fix(image): charge GIF frames at the canvas size Pillow decodes them at

[badGarnet]

Summary

Follow-ups to the image pixel limit added in #4520.

• Charge each GIF frame at the canvas size Pillow decodes it at. A GIF frame that extends past the logical screen grows the canvas that it and every later frame are decoded onto. Pillow's frame count (n_frames) does not apply that growth, so the limit charged every frame at the first frame's size, and a small first frame followed by a large one was undercounted.
  • With hi_res, a GIF's frames are now measured by _iter_gif_canvas_sizes(), which reads each frame descriptor's position and size from the file.
  • It skips color tables and image data by their lengths, and stray bytes as Pillow does, without decompressing anything, so the work is linear in the file size.
  • It yields the running canvas size: the logical screen grown to fit every descriptor seen so far.
  • Other formats are unchanged.

Verification

• Exact match: on 2,000 generated GIFs with random logical screens, frame positions and sizes, extensions and stray bytes, the walker's per-frame canvas sizes equal the sizes Pillow decodes each frame at. This was run in a memory-capped container.
• Never fewer pixels: on 329 byte-mutated GIFs that Pillow could still decode, the walker never charged fewer pixels than Pillow decoded.

Tests

• GIF walker: matches Pillow's decoded canvas on a fixed canvas, growth on a later frame, growth by offset, and a first frame past the screen (with an extension and a stray byte).
• Growing canvas: a GIF whose canvas grows from 10×10 to 100×80 is admitted at its exact decoded total and rejected one below it, allocating no pixel buffer.
• Frame-header failure: a failure after one frame was measured, through partition_image. No partitioner, OCR or conversion runs, the original exception escapes, and the borrowed stream stays open at its position.
• ocr_only negative controls: whether requested directly or as hi_res's fallback when unstructured_inference is missing, ocr_only never reaches a later frame or a declared frame count, for TIFF, APNG and GIF. A hi_res control shows the same poison trips when frames are read.
• Forged frame count: a deterministic work count for a forged APNG acTL: one run, not one per declared frame.

🤖 Generated with Claude Code

[cubic-dev-ai]

All reported issues were addressed across 4 files

<sub>Shadow auto-approve: would not auto-approve because issues were found.

Re-trigger cubic</sub>

[cubic-dev-ai]

0 issues found across 2 files (changes from recent commits).

<sub>Shadow auto-approve: would not auto-approve. This PR does not meet the repository auto-approval settings.

Re-trigger cubic</sub>

[cragwolfe]

Oracle Pro production review of exact head 2c57730165909e7d5f0634a39f13f8629106abc6 against main f4105db674e4bf6c98ddb8fe6a5e32df0d7237b4, with complete untruncated image/PDF source and tests.

One verified High-severity regression prevents approval: malformed extension parsing can admit a fixed-canvas GIF whose actual decoded frame total exceeds IMAGE_MAX_TOTAL_PIXELS. A second, nonblocking follow-up concerns scanner-handle retention when rejection tracebacks are retained. See the inline evidence and acceptance criteria.

The ordinary canvas-growth arithmetic improves main, but it does not compensate for the introduced frame-enumeration bypass. Exact-head CI reports all 53 checks successful, including the Python 3.11–3.13 unit suites. Findings are source-derived; no local tests or source changes were performed.

(authored by codex)

[cragwolfe]

P1 / High: malformed extension can hide frames from the pixel budget. The extension label is discarded, and skip_sub_blocks() stops at the first zero. Pillow instead reads an initial extension block and then, for a non-comment extension, runs another while self.data() loop even if that initial block was empty. Insert 21 FF 00 3B, followed by 59 bytes of 41 and a final 00, between frame one and frame two of a fixed-canvas GIF. Pillow treats 3B as a 59-byte sub-block length and continues to later frames; this walker treats it as the trailer and returns normally after frame one. A three-frame 10×10 GIF with a 250-pixel budget is therefore charged 100 pixels and admitted here, whereas main's Pillow n_frames * image.size charges 300 and rejects it. The same mismatch scales past the default aggregate pixel budget while each frame remains below Pillow's individual bomb threshold.

Make extension consumption match Pillow, or reject malformed/ambiguous extensions before processing. Rejection must propagate; UnidentifiedImageError is swallowed by this checker. Add deterministic before-first-frame and between-frame fixtures, comparing real Pillow traversal against accounting; cover filename, bytes and borrowed streams, exact budget rejection, no downstream processing, and stream position/ownership. This finding is verified by source tracing, without local test execution.

(authored by codex)

[cragwolfe]

P2 / Medium, nonblocking follow-up: explicitly close the run generator on consumer-side rejection. For filename input this generator owns a second file handle. If the consumer raises UnprocessableEntityError after an over-budget yield, runs remains suspended inside this with open. A caller retaining the exception traceback also retains the consumer frame, its runs local, and that open descriptor. The Pillow context closes its own handle, not this scanner handle. Normal exhaustion or an exception raised inside the generator does unwind it, so this is conditional retention rather than an unconditional permanent leak.

Move owned-stream lifetime into the checker's enclosing context or explicitly close the generator on every exit. Validate closure while retaining the rejection exception/traceback, without forced GC, and retain borrowed-stream open-state/offset behavior.

(authored by codex)