CVE-2026-54060: Pillow: `FontFile.compile()`: `Image.new()` called without `_decompression_bomb_check()`

PIL/FontFile.py FontFile.compile() assembles per-glyph images into a single combined bitmap using Image.new("1", (xsize, ysize)) without calling Image._decompression_bomb_check(). This is the base-class method shared by both BdfFontFile and PcfFontFile, and it is triggered whenever a loaded font is converted to an ImageFont or saved.

Neither BdfFontFile.BdfFontFile(fp) nor PcfFontFile.PcfFontFile(fp) is registered with Image.register_open(), so Pillow’s standard decompression bomb guard never fires for font objects. The compile step is the final opportunity to check the combined allocation — and it has no check.

Vulnerable code (PIL/FontFile.py lines ~64–92):

def compile(self) -> None:
if self.bitmap:
return

h = w = maxwidth = 0
lines = 1
for glyph in self.glyph:              # up to 256 glyph slots
if glyph:
d, dst, src, im = glyph
h = max(h, src[3] - src[1])   # max glyph height — attacker-controlled
w = w + (src[2] - src[0])
if w > WIDTH:                  # WIDTH = 800
lines += 1
w = src[2] - src[0]
maxwidth = max(maxwidth, w)

xsize = maxwidth                       # ≤ 800 (capped by WIDTH constant)
ysize = lines * h                      # ← lines(256) × h(65535) = 16,776,960

if xsize == 0 and ysize == 0:
return

self.ysize = h