psd_tools/compression/__init__.py
b/src/psd_tools/compression/__init__.py
+index 8a4bf50..c4415a2 100644
+--- a/src/psd_tools/compression/__init__.py
++++ b/src/psd_tools/compression/__init__.py
+@@ -8,6 +8,7 @@ from typing import Iterator
+ import array
+ import io
+ import logging
++import warnings
+ import zlib
+
+ from PIL import Image
+@@ -28,6 +29,60 @@ except ImportError:
+ logger = logging.getLogger(__name__)
+
+
++class PSDDecompressionWarning(UserWarning):
++ """Issued when channel data cannot be fully decompressed.
++
++ The affected channel is replaced with black pixels. Catch or filter this
++ warning to detect silently degraded images::
++
++ import warnings
++ from psd_tools.compression import PSDDecompressionWarning
++
++ with warnings.catch_warnings():
++ warnings.simplefilter("error", PSDDecompressionWarning)
++ psd = PSDImage.open("file.psd")
++ """
++
++
++_VALID_DEPTHS: frozenset[int] = frozenset((1, 8, 16, 32))
++_MAX_DIMENSION: int = 300_000 # PSD/PSB hard limit per the Adobe spec
++
++
++def _warn_decompress_failure(
++ codec: str,
++ exc: Exception,
++ width: int,
++ height: int,
++ depth: int,
++ version: int,
++) -> None:
++ """Log and emit a PSDDecompressionWarning for a failed channel decode."""
++ msg = (
++ "%s decode failed (%s: %s); channel replaced with black. "
++ "width=%d height=%d depth=%d version=%d"
++ % (codec, type(exc).__name__, exc, width, height, depth, version)
++ )
++ logger.warning(msg)
++ warnings.warn(msg, PSDDecompressionWarning, stacklevel=3)
++
++
++def _safe_zlib_decompress(data: bytes, max_length: int) -> bytes:
++ """Decompress *data* with a hard upper bound on output size.
++
++ Unlike :func:`zlib.decompress`, this function raises :exc:`ValueError`
++ if the decompressed output would exceed *max_length* bytes, preventing
++ memory exhaustion from crafted ZIP-bomb payloads.
++ """
++ d = zlib.decompressobj()
++ out = d.decompress(data, max_length + 1)
++ if d.unconsumed_tail:
++ raise ValueError(
++ "Decompressed size exceeds expected maximum of %d bytes" %
max_length
++ )
++ out += d.flush()
++ return out
++
++
+ def compress(
+ data: bytes,
+ compression: Compression,
+@@ -72,24 +127,46 @@ def decompress(
+ :param data: compressed data bytes.
+ :param compression: compression type,
+ see :py:class:`~psd_tools.constants.Compression`.
+- :param width: width.
+- :param height: height.
+- :param depth: bit depth of the pixel.
++ :param width: width in pixels; must be in [1, 300000].
++ :param height: height in pixels; must be in [1, 300000].
++ :param depth: bit depth of the pixel; must be one of 1, 8, 16, 32.
+ :param version: psd file version.
+ :return: decompressed data bytes.
++ :raises ValueError: if *width*, *height*, or *depth* are out of range.
