Skip to content

Commit 89ebbc7

Browse files
aclark4lifeCopilot
andauthored
Update docs/handbook/security.rst
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
1 parent b71b4b9 commit 89ebbc7

File tree

1 file changed

+4
-3
lines changed

1 file changed

+4
-3
lines changed

docs/handbook/security.rst

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -140,11 +140,12 @@ Denial of service
140140
**D-1 — Decompression bomb**
141141

142142
A small compressed image can expand to gigabytes in memory.
143-
:py:data:`PIL.Image.MAX_IMAGE_PIXELS` (~89 MP by default) raises
143+
:py:data:`PIL.Image.MAX_IMAGE_PIXELS` raises
144144
``DecompressionBombError`` at 2× the limit and
145145
``DecompressionBombWarning`` at 1×. PNG text chunks are
146-
separately capped by ``PngImagePlugin.MAX_TEXT_CHUNK`` (1 MiB) and
147-
``MAX_TEXT_MEMORY`` (64 MiB).
146+
separately capped by ``PngImagePlugin.MAX_TEXT_CHUNK`` and
147+
``MAX_TEXT_MEMORY``. Check the values in your installed Pillow version at
148+
runtime or in the reference/source for the current defaults.
148149

149150
*Mitigations:* **never** set ``Image.MAX_IMAGE_PIXELS = None`` in production;
150151
treat ``DecompressionBombWarning`` as an error; set OS/container memory limits

0 commit comments

Comments
 (0)