Fix RLE4 absolute mode decoding for odd pixel counts

Tests/test_file_bmp.py

@@ -202,6 +202,44 @@ def test_rle4() -> None:
         assert_image_similar_tofile(im, "Tests/images/bmp/g/pal4.bmp", 12)
 
 
+def test_rle4_absolute_odd() -> None:
+    # An RLE4 absolute run with an odd number of pixels is packed into
+    # ceil(count / 2) bytes, the final nibble being padding. Build a 3x1
+    # image whose single row is one absolute run of 3 pixels (indices 1, 2, 3).
+    palette = b"".join(o32(c) for c in (0x000000, 0x0000FF, 0x00FF00, 0xFF0000))
+    palette += b"\x00" * (16 * 4 - len(palette))
+    rle = (
+        b"\x00\x03"  # absolute mode, 3 pixels
+        b"\x12\x30"  # nibbles 1, 2, 3 and a padding nibble
+        b"\x00\x01"  # end of bitmap
+    )
+    header = (
+        o32(40)  # header size
+        + o32(3)  # width
+        + o32(1)  # height
+        + o16(1)  # planes
+        + o16(4)  # bits per pixel
+        + o32(2)  # BI_RLE4 compression
+        + o32(len(rle))  # image size
+        + o32(0) * 2  # resolution
+        + o32(16)  # palette length
+        + o32(0)  # important colors
+    )
+    offset = 14 + len(header) + len(palette)
+    data = (
+        b"BM"
+        + o32(offset + len(rle))  # file size
+        + o32(0)  # reserved
+        + o32(offset)  # data offset
+        + header
+        + palette
+        + rle
+    )
+
+    with Image.open(io.BytesIO(data)) as im:
+        assert [im.getpixel((x, 0)) for x in range(3)] == [1, 2, 3]
+
+
 @pytest.mark.parametrize(
     "file_name,length",
     (

src/PIL/BmpImagePlugin.py

@@ -372,12 +372,13 @@ def decode(self, buffer: Image.DecoderInput) -> tuple[int, int]:
                 else:
                     # absolute mode
                     if rle4:
-                        # 2 pixels per byte
-                        byte_count = byte[0] // 2
+                        # 2 pixels per byte, padded up to a whole byte
+                        byte_count = (byte[0] + 1) // 2
                         bytes_read = self.fd.read(byte_count)
-                        for byte_read in bytes_read:
+                        for i, byte_read in enumerate(bytes_read):
                             data += o8(byte_read >> 4)
-                            data += o8(byte_read & 0x0F)
+                            if 2 * i + 1 < byte[0]:
+                                data += o8(byte_read & 0x0F)
                     else:
                         byte_count = byte[0]
                         bytes_read = self.fd.read(byte_count)