Skip to content

Conversation

@radarhere
Copy link
Member

@radarhere radarhere commented Apr 4, 2025

xz 5.8.1 has been released - https://github.com/tukaani-project/xz/releases/tag/v5.8.1

This updates it, except for on 32-bit Windows. That would fail with https://github.com/radarhere/Pillow/actions/runs/14264115010/job/39981991680#step:30:1096

E OSError: decoder error -2

C:\hostedtoolcache\windows\Python\3.9.13\x86\lib\site-packages\PIL\TiffImagePlugin.py:1416: OSError
---------------------------- Captured stderr call -----------------------------
LZMADecode: Decoding error at scanline 0, data is corrupt.
LZMADecode: Not enough data at scanline 0 (short 49152 bytes).

I initially reported this to libtiff at https://gitlab.com/libtiff/libtiff/-/issues/677, but have since moved on and reported it directly to xz at tukaani-project/xz#171

@radarhere
Copy link
Member Author

tukaani-project/xz#171 found a workaround! I've pushed a commit to add -DXZ_CLMUL_CRC:BOOL=OFF.

@radarhere
Copy link
Member Author

For anyone who is wondering, we should not be affected by https://www.cve.org/CVERecord?id=CVE-2025-31115, as libtiff uses lzma_stream_decoder, not lzma_stream_decoder_mt. See https://gitlab.com/libtiff/libtiff/-/blob/master/libtiff/tif_lzma.c

@hugovk hugovk merged commit 774d0ae into python-pillow:main Apr 12, 2025
108 of 137 checks passed
@radarhere radarhere deleted the xz_upgrade branch April 12, 2025 07:30
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

2 participants