GHSA-gg2r-wvfm-q9rx Pillow: MSP RLE decoder expands a tiny file into unbounded memory

• PyPI pillow: >= 4.1.0, < 13.0.0 → fixed in 13.0.0

Summary The MSP RLE decoder expands run-length data into an in-memory buffer with no cap tied to the declared image size. A small file that passes the pixel-count check can force hundreds of megabytes or more of allocation when the application loads pixels. Details The MSP decoder writes each run into an unbounded `io.BytesIO` and can expand roughly 85x per run: • `src/PIL/MspImagePlugin.py:144-146` Impact Memory-exhaustion denial of service from a tiny crafted image in any application that loads pixels. The expansion is decoupled from the declared pixel count, so `MAX_IMAGE_PIXELS` does not bound it.