From 59e690bd3ae1e331ce462a0d59a1ee522f6e578a Mon Sep 17 00:00:00 2001 From: Arthur031221 Date: Thu, 1 Oct 2026 07:47:21 +0800 Subject: [PATCH 1/3] Fix PSD layer tiles reading from the wrong file offset PsdImageFile.layers() parses each layer's channel data from a BytesIO copy of the layer info block, so the tile offsets it builds are positions within that copy, starting at 0. seek() then loads those tiles from the original file object, so the bytes actually decoded come from wherever that small offset lands in the real file, not from the layer's pixel data. Add self._layers_position, the real file offset the copy was read from, back onto each tile offset so seek() reads the correct bytes. --- Tests/test_file_psd.py | 16 ++++++++++++++++ docs/releasenotes/13.0.0.rst | 7 +++++++ src/PIL/PsdImagePlugin.py | 15 +++++++++++++++ 3 files changed, 38 insertions(+) diff --git a/Tests/test_file_psd.py b/Tests/test_file_psd.py index a376ba2e887..74540fd1f42 100644 --- a/Tests/test_file_psd.py +++ b/Tests/test_file_psd.py @@ -9,6 +9,7 @@ from PIL import Image, PsdImagePlugin from .helper import ( + assert_image_equal, assert_image_equal_tofile, assert_image_similar, hopper, @@ -111,6 +112,21 @@ def test_seek_tell() -> None: assert layer_number == 2 +def test_seek_position_reads_correct_layer_data() -> None: + # The "Background" layer of this file is pixel-identical to the merged + # image that is loaded before any seek() call. Seeking away and back to + # that layer must decode the same data, not whatever bytes happen to sit + # at that offset in the layer info block. + with Image.open(test_file) as im: + merged = im.copy() + + im.seek(2) + im.seek(1) + im.load() + + assert_image_equal(im, merged) + + def test_seek_eoferror() -> None: with Image.open(test_file) as im: with pytest.raises(EOFError): diff --git a/docs/releasenotes/13.0.0.rst b/docs/releasenotes/13.0.0.rst index b9906b7f19d..54ef1308952 100644 --- a/docs/releasenotes/13.0.0.rst +++ b/docs/releasenotes/13.0.0.rst @@ -228,3 +228,10 @@ position or contents. :py:meth:`~PIL.Image.Image.tobytes` also now explicitly cleans up its encoder on both success and failure, rather than relying on object destruction. + +Fixed reading PSD layers at the wrong file offset +^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ + +When seeking to a layer of a PSD image, the pixel data was read from the wrong +position in the file, so :py:meth:`~PIL.Image.Image.seek` returned unrelated +bytes reinterpreted as image data instead of that layer's actual content. diff --git a/src/PIL/PsdImagePlugin.py b/src/PIL/PsdImagePlugin.py index e39843e9dc8..154ae5e774c 100644 --- a/src/PIL/PsdImagePlugin.py +++ b/src/PIL/PsdImagePlugin.py @@ -160,6 +160,21 @@ def layers( self._fp.seek(self._layers_position) _layer_data = io.BytesIO(ImageFile._safe_read(self._fp, self._layers_size)) layers = _layerinfo(_layer_data, self._layers_size) + # _layerinfo() reads from a copy of the layer data starting at + # offset 0, but seek() reads tiles from the original file, so + # the tile offsets need to be shifted to be absolute. + layers = [ + ( + name, + mode, + bbox, + [ + tile._replace(offset=tile.offset + self._layers_position) + for tile in tiles + ], + ) + for name, mode, bbox, tiles in layers + ] self._n_frames = len(layers) return layers From 685ef1d1b78f851be83c3b680effbbf995a83960 Mon Sep 17 00:00:00 2001 From: Andrew Murray Date: Thu, 1 Oct 2026 16:40:05 +1000 Subject: [PATCH 2/3] Pass original file pointer to _layerinfo() --- Tests/test_file_psd.py | 20 +++++--------------- src/PIL/PsdImagePlugin.py | 18 +----------------- 2 files changed, 6 insertions(+), 32 deletions(-) diff --git a/Tests/test_file_psd.py b/Tests/test_file_psd.py index 74540fd1f42..1047c294438 100644 --- a/Tests/test_file_psd.py +++ b/Tests/test_file_psd.py @@ -112,19 +112,15 @@ def test_seek_tell() -> None: assert layer_number == 2 -def test_seek_position_reads_correct_layer_data() -> None: - # The "Background" layer of this file is pixel-identical to the merged - # image that is loaded before any seek() call. Seeking away and back to - # that layer must decode the same data, not whatever bytes happen to sit - # at that offset in the layer info block. +def test_seek_back_to_initial_frame() -> None: + # Seeking away from the initial frame and then back