This update is broken. You are using function _string_length_check in the code but that function is not defined. Moreover, not all vulnerable methods are fixed.

For example, this code should raise an error:

>>> from PIL import ImageFont
>>> loaded_font = ImageFont.truetype("./FreeMono.ttf", 20, layout_engine=ImageFont.Layout.BASIC)
>>> loaded_font.getlength("A" * 1000001)
12000012.0

And this one demonstrates the missing function:

>>> from PIL import ImageFont
>>> loaded_font = ImageFont.truetype("./FreeMono.ttf", 20, layout_engine=ImageFont.Layout.BASIC)
>>> loaded_font.getsize("A" * 1000001)
<stdin>:1: DeprecationWarning: getsize is deprecated and will be removed in Pillow 10 (2023-07-01). Use getbbox or getlength instead.
Traceback (most recent call last):
  File "<stdin>", line 1, in <module>
  File "/usr/lib64/python3.11/site-packages/PIL/ImageFont.py", line 483, in getsize
    _string_length_check(text)
    ^^^^^^^^^^^^^^^^^^^^
NameError: name '_string_length_check' is not defined