+ """
++ if width < 1 or width > _MAX_DIMENSION:
++ raise ValueError("width %d out of range [1, %d]" % (width,
_MAX_DIMENSION))
++ if height < 1 or height > _MAX_DIMENSION:
++ raise ValueError("height %d out of range [1, %d]" % (height,
_MAX_DIMENSION))
++ if depth not in _VALID_DEPTHS:
++ raise ValueError("depth %d not in %s" % (depth,
sorted(_VALID_DEPTHS)))
++
+ length = width * height * max(1, depth // 8)
+
+ result = None
+ if compression == Compression.RAW:
+ result = data[:length]
+ elif compression == Compression.RLE:
+- result = decode_rle(data, width, height, depth, version)
++ try:
++ result = decode_rle(data, width, height, depth, version)
++ except (ValueError, IndexError) as e:
++ _warn_decompress_failure("RLE", e, width, height, depth, version)
++ result = None
+ elif compression == Compression.ZIP:
+- result = zlib.decompress(data)
++ try:
++ result = _safe_zlib_decompress(data, length)
++ except (ValueError, zlib.error) as e:
++ _warn_decompress_failure("ZIP", e, width, height, depth, version)
++ result = None
+ else:
+- decompressed = zlib.decompress(data)
+- result = decode_prediction(decompressed, width, height, depth)
++ try:
++ decompressed = _safe_zlib_decompress(data, length)
++ result = decode_prediction(decompressed, width, height, depth)
++ except (ValueError, zlib.error) as e:
++ _warn_decompress_failure(
++ "ZIP_WITH_PREDICTION", e, width, height, depth, version
++ )
++ result = None
+
+ if depth >= 8:
+ if result is None:
+@@ -97,8 +174,14 @@ def decompress(
+ result = Image.new(mode, (width, height), color=0).tobytes()
+ logger.warning("Failed channel has been replaced by black")
+ else:
+- assert len(result) == length, "len=%d, expected=%d" %
(len(result), length)
+-
++ if len(result) != length:
++ raise ValueError(
++ "Decompressed length mismatch: got %d, expected %d"
++ % (len(result), length)
++ )
++
++ if result is None:
++ raise RuntimeError("decompress() produced no result for depth=%d" %
depth)
+ return result
+
+
+diff --git a/src/psd_tools/compression/_rle.pyx
b/src/psd_tools/compression/_rle.pyx
+index 6d2207b..18786dc 100644
+--- a/src/psd_tools/compression/_rle.pyx
++++ b/src/psd_tools/compression/_rle.pyx
+@@ -8,39 +8,45 @@ def decode(const unsigned char[:] data, Py_ssize_t size) ->
string:
+ """decode(data, size) -> bytes
+
+ Apple PackBits RLE decoder.
++
++ Tolerant implementation: runs that would exceed *size* are clipped at the
++ row boundary, runs whose input is truncated copy what is available, and
any
++ remaining bytes are zero-padded (std::string::resize zero-initialises).
++ The function always returns exactly *size* bytes without raising.
+ """
+
+- cdef int i = 0
+- cdef int j = 0
+- cdef int length = data.shape[0]
++ cdef Py_ssize_t i = 0
++ cdef Py_ssize_t j = 0
++ cdef Py_ssize_t length = data.shape[0]
++ cdef Py_ssize_t actual, available
+ cdef unsigned char bit
+ cdef string result
+
++ result.resize(size) # zero-initialised by std::string::resize
++
+ if length == 1:
+- if data[0] != 128:
+- raise ValueError('Invalid RLE compression')
++ # Single byte: either a no-op (128) or a stray header — return zeros
+ return result
+
+- result.resize(size)
+-
+- while i < length:
++ while i < length and j < size:
+ i, bit = i+1, data[i]
+ if bit > 128:
+ bit = 256 - bit
+- if j+1+bit > size:
+- raise ValueError('Invalid RLE compression')
+- fill_n(result.begin()+j, 1+bit, <char>data[i])
+- j += 1+bit
++ if i >= length: # lone repeat header at end of stream — stop
++ break
++ actual = min(1+bit, size-j) # clip at remaining output space
++ fill_n(result.begin()+j, actual, <char>data[i])
++ j += actual
+ i += 1
+ elif bit < 128:
+- if i+1+bit > length or (j+1+bit > size):
+- raise ValueError('Invalid RLE compression')
+- copy_n(&data[i], 1+bit, result.begin()+j)
+- j += 1+bit
+- i += 1+bit
+-
+- if size and (j != size):
+- raise ValueError('Expected %d bytes but decoded %d bytes' % (size, j))
++ if i >= length: # copy header is the last byte; nothing to copy
++ break
++ available = min(length-i, 1+bit)
++ actual = min(available, size-j) # clip to input and output
++ copy_n(&data[i], actual, result.begin()+j)
++ j += actual
++ i += available # advance by declared amount or to end
++ # bit == 128: no-op
+
+ return result
+
+@@ -58,7 +64,7 @@ def encode(const unsigned char[:] data) -> string:
+ cdef string result
+
+ if length == 0:
+- return data
++ return result
+ if length == 1:
+ result.push_back(0)
+ result.push_back(data[0])
+diff --git a/src/psd_tools/compression/rle.py
b/src/psd_tools/compression/rle.py
+index 19f07e1..e7822b8 100644
+--- a/src/psd_tools/compression/rle.py
++++ b/src/psd_tools/compression/rle.py
+@@ -4,36 +4,36 @@ def decode(data: bytes, size: int) -> bytes:
+ """decode(data, size) -> bytes
+
+ Apple PackBits RLE decoder.