should produce the same image with Image.open(test_file) as im: - merged = im.copy() + initial_frame = im.copy() im.seek(2) im.seek(1) - im.load() - assert_image_equal(im, merged) + assert_image_equal(im, initial_frame) def test_seek_eoferror() -> None: @@ -244,11 +240,5 @@ def test_bounds_crash_overflow() -> None: with Image.open("Tests/images/psd-oob-write-overflow.psd") as im: assert isinstance(im, PsdImagePlugin.PsdImageFile) im.load() - if sys.maxsize <= 2**32: - with pytest.raises(OverflowError): - im.seek(im.n_frames) - else: + with pytest.raises(OverflowError if sys.maxsize <= 2**32 else ValueError): im.seek(im.n_frames) - - with pytest.raises(ValueError): - im.load() diff --git a/src/PIL/PsdImagePlugin.py b/src/PIL/PsdImagePlugin.py index 154ae5e774c..4bd6b3b90aa 100644 --- a/src/PIL/PsdImagePlugin.py +++ b/src/PIL/PsdImagePlugin.py @@ -158,23 +158,7 @@ def layers( if isinstance(self._fp, DeferredError): raise self._fp.ex self._fp.seek(self._layers_position) - _layer_data = io.BytesIO(ImageFile._safe_read(self._fp, self._layers_size)) - layers = _layerinfo(_layer_data, self._layers_size) - # _layerinfo() reads from a copy of the layer data starting at - # offset 0, but seek() reads tiles from the original file, so - # the tile offsets need to be shifted to be absolute. - layers = [ - ( - name, - mode, - bbox, - [ - tile._replace(offset=tile.offset + self._layers_position) - for tile in tiles - ], - ) - for name, mode, bbox, tiles in layers - ] + layers = _layerinfo(self._fp, self._layers_size) self._n_frames = len(layers) return layers From d8511d1ea5eea20f4286d5d48464d15ef77cf661 Mon Sep 17 00:00:00 2001 From: Arthur031221 Date: Thu, 1 Oct 2026 16:16:59 +0800 Subject: [PATCH 3/3] Pass original file pointer to _layerinfo() Applies radarhere's suggestion: read the layer info from the file directly so the tile offsets are already absolute, and use the test form from the same suggestion. --- Tests/test_file_psd.py | 20 +++++--------------- src/PIL/PsdImagePlugin.py | 18 +----------------- 2 files changed, 6 insertions(+), 32 deletions(-) diff --git a/Tests/test_file_psd.py b/Tests/test_file_psd.py index 74540fd1f42..1047c294438 100644 --- a/Tests/test_file_psd.py +++ b/Tests/test_file_psd.py @@ -112,19 +112,15 @@ def test_seek_tell() -> None: assert layer_number == 2 -def test_seek_position_reads_correct_layer_data() -> None: - # The "Background" layer of this file is pixel-identical to the merged - # image that is loaded before any seek() call. Seeking away and back to - # that layer must decode the same data, not whatever bytes happen to sit - # at that offset in the layer info block. +def test_seek_back_to_initial_frame() -> None: + # Seeking away from the initial frame and then back should produce the same image with Image.open(test_file) as im: - merged = im.copy() + initial_frame = im.copy() im.seek(2) im.seek(1) - im.load() - assert_image_equal(im, merged) + assert_image_equal(im, initial_frame) def test_seek_eoferror() -> None: @@ -244,11 +240,5 @@ def test_bounds_crash_overflow() -> None: with Image.open("Tests/images/psd-oob-write-overflow.psd") as im: assert isinstance(im, PsdImagePlugin.PsdImageFile) im.load() - if sys.maxsize <= 2**32: - with pytest.raises(OverflowError): - im.seek(im.n_frames) - else: + with pytest.raises(OverflowError if sys.maxsize <= 2**32 else ValueError): im.seek(im.n_frames) - - with pytest.raises(ValueError): - im.load() diff --git a/src/PIL/PsdImagePlugin.py b/src/PIL/PsdImagePlugin.py index 154ae5e774c..4bd6b3b90aa 100644 --- a/src/PIL/PsdImagePlugin.py +++ b/src/PIL/PsdImagePlugin.py @@ -158,23 +158,7 @@ def layers( if isinstance(self._fp, DeferredError): raise self._fp.ex self._fp.seek(self._layers_position) - _layer_data = io.BytesIO(ImageFile._safe_read(self._fp, self._layers_size)) - layers = _layerinfo(_layer_data, self._layers_size) - # _layerinfo() reads from a copy of the layer data starting at - # offset 0, but seek() reads tiles from the original file, so - # the tile offsets need to be shifted to be absolute. - layers = [ - ( - name, - mode, - bbox, - [ - tile._replace(offset=tile.offset + self._layers_position) - for tile in tiles - ], - ) - for name, mode, bbox, tiles in layers - ] + layers = _layerinfo(self._fp, self._layers_size) self._n_frames = len(layers) return layers