Do not allow negative offset with memory mapping

Author: radarhere

Tests/test_imagefile.py

@@ -164,6 +164,11 @@ def test_negative_stride(self) -> None:
         with pytest.raises(OSError):
             p.close()
 
+    def test_negative_offset(self) -> None:
+        with Image.open("Tests/images/raw_negative_stride.bin") as im:
+            with pytest.raises(ValueError, match="Tile offset cannot be negative"):
+                im.load()
+
     def test_no_format(self) -> None:
         buf = BytesIO(b"\x00" * 255)
 

src/PIL/ImageFile.py

@@ -313,6 +313,9 @@ def load(self) -> Image.core.PixelAccess | None:
                 and args[0] == self.mode
                 and args[0] in Image._MAPMODES
             ):
+                if offset < 0:
+                    msg = "Tile offset cannot be negative"
+                    raise ValueError(msg)
                 try:
                     # use mmap, if possible
                     import mmap