From b7471b5de2c35188c0df472171f8c8343d3f94ca Mon Sep 17 00:00:00 2001
From: Andrew Murray <radarhere@users.noreply.github.com>
Date: Sat, 25 Jul 2026 15:32:35 +1000
Subject: [PATCH] Add decompression bomb check after seek

---
 Tests/test_file_spider.py    | 20 ++++++++++++++++++++
 src/PIL/SpiderImagePlugin.py |  1 +
 2 files changed, 21 insertions(+)

diff --git a/Tests/test_file_spider.py b/Tests/test_file_spider.py
index 51e54798dfb..99386d42d6b 100644
--- a/Tests/test_file_spider.py
+++ b/Tests/test_file_spider.py
@@ -1,5 +1,6 @@
 from __future__ import annotations
 
+import struct
 import tempfile
 import warnings
 from io import BytesIO
@@ -177,3 +178,22 @@ def test_odd_size() -> None:
     data.seek(0)
     with Image.open(data) as im2:
         assert_image_equal(im, im2)
+
+
+def test_seek_decompression_bomb() -> None:
+    with open(TEST_FILE, "rb") as fp:
+        data = fp.read()
+    # istack
+    first_frame = data[: 23 * 4] + struct.pack("<f", 1) + data[24 * 4 :]
+    # frame count
+    first_frame = first_frame[: 25 * 4] + struct.pack("<f", 2) + first_frame[26 * 4 :]
+
+    # width
+    second_frame = data[: 11 * 4] + struct.pack("<f", 65535) + data[12 * 4 :]
+    # height
+    second_frame = (
+        second_frame[: 1 * 4] + struct.pack("<f", 65535) + second_frame[2 * 4 :]
+    )
+    with Image.open(BytesIO(first_frame + b"\x00" * 1024 + second_frame)) as im:
+        with pytest.raises(Image.DecompressionBombError):
+            im.seek(1)
diff --git a/src/PIL/SpiderImagePlugin.py b/src/PIL/SpiderImagePlugin.py
index 9e71c5fde8f..9321688cbb0 100644
--- a/src/PIL/SpiderImagePlugin.py
+++ b/src/PIL/SpiderImagePlugin.py
@@ -184,6 +184,7 @@ def seek(self, frame: int) -> None:
         self.fp = self._fp
         self.fp.seek(self.stkoffset)
         self._open()
+        Image._decompression_bomb_check(self.size)
 
     # returns a byte image after rescaling to 0..255
     def convert2byte(self, depth: int = 255) -> Image.Image: