Pillow: NULL pointer dereference in Image.merge via an unvalidated band 0

QFinch assessment

Image.merge() checks the mode of every input band except band 0. If band 0 is a single-band I or F image, the native merge routine reads a pixel pointer that is NULL for those modes and the process crashes. The IPTC plugin reaches this from a plain Image.open() followed by a load, and IPTC has no magic-byte prefilter, so a crafted file with no recognizable header can drive it.

Potential impact

NULL pointer dereference in a C extension. A crafted file opened and loaded through the IPTC path crashes the worker process. This is a hard crash, not a Python exception an application can catch.

Technical context

The validation loop skips band 0: - src/PIL/Image.py:3795 iterates for band in bands[1:] and checks mode and size only for those. For an I or F image the 8-bit plane image8 is NULL (only image32 is set). ImagingMerge dereferences bands[0]->image8[y] for the multi-band output modes: - src/libImaging/Bands.c:302, :311, :321 The IPTC loader builds the band list from an attacker-typed sub-image and passes it to merge with the sub-image at index 0: - src/PIL/IptcImagePlugin.py:156-160 - src/PIL/IptcImagePlugin.py:169 registers the opener with no accept function.