Add decompression bomb check to GdImageFile

Tests/test_file_gd.py

@@ -4,7 +4,7 @@
 
 import pytest
 
-from PIL import GdImageFile, UnidentifiedImageError
+from PIL import GdImageFile, Image, UnidentifiedImageError, _binary
 
 from .helper import assert_image_similar_tofile
 
@@ -31,6 +31,12 @@ def test_bad_mode() -> None:
         GdImageFile.open(TEST_GD_FILE, "bad mode")
 
 
+def test_decompression_bomb() -> None:
+    b = BytesIO(_binary.o16be(65535) + _binary.o16be(50000) + _binary.o16be(50000))
+    with pytest.raises(Image.DecompressionBombError):
+        GdImageFile.open(b)
+
+
 def test_invalid_file() -> None:
     invalid_file = "Tests/images/flower.jpg"
 

src/PIL/GdImageFile.py

@@ -30,7 +30,7 @@ class is not registered for use with :py:func:`PIL.Image.open()`.  To open a
 
 from typing import IO
 
-from . import ImageFile, ImagePalette, UnidentifiedImageError
+from . import Image, ImageFile, ImagePalette, UnidentifiedImageError
 from ._binary import i16be as i16
 from ._binary import i32be as i32
 from ._typing import StrOrBytesPath
@@ -59,6 +59,7 @@ def _open(self) -> None:
 
         self._mode = "P"
         self._size = i16(s, 2), i16(s, 4)
+        Image._decompression_bomb_check(self.size)
 
         true_color = s[6]
         true_color_offset = 2 if true_color else 0