where the decoder writes assuming 4 bytes per pixel into a 3 byte per pixel wide buffer, allowing writing 768 bytes off the end of the buffer. This overwrites objects in Python's stack, leading to a crash. https://github.com/python-pillow/Pillow/pull/1706 (There's also a newer upstream release but that will need additional checking before it can go in).