++
++ Tolerant implementation: runs that would exceed *size* are clipped at the
++ row boundary, runs whose input is truncated copy what is available, and
any
++ remaining bytes are zero-padded. The function always returns exactly
*size*
++ bytes without raising.
+ """
+
+ i, j = 0, 0
+ length = len(data)
+ data = bytearray(data)
+- result = bytearray()
++ result = bytearray(size) # pre-allocated and zero-filled
+
+- if length == 1:
+- if data[0] != 128:
+- raise ValueError("Invalid RLE compression")
+- return result
+-
+- while i < length:
++ while i < length and j < size:
+ i, bit = i + 1, data[i]
+ if bit > 128:
+ bit = 256 - bit
+- if j + 1 + bit > size:
+- raise ValueError("Invalid RLE compression")
+- result.extend((data[i : i + 1]) * (1 + bit))
+- j += 1 + bit
++ if i >= length: # lone repeat header at end of stream — stop
++ break
++ actual = min(1 + bit, size - j) # clip at remaining output space
++ result[j : j + actual] = bytes([data[i]]) * actual
++ j += actual
+ i += 1
+ elif bit < 128:
+- if i + 1 + bit > length or (j + 1 + bit > size):
+- raise ValueError("Invalid RLE compression")
+- result.extend(data[i : i + 1 + bit])
+- j += 1 + bit
+- i += 1 + bit
+-
+- if size and (len(result) != size):
+- raise ValueError("Expected %d bytes but decoded %d bytes" % (size, j))
++ copy_count = 1 + bit
++ available = length - i
++ actual = min(copy_count, available, size - j) # clip to input
and output
++ result[j : j + actual] = data[i : i + actual]
++ j += actual
++ i += min(copy_count, available) # advance by declared amount or
to end
++ # bit == 128: no-op
+
+ return bytes(result)
+
+diff --git a/tests/psd_tools/compression/test_compression.py
b/tests/psd_tools/compression/test_compression.py
+index 2b71591..7189b46 100644
+--- a/tests/psd_tools/compression/test_compression.py
++++ b/tests/psd_tools/compression/test_compression.py
+@@ -1,16 +1,20 @@
+ from __future__ import print_function, unicode_literals
+
+ import logging
++import warnings
++import zlib
+
+ import pytest
+
+ from psd_tools.compression import (
++ PSDDecompressionWarning,
+ compress,
+ decode_prediction,
+ decode_rle,
+ decompress,
+ encode_prediction,
+ encode_rle,
++ rle_impl,
+ )
+ from psd_tools.constants import Compression
+
+@@ -77,6 +81,54 @@ def test_compress_decompress(data, kind, width, height,
depth, version):
+ assert output == data, "output=%r, expected=%r" % (output, data)
+
+
++def test_decompress_rle_overflow_clips() -> None:
++ # Header: 1 row of 4 compressed bytes (\x00\x04).
++ # Row data: literal run header 0x02 = copy 3 bytes, but row_size is 2.
++ # Tolerant decoder clips to 2 bytes → correct decoded output, no fallback.
++ rle_data = b"\x00\x04\x02\x00\x00\x00"
++ width, height, depth = 2, 1, 8
++ result = decompress(rle_data, Compression.RLE, width, height, depth)
++ assert result == b"\x00\x00"
++
++
++# --- Low-level decode() tolerance tests (exercise both Python and Cython
impls) ---
++
++
++def test_decode_rle_repeat_overflow() -> None:
++ # 0x82 = repeat-run header: 256 - 0x82 = 126, so repeat 127× next byte.
++ # row_size=3 → decoder should clip to 3 repetitions of 0xAA.
++ data = bytes([0x82, 0xAA])
++ assert rle_impl.decode(data, 3) == b"\xaa\xaa\xaa"
++
++
++def test_decode_rle_copy_overflow() -> None:
++ # 0x02 = copy-run header: copy 3 bytes, but row_size=2.
++ # Decoder should clip to 2 bytes.
++ data = bytes([0x02, 0x01, 0x02, 0x03])
++ assert rle_impl.decode(data, 2) == b"\x01\x02"
++
++
++def test_decode_rle_copy_truncated_input() -> None:
++ # 0x04 = copy-run header: copy 5 bytes, but only 3 bytes follow in the
stream.
++ # Decoder should copy 3 available bytes and zero-pad the remaining 2.
++ data = bytes([0x04, 0x01, 0x02, 0x03])
++ assert rle_impl.decode(data, 5) == b"\x01\x02\x03\x00\x00"
++
++
++def test_decode_rle_lone_repeat_header() -> None:
++ # 0x82 = repeat-run header with no following pixel byte (stream ends).
++ # Should not raise (previously caused IndexError in Cython); returns
zeros.
++ data = bytes([0x82])
++ assert rle_impl.decode(data, 4) == b"\x00\x00\x00\x00"
++
++
++def test_decode_rle_short_output() -> None:
++ # Stream is valid but encodes fewer bytes than row_size (zero-padded
remainder).
++ # 0x00 = copy 1 byte (0xFF); row_size=4 → b"\xff\x00\x00\x00"
++ data = bytes([0x00, 0xFF])
++ assert rle_impl.decode(data, 4) == b"\xff\x00\x00\x00"
++
++
+ # This will fail due to irreversible zlib compression.
+ @pytest.mark.xfail
+ @pytest.mark.parametrize(
+@@ -97,3 +149,64 @@ def test_compress_decompress_fail(data, width, height,
depth):
+ decoded = decompress(data, Compression.ZIP_WITH_PREDICTION, width,
height, depth)
+ encoded = compress(decoded, Compression.ZIP_WITH_PREDICTION, width,
height, depth)
+ assert data == encoded
++
++
++# ---------------------------------------------------------------------------
++# Security fix tests
++# ---------------------------------------------------------------------------
++
++
[email protected](
++ "kind",
++ [Compression.ZIP, Compression.ZIP_WITH_PREDICTION],
++)
++def test_decompress_zip_bomb_falls_back_to_black(kind: Compression) -> None:
++ """A zlib payload that expands beyond the declared channel size must not
++ exhaust memory; it should fall back to a black channel."""
++ oversized = zlib.compress(b"\x00" * 10_000)
++ result = decompress(oversized, kind, width=2, height=2, depth=8)
++ assert result == b"\x00" * 4 # black fallback for 2×2 8-bit
++
++
[email protected](
++ "kind",
++ [Compression.ZIP, Compression.ZIP_WITH_PREDICTION],
++)
++def test_decompress_zip_bomb_emits_psd_warning(kind: Compression) -> None:
++ """ZIP bomb fallback must emit PSDDecompressionWarning."""
++ oversized = zlib.compress(b"\x00" * 10_000)
++ with warnings.catch_warnings(record=True) as caught:
++ warnings.simplefilter("always")
++ decompress(oversized, kind, width=2, height=2, depth=8)
++ assert any(issubclass(w.category, PSDDecompressionWarning) for w in
caught)
++
++
++def test_decompress_rle_failure_emits_psd_warning() -> None:
++ """An undecodable RLE channel must emit PSDDecompressionWarning."""
++ # version=1 row byte-count table needs height*2 bytes (unsigned short
each).
++ # Providing only 1 byte forces array.frombytes to raise ValueError (not a
++ # multiple of 2), which is the path that triggers the warning.
