Load broken images

PIL/ImageFile.py

@@ -190,9 +190,6 @@ def load(self):
             except AttributeError:
                 prefix = b""
 
-            # Buffer length read; assign a default value
-            t = 0
-
             for d, e, o, a in self.tile:
                 d = Image._getdecoder(self.mode, d, a, self.decoderconfig)
                 seek(o)
@@ -201,7 +198,6 @@ def load(self):
                 except ValueError:
                     continue
                 b = prefix
-                t = len(b)
                 while True:
                     try:
                         s = read(self.decodermaxblock)
@@ -230,7 +226,6 @@ def load(self):
                     if n < 0:
                         break
                     b = b[n:]
-                    t = t + n
                 # Need to cleanup here to prevent leaks in PyPy
                 d.cleanup()
 
@@ -239,7 +234,7 @@ def load(self):
 
         self.fp = None  # might be shared
 
-        if not self.map and (not LOAD_TRUNCATED_IMAGES or t == 0) and e < 0:
+        if not self.map and not LOAD_TRUNCATED_IMAGES and e < 0:
             # still raised if decoder fails to return anything
             raise_ioerror(e)
 

Tests/test_imagefile.py

@@ -115,6 +115,26 @@ def test_truncated_without_errors(self):
         finally:
             ImageFile.LOAD_TRUNCATED_IMAGES = False
 
+    def test_broken_datastream_with_errors(self):
+        if "zip_encoder" not in codecs:
+            self.skipTest("PNG (zlib) encoder not available")
+
+        im = Image.open("Tests/images/broken_data_stream.png")
+        with self.assertRaises(IOError):
+            im.load()
+
+    def test_broken_datastream_without_errors(self):
+        if "zip_encoder" not in codecs:
+            self.skipTest("PNG (zlib) encoder not available")
+
+        im = Image.open("Tests/images/broken_data_stream.png")
+
+        ImageFile.LOAD_TRUNCATED_IMAGES = True
+        try:
+            im.load()
+        finally:
+            ImageFile.LOAD_TRUNCATED_IMAGES = False
+
 if __name__ == '__main__':
     unittest.main()