From d3c00e3d7acff93da53d72880dc55761d22b31d6 Mon Sep 17 00:00:00 2001
From: Andrew Murray <radarhere@users.noreply.github.com>
Date: Tue, 22 Sep 2026 23:50:44 +1000
Subject: [PATCH] Restrict Dib paste box to bitmap

---
 Tests/test_imagewin.py | 15 +++++++++++++++
 src/display.c          | 16 ++++++++++++++++
 src/libImaging/Dib.c   |  3 ---
 3 files changed, 31 insertions(+), 3 deletions(-)

diff --git a/Tests/test_imagewin.py b/Tests/test_imagewin.py
index 18f7527a045..3a72878f695 100644
--- a/Tests/test_imagewin.py
+++ b/Tests/test_imagewin.py
@@ -104,6 +104,21 @@ def test_dib_paste_bbox(self) -> None:
         with pytest.raises(ValueError, match="images do not match"):
             dib.paste(im, (0, 0, 1, 1))
 
+        with pytest.raises(ValueError, match="left box co-ordinate cannot be negative"):
+            dib.paste(im, (-1, 0, 127, 128))
+        with pytest.raises(
+            ValueError, match="right box co-ordinate outside bitmap image"
+        ):
+            dib.paste(im, (128, 0, 256, 128))
+        with pytest.raises(
+            ValueError, match="upper box co-ordinate cannot be negative"
+        ):
+            dib.paste(im, (0, -1, 128, 127))
+        with pytest.raises(
+            ValueError, match="lower box co-ordinate outside bitmap image"
+        ):
+            dib.paste(im, (0, 128, 128, 256))
+
     def test_dib_frombytes_tobytes_roundtrip(self) -> None:
         # Arrange
         # Make two different DIB images
diff --git a/src/display.c b/src/display.c
index a950cffc127..32b3408d83c 100644
--- a/src/display.c
+++ b/src/display.c
@@ -137,11 +137,27 @@ _paste(ImagingDisplayObject *display, PyObject *args) {
     } else if (xy[2] - xy[0] != im->xsize) {
         return ImagingError_Mismatch();
     }
+    if (xy[0] < 0) {
+        PyErr_SetString(PyExc_ValueError, "left box co-ordinate cannot be negative");
+        return NULL;
+    }
+    if (xy[2] > display->dib->xsize) {
+        PyErr_SetString(PyExc_ValueError, "right box co-ordinate outside bitmap image");
+        return NULL;
+    }
     if (xy[3] <= xy[1]) {
         xy[3] = xy[1] + im->ysize;
     } else if (xy[3] - xy[1] != im->ysize) {
         return ImagingError_Mismatch();
     }
+    if (xy[1] < 0) {
+        PyErr_SetString(PyExc_ValueError, "upper box co-ordinate cannot be negative");
+        return NULL;
+    }
+    if (xy[3] > display->dib->ysize) {
+        PyErr_SetString(PyExc_ValueError, "lower box co-ordinate outside bitmap image");
+        return NULL;
+    }
 
     ImagingPasteDIB(display->dib, im, xy);
 
diff --git a/src/libImaging/Dib.c b/src/libImaging/Dib.c
index 2afe71d4ac9..75a6e6f3e3e 100644
--- a/src/libImaging/Dib.c
+++ b/src/libImaging/Dib.c
@@ -208,9 +208,6 @@ ImagingNewDIB(const ModeID mode, int xsize, int ysize) {
 void
 ImagingPasteDIB(ImagingDIB dib, Imaging im, int xy[4]) {
     /* Paste image data into a bitmap */
-
-    /* FIXME: check size! */
-
     int y;
     for (y = 0; y < im->ysize; y++) {
         dib->pack(