CVE-2016-3076: Buffer Overflow

Pillow between 2.5.0 and 3.1.1 may overflow a buffer when reading rewriting a specially crafted Jpeg2000 file.

This occurs specifically in the function j2kencodeentry, at the line: state->buffer = malloc (tilewidth tileheight components prec / 8);

If this buffer is smaller than expected, the jpeg2k encoding functions will write outside the allocation and onto the heap, corrupting memory.

Reproducer and proposed fix can be found in original bug report:

https://bugzilla.redhat.com/showbug.cgi?id=1321422

— Red Hat