From e79f9df52165f60830a16fc1e040495ebe9155f9 Mon Sep 17 00:00:00 2001
From: Jonnas Figueiredo <125215987+JonnasFigueiredo@users.noreply.github.com>
Date: Tue, 25 Aug 2026 20:50:17 -0300
Subject: [PATCH] Reject non-finite radius in BoxBlur

BoxBlur only checked `radius < 0`, so a NaN or infinite radius passed the
Python-level validation (`nan < 0` is False) and reached the C `box_blur`,
causing a heap-buffer-overflow. Validate that the radius is a finite,
non-negative number and raise ValueError, as is already done for negative
radii.
---
 Tests/test_image_filter.py | 14 ++++++++++++++
 src/PIL/ImageFilter.py     |  5 +++--
 2 files changed, 17 insertions(+), 2 deletions(-)

diff --git a/Tests/test_image_filter.py b/Tests/test_image_filter.py
index 4fa24e2f9c5..2ab3fa61bfb 100644
--- a/Tests/test_image_filter.py
+++ b/Tests/test_image_filter.py
@@ -235,6 +235,20 @@ def test_invalid_box_blur_filter(radius: int | tuple[int, int]) -> None:
         im.filter(box_blur_filter)
 
 
+@pytest.mark.parametrize(
+    "radius",
+    (
+        float("nan"),
+        float("inf"),
+        (float("nan"), 2),
+        (2, float("inf")),
+    ),
+)
+def test_box_blur_non_finite_radius(radius: float | tuple[float, float]) -> None:
+    with pytest.raises(ValueError):
+        ImageFilter.BoxBlur(radius)
+
+
 def test_rankfilter_size_1() -> None:
     im = Image.new("L", (3, 3), 128)
 
diff --git a/src/PIL/ImageFilter.py b/src/PIL/ImageFilter.py
index b5229cad92b..42ce646cc6d 100644
--- a/src/PIL/ImageFilter.py
+++ b/src/PIL/ImageFilter.py
@@ -17,6 +17,7 @@
 from __future__ import annotations
 
 import abc
+import math
 from typing import cast
 
 TYPE_CHECKING = False
@@ -222,8 +223,8 @@ class BoxBlur(MultibandFilter):
 
     def __init__(self, radius: float | Sequence[float]) -> None:
         xy = radius if isinstance(radius, (tuple, list)) else (radius, radius)
-        if xy[0] < 0 or xy[1] < 0:
-            msg = "radius must be >= 0"
+        if not all(math.isfinite(value) and value >= 0 for value in xy):
+            msg = "radius must be a finite number >= 0"
             raise ValueError(msg)
         self.radius = radius