CVE Request -- Buffer overflow in Python-Pillow and PIL

[Eric Soroos <eric () soroos net>]

Hello, 

I’d like to request a CVE number for all versions of Python Pillow <= 3.1.0  and PIL == 1.1.7 (at the least). 

There is a buffer overflow in PcdDecode.c, where the decoder writes assuming 4 bytes per pixel into a 3 byte per pixel 
wide buffer, allowing writing 768 bytes off the end of the buffer. This overwrites objects in Python's stack, leading 
to a crash. 

This issue and the patch are public:  https://github.com/python-pillow/Pillow/pull/1706

Thanks, 

Eric