Copy qtables list when saving JPEG image

Tests/test_file_jpeg.py

@@ -686,6 +686,15 @@ def _n_qtables_helper(n: int, test_file: str) -> None:
             with pytest.raises(ValueError):
                 self.roundtrip(im, qtables=[[1, 2, 3, 4]])
 
+    def test_qtables_incorrect_length(self) -> None:
+        class IncorrectLength(list[list[int]]):
+            def __len__(self) -> int:
+                return 4
+
+        im = Image.new("1", (1, 1))
+        im2 = self.roundtrip(im, qtables=IncorrectLength([[1] * 64]))
+        assert len(im2.quantization) == 1
+
     def test_load_16bit_qtables(self) -> None:
         with Image.open("Tests/images/hopper_16bit_qtables.jpg") as im:
             assert isinstance(im, JpegImagePlugin.JpegImageFile)

src/PIL/JpegImagePlugin.py

@@ -731,7 +731,8 @@ def validate_qtables(
                 qtables = [
                     qtables[key] for key in range(len(qtables)) if key in qtables
                 ]
-            elif isinstance(qtables, tuple):
+            else:
+                # Copy the sequence, so that it cannot be changed while it is read
                 qtables = list(qtables)
             if not (0 < len(qtables) < 5):
                 msg = "None or too many quantization tables"

src/encode.c

@@ -1113,10 +1113,10 @@ get_qtables_arrays(PyObject *qtables, int *qtablesLen) {
     }
 
     tables = PySequence_Fast(qtables, "expected a sequence");
-    if (!tables) {
+    if (tables == NULL) {
         return NULL;
     }
-    num_tables = PySequence_Size(qtables);
+    num_tables = PySequence_Fast_GET_SIZE(tables);
     if (num_tables < 1 || num_tables > NUM_QUANT_TBLS) {
         PyErr_SetString(
             PyExc_ValueError,
@@ -1137,12 +1137,13 @@ get_qtables_arrays(PyObject *qtables, int *qtablesLen) {
             PyErr_SetString(PyExc_ValueError, "Invalid quantization tables");
             goto JPEG_QTABLES_ERR;
         }
-        if (PySequence_Size(table) != DCTSIZE2) {
-            PyErr_SetString(PyExc_ValueError, "Invalid quantization table size");
+        table_data = PySequence_Fast(table, "expected a sequence");
+        if (table_data == NULL) {
             goto JPEG_QTABLES_ERR;
         }
-        table_data = PySequence_Fast(table, "expected a sequence");
-        if (!table_data) {
+        if (PySequence_Fast_GET_SIZE(table_data) != DCTSIZE2) {
+            Py_DECREF(table_data);
+            PyErr_SetString(PyExc_ValueError, "Invalid quantization table size");
             goto JPEG_QTABLES_ERR;
         }
         for (j = 0; j < DCTSIZE2; j++) {
@@ -1239,7 +1240,7 @@ PyImaging_JpegEncoderNew(PyObject *self, PyObject *args) {
 
     // Freed in JpegEncode, Case 6
     qarrays = get_qtables_arrays(qtables, &qtablesLen);
-    if (!qarrays && PyErr_Occurred()) {
+    if (qarrays == NULL && PyErr_Occurred()) {
         Py_DECREF(encoder);
         return NULL;
     }