Fix BMP RLE delta escape reading from wrong file position (#9443)

bysiber · radarhere · web-flow · commit 4777a0b31820 · 2026-02-21T14:21:48.000+02:00
Co-authored-by: Andrew Murray &lt;radarhere@users.noreply.github.com&gt;
diff --git a/Tests/images/pal8rletrns.png b/Tests/images/pal8rletrns.png
diff --git a/Tests/test_file_bmp.py b/Tests/test_file_bmp.py
@@ -221,6 +221,11 @@ def test_rle8_eof(file_name: str, length: int) -> None:
             im.load()
 
 
+def test_rle_delta() -> None:
+    with Image.open("Tests/images/bmp/q/pal8rletrns.bmp") as im:
+        assert_image_equal_tofile(im, "Tests/images/pal8rletrns.png")
+
+
 def test_unsupported_bmp_bitfields_layout() -> None:
     fp = io.BytesIO(
         o32(40)  # header size
diff --git a/src/PIL/BmpImagePlugin.py b/src/PIL/BmpImagePlugin.py
@@ -369,7 +369,7 @@ def decode(self, buffer: bytes | Image.SupportsArrayInterface) -> tuple[int, int
                     bytes_read = self.fd.read(2)
                     if len(bytes_read) < 2:
                         break
-                    right, up = self.fd.read(2)
+                    right, up = bytes_read
                     data += b"\x00" * (right + up * self.state.xsize)
                     x = len(data) % self.state.xsize
                 else:
