Skip to content
Back to top
View this page

# 7.1.0

## Security

This release includes many security fixes.

### CVE 2020-10177: Multiple out-of-bounds reads in FLI decoding

Pillow before 7.1.0 has multiple out-of-bounds reads in `libImaging/FliDecode.c`.

### CVE 2020-10378: Bounds overflow in PCX decoding

In `libImaging/PcxDecode.c` in Pillow before 7.1.0, an out-of-bounds read can occur when reading PCX files where `state->shuffle` is instructed to read beyond `state->buffer`.

### CVE 2020-10379: Two buffer overflows in TIFF decoding

In Pillow before 7.1.0, there are two buffer overflows in `libImaging/TiffDecode.c`.

### CVE 2020-10994: Bounds overflow in JPEG 2000 decoding

In `libImaging/Jpeg2KDecode.c` in Pillow before 7.1.0, there are multiple out-of-bounds reads via a crafted JP2 file.

### CVE 2020-11538: Buffer overflow in SGI-RLE decoding

In `libImaging/SgiRleDecode.c` in Pillow through 7.0.0, a number of out-of-bounds reads exist in the parsing of SGI image files, a different issue than CVE 2020-5311.

## API changes

### Allow saving of zero quality JPEG images

If no quality was specified when saving a JPEG, Pillow internally used a value of zero to indicate that the default quality should be used. However, this removed the ability to actually save a JPEG with zero quality. This has now been resolved.

    from PIL import Image
    im = Image.open("hopper.jpg")
    im.save("out.jpg", quality=0)

## API additions

### New channel operations

Three new channel operations have been added: `soft_light()`, `hard_light()` and `overlay()`.

### PILLOW_VERSION constant

`PILLOW_VERSION` has been re-added but is deprecated and will be removed in a future release. Use `__version__` instead.

It was initially removed in Pillow 7.0.0, but brought back in 7.1.0 to give projects more time to upgrade.

### Reading JPEG comments

When opening a JPEG image, the comment may now be read into `info`.

### Support for different charset encodings in PcfFontFile

Previously `PcfFontFile` output only bitmap PIL fonts with ISO 8859-1 encoding, even though the PCF format supports Unicode, making it hard to work with Pillow with bitmap fonts in languages which use different character sets.

Now it’s possible to set a different charset encoding in `PcfFontFile`’s class constructor. By default, it generates a PIL font file with ISO 8859-1 as before. The generated PIL font file still contains up to 256 characters, but the character set is different depending on the selected encoding.

To use such a font with `ImageDraw.text`, call it with a bytes object with the same encoding as the font file.

### X11 ImageGrab.grab()

Support has been added for `ImageGrab.grab()` on Linux using the X server with the XCB library.

An optional `xdisplay` parameter has been added to select the X server, with the default value of `None` using the default X server.

Passing a different value on Windows or macOS will force taking a snapshot using the selected X server; pass an empty string to use the default X server. XCB support is not included in pre-compiled wheels for Windows and macOS.

## Other changes

### If present, only use alpha channel for bounding box

When the `getbbox()` method calculates the bounding box, for an RGB image it trims black pixels. Similarly, for an RGBA image it would trim black transparent pixels. This is now changed so that if an image has an alpha channel (RGBA, RGBa, PA, LA, La), any transparent pixels are trimmed.

### Improved APNG support

Added support for reading and writing Animated Portable Network Graphics (APNG) images. The PNG plugin now supports using the `seek()` method and the `Iterator` class to read APNG frame sequences. The PNG plugin also now supports using the `append_images` argument to write APNG frame sequences. See APNG sequences for further details.