Affected: Homebrew: aider

### Summary A PPM or PGM file can declare a width of 0, which Pillow accepts, producing an image of size `(0, N)`. Passing that image to `ImageMorph.MorphOp.apply()` makes the native morphology code index a row buffer at `outrow[width - 1]`, which is `outrow[-1]` when the width is 0. The process crashes.

### Details The PPM parser reads width and height with no lower-bound check:

- `src/PIL/PpmImagePlugin.py:119`

The native `apply()` writes the row edges with no guard that the width is positive:

- `src/_imagingmorph.c:81` sets `outrow[0] = outrow[width - 1] = 0;`

`match()` and `get_on_pixels()` use the same edge-indexing pattern.

### PoC ```python from PIL import Image, ImageMorph

# A width-0 image (also producible from a crafted PPM header). apply() indexes # outrow[width - 1] == outrow[-1] in native code. im = Image.new("L", (0, 5)) ImageMorph.MorphOp(op_name="dilation4").apply(im) ```

Run it: ``` $ python 03_poc.py Segmentation fault (core dumped) ```

Observed on a source build of commit `3e2ab96`.

Under AddressSanitizer: ``` ==ERROR: AddressSanitizer: SEGV on unknown address (pc ... in apply) #0 apply src/_imagingmorph.c:81 SUMMARY: AddressSanitizer: SEGV src/_imagingmorph.c:81 in apply ``` With width 0 the `outrow[width - 1]` write lands on an unmapped page, so it surfaces as a SEGV pinned to the edge-write line rather than a redzone overflow.

### Impact Out-of-bounds write in a C extension. Affects any application that runs a morphology operation on an…

Pillow is a Python imaging library. Prior to 13.0.0, Pillow's ImageMorph.MorphOp.apply() can access memory before a row buffer for a zero-width image. PPM and PGM input can create an image with width zero, and the native morphology routine indexes outrow[width - 1] without rejecting that geometry. An attacker can supply such an image to an application that applies a morphology operation. This can crash the process. This issue is fixed in version 13.0.0.

Affected: PyPI: Pillow

### Summary A PPM or PGM file can declare a width of 0, which Pillow accepts, producing an image of size `(0, N)`. Passing that image to `ImageMorph.MorphOp.apply()` makes the native morphology code index a row buffer at `outrow[width - 1]`, which is `outrow[-1]` when the width is 0. The process crashes.

### Details The PPM parser reads width and height with no lower-bound check:

- `src/PIL/PpmImagePlugin.py:119`

The native `apply()` writes the row edges with no guard that the width is positive:

- `src/_imagingmorph.c:81` sets `outrow[0] = outrow[width - 1] = 0;`

`match()` and `get_on_pixels()` use the same edge-indexing pattern.

### PoC ```python from PIL import Image, ImageMorph

# A width-0 image (also producible from a crafted PPM header). apply() indexes # outrow[width - 1] == outrow[-1] in native code. im = Image.new("L", (0, 5)) ImageMorph.MorphOp(op_name="dilation4").apply(im) ```

Run it: ``` $ python 03_poc.py Segmentation fault (core dumped) ```

Observed on a source build of commit `3e2ab96`.

Under AddressSanitizer: ``` ==ERROR: AddressSanitizer: SEGV on unknown address (pc ... in apply) #0 apply src/_imagingmorph.c:81 SUMMARY: AddressSanitizer: SEGV src/_imagingmorph.c:81 in apply ``` With width 0 the `outrow[width - 1]` write lands on an unmapped page, so it surfaces as a SEGV pinned to the edge-write line rather than a redzone overflow.

### Impact Out-of-bounds write in a C extension. Affects any application that runs a morphology operation on an…

Affected: Ubuntu:Pro:14.04:LTS: pillow, Ubuntu:Pro:16.04:LTS: pillow, Ubuntu:Pro:18.04:LTS: pillow, Ubuntu:Pro:20.04:LTS: pillow, Ubuntu:Pro:20.04:LTS: pillow-python2, Ubuntu:22.04:LTS: pillow, Ubuntu:24.04:LTS: pillow, Ubuntu:26.10: pillow, Ubuntu:26.04:LTS: pillow

(Pillow is a Python imaging library. Prior to 13.0.0, Pillow's ImageMor ...)