Pillow Truncated Load Verdict

Decides whether a Pillow image-load path can silently accept an INCOMPLETE image. Pure function over facts you already have: no I/O, no image decoding, no dependency on Pillow.

Built for Pillow 12.3.0 (MIT-CMU). Not affiliated with or endorsed by the Pillow project.

THE SILENT FAILURE. `ImageFile.LOAD_TRUNCATED_IMAGES = True` is a line that appears in a great many codebases. It is added to stop an OSError that was firing on real user uploads, and it works -- the error goes away. What it does is turn a loud failure into a silent one.

The truncated image now LOADS. It reports its correct dimensions. It passes any check that looks at size or mode, generates a thumbnail, and is stored as a valid image. The part of the picture that was never uploaded is filled with flat grey, and nothing is raised at any point. Measured on 12.3.0: a JPEG cut to half its bytes loads at the correct 200x200 and 3 of 4 sampled rows are grey rather than the picture.

VERIFY() IS THE TRAP. It is the method people reach for BECAUSE it sounds like the validating one. Measured, on a truncated JPEG, it raises NOTHING -- it checks container structure, not whether the pixel data is all there. And it consumes the file object, so the load() afterwards fails with AssertionError instead of the real error, pointing at the wrong thing entirely. Both are reported wherever verify() appears, even when nothing can be truncated.

THE FLAG IS PROCESS-GLOBAL. It is module state, so any import anywhere in the process can set it -- including a dependency, at import time, in code you have never read. That is why "unknown" is the honest value for most applications rather than an evasion, and why this returns NOT_DETERMINABLE for it instead of assuming the default still holds.

IT STAYS QUIET WHERE THERE IS NOTHING TO SAY. Known-complete bytes settle the question whatever the flag is -- a checked Content-Length, a matched checksum -- so that returns SAFE. Calling load() immediately after open() is SAFE. Only open-only is flagged, because open() succeeds and reports the right size for a truncated file and the error surfaces later, wherever the pixels are first touched.

A HYPOTHESIS THAT DID NOT REPRODUCE, recorded rather than dropped: Pillow does not mangle Adobe CMYK JPEGs on a round trip in 12.3.0. Mode and pixel values came back intact. The README does not claim it.

VERIFIED: 16 tests, measured by running the suite, every mutation observed FAILING before restore -- including one that caught a gap in the TESTS rather than the code: worst-first finding order went unpinned until a mutation swapping unshift for push survived.

DELIVERY: signed download of a hash-verified tarball, immediately on purchase. Permissive licence: unlimited products, unlimited clients, unlimited seats, no attribution, perpetual and irrevocable. One restriction, do not republish the source as source.

Interface

What you call, and what comes back. Types and signatures only — the implementation ships with the source.

  export function evaluatePillowLoadPath(path: LoadPath): Verdict;

  export type Verdict = | { status: "SAFE";