++ bad_rle = b"\x00"
++ with warnings.catch_warnings(record=True) as caught:
++ warnings.simplefilter("always")
++ decompress(bad_rle, Compression.RLE, width=4, height=1, depth=8,
version=1)
++ assert any(issubclass(w.category, PSDDecompressionWarning) for w in
caught)
++
++
[email protected](
++ "bad_kwarg",
++ [
++ {"width": 0},
++ {"width": 300_001},
++ {"height": 0},
++ {"height": 300_001},
++ {"depth": 7},
++ {"depth": 0},
++ ],
++)
++def test_decompress_invalid_dimensions_raises(bad_kwarg: dict) -> None:
++ """Out-of-spec dimensions must raise ValueError immediately."""
++ params: dict = dict(width=4, height=4, depth=8, version=1)
++ params.update(bad_kwarg)
++ with pytest.raises(ValueError):
++ decompress(b"\x00" * 16, Compression.RAW, **params)
+diff --git a/tests/psd_tools/compression/test_rle.py
b/tests/psd_tools/compression/test_rle.py
+index f7234de..a0b3378 100644
+--- a/tests/psd_tools/compression/test_rle.py
++++ b/tests/psd_tools/compression/test_rle.py
+@@ -26,20 +26,26 @@ def test_identical():
+ assert decoded_c == EDGE_CASE_1
+
+ @pytest.mark.parametrize(
+- ("mod, data, size"),
++ ("mod, data, size, expected"),
+ [
+- # b'\x01\x01\x01\x01'
+- (rle, b"\xfd\x01", 3),
+- (rle, b"\xfd\x01", 5),
+- (_rle, b"\xfd\x01", 3),
+- (_rle, b"\xfd\x01", 5),
+- # b'\x01\x02\x03'
+- (rle, b"\x02\x01\x02\x03", 2),
+- (rle, b"\x02\x01\x02\x03", 4),
+- (_rle, b"\x02\x01\x02\x03", 2),
+- (_rle, b"\x02\x01\x02\x03", 4),
++ # 0xfd = repeat-run: 256-253=3, so repeat 4× byte 0x01.
++ # size=3 → overflow clipped: b'\x01\x01\x01'
++ (rle, b"\xfd\x01", 3, b"\x01\x01\x01"),
++ (_rle, b"\xfd\x01", 3, b"\x01\x01\x01"),
++ # size=5 → 4 real bytes + 1 zero-padded: b'\x01\x01\x01\x01\x00'
++ (rle, b"\xfd\x01", 5, b"\x01\x01\x01\x01\x00"),
++ (_rle, b"\xfd\x01", 5, b"\x01\x01\x01\x01\x00"),
++ # 0x02 = copy-run: copy 3 bytes (0x01 0x02 0x03).
++ # size=2 → overflow clipped: b'\x01\x02'
++ (rle, b"\x02\x01\x02\x03", 2, b"\x01\x02"),
++ (_rle, b"\x02\x01\x02\x03", 2, b"\x01\x02"),
++ # size=4 → 3 real bytes + 1 zero-padded: b'\x01\x02\x03\x00'
++ (rle, b"\x02\x01\x02\x03", 4, b"\x01\x02\x03\x00"),
++ (_rle, b"\x02\x01\x02\x03", 4, b"\x01\x02\x03\x00"),
+ ],
+ )
+-def test_malicious(mod, data, size):
+- with pytest.raises(ValueError):
+- mod.decode(data, size)
++def test_tolerant_decode(mod, data, size, expected) -> None:
++ # The decoder must never raise; it clips overflow runs and zero-pads
short output.
++ result = mod.decode(data, size)
++ assert result == expected
++ assert len(result) == size
+--
+2.47.3
+
diff -Nru psd-tools-1.10.7+dfsg.1/debian/patches/series
psd-tools-1.10.7+dfsg.1/debian/patches/series
--- psd-tools-1.10.7+dfsg.1/debian/patches/series 1970-01-01
02:00:00.000000000 +0200
+++ psd-tools-1.10.7+dfsg.1/debian/patches/series 2026-06-21
20:06:53.000000000 +0300
@@ -0,0 +1 @@
+0001-Fix-compression-security-issues-GHSA-24p2-j2jr-386w-.patch
--- End Message ---
