Red Hat found some crashers in the rgbimg module along with a proposed patch: https://bugzilla.redhat.com/show_bug.cgi?id=541698 . Since the patch was sent to the PSRT privately before the bugs were announced, it should be fine to take the patch from the page and apply it.

As a security fix, it probably applies to 2.5 and 2.6 as well.

According to PEP-0004, affected module was deprecated in 2.5 and is no longer part of 2.6 and later.  Hence 2.5 only, not sure if that version is still actively supported upstream.

Because it's a crasher it could still be patched if someone chose to do the work.

See also #7673 (other crashers).

haypo: what's the relationship?

I am able to reproduce the crash with z > 4:

# (magic, type (rle, bpp), dim, x, y, z)
open('image', 'wb').write(struct.pack('>hhhhhh', 0732, 1, 1, 1, 1, 10))
rgbimg.longimagedata('image')

--

But not the "xsize = ysize = 0x8000" integer overflow. longimagedata() begins by checking that xsize * ysize * zsize * sizeof(Py_Int32) doesn't overflow:

	tablen = xsize * ysize * zsize * sizeof(Py_Int32);
        if (xsize != (((tablen / ysize) / zsize) / sizeof(Py_Int32))) {
		PyErr_NoMemory();
		goto finally;
        }

If xsize * ysize * zsize * sizeof(Py_Int32) doesn't overflow, there is no reason that xsize * ysize * sizeof(Py_Int32) does overflow.

--

I am too tired to check the two RLE bugs.

You seem to be right that r65878 should block the "xsize = ysize = 0x8000" integer overflow.  I was testing on the python version with r60793, but not with r65878.  Note that the check added in r65878 should still cause crash on divide-by-zero for some files.

Attaching my test files. 1 is for excessive ZSIZE, 2 and 3 for the integer overflow, RLE and non-RLE code path, 4 and 5 for RLE decoding issues.  6 should trigger sigfpe in the r65878 check as noted above, but I've not really tested that one.