OpenEXR 3.2.10__tar.gz → 3.2.11__tar.gz

{openexr-3.2.10 → openexr-3.2.11}/CHANGES.md

@@ -28,6 +28,7 @@
 * [Version 3.3.2](#version-332-november-11-2024) November 11, 2024
 * [Version 3.3.1](#version-331-october-8-2024) October 8, 2024
 * [Version 3.3.0](#version-330-september-30-2024) September 30, 2024
+* [Version 3.2.11](#version-3211-august-6-2026) August 6, 2026
 * [Version 3.2.10](#version-3210-june-21-2026) June 21, 2026
 * [Version 3.2.9](#version-329-april-29-2026) April 29, 2026
 * [Version 3.2.8](#version-328-april-17-2026) April 17, 2026
@@ -1761,6 +1762,124 @@ Fix macOS arm64 build
 Propagate dwa core 3 1
 * [1418](https://github.com/AcademySoftwareFoundation/openexr/pull/1418)
 
+## Version 3.2.11 (August 6, 2026)
+
+v3.2.11 is a security-focused patch release for the v3.2 release
+stream. It fixes 10 CVEs plus a set of additional hardening
+changes uncovered by the same fuzzing/audit effort.
+
+For each of these vulnerabilities, an attacker's vector is a
+maliciously crafted `.exr` file that must be opened by a victim,
+whether through the OpenEXR/OpenEXRUtil C++ libraries, the
+command-line tools (`exrmetrics`, `exrmultiview`, `exrmultipart`), or
+the PyOpenEXR Python bindings. The primary flaw for most of the CVEs
+is **memory corruption** — heap buffer overflows and out-of-bounds
+reads/writes — which at minimum crashes the reading process (denial of
+service) and in several cases could plausibly be leveraged for
+information disclosure or, in the worst cases, arbitrary code
+execution.
+
+No user interaction beyond opening the file is required, so any
+pipeline, service, or application that decodes untrusted or
+third-party EXR files should treat this as a priority
+upgrade. Severity generally ranges from **moderate** (crash-only, or
+requiring an uncommon build configuration) to **high** (heap overflow
+reachable with a small, easily-crafted file on common configurations).
+
+The individual vulnerabilities fall into four broad groups:
+
+* **Integer-overflow-driven heap overflows on 32-bit (ILP32) builds**
+  ([CVE-2026-59985](https://www.cve.org/CVERecord?id=CVE-2026-59985),
+  [CVE-2026-59984](https://www.cve.org/CVERecord?id=CVE-2026-59984),
+  [CVE-2026-59983](https://www.cve.org/CVERecord?id=CVE-2026-59983),
+  [CVE-2026-59982](https://www.cve.org/CVERecord?id=CVE-2026-59982),
+  [CVE-2026-59981](https://www.cve.org/CVERecord?id=CVE-2026-59981),
+  [CVE-2026-59189](https://www.cve.org/CVERecord?id=CVE-2026-59189),
+  [CVE-2026-59186](https://www.cve.org/CVERecord?id=CVE-2026-59186)).
+  On platforms where `size_t`/`int` are 32 bits, buffer sizes computed
+  from attacker-controlled header fields (dimensions, sample counts,
+  tile sizes) could overflow before an allocation or bounds check,
+  yielding an undersized buffer and a subsequent heap out-of-bounds
+  read or write during RLE, B44/B44A, or DWAA decompression, deep
+  sample-count-table decoding, or large-tile handling. These do not
+  affect typical 64-bit desktop/server builds, but are significant for
+  32-bit Linux, embedded, and some mobile/CI targets.
+
+* **Heap out-of-bounds access in `OpenEXRUtil` with non-default data
+  windows**
+  ([CVE-2026-59981](https://www.cve.org/CVERecord?id=CVE-2026-59981),
+  [CVE-2026-59189](https://www.cve.org/CVERecord?id=CVE-2026-59189),
+  [CVE-2026-59186](https://www.cve.org/CVERecord?id=CVE-2026-59186),
+  [CVE-2026-59184](https://www.cve.org/CVERecord?id=CVE-2026-59184)).
+  `FlatImageChannel`/`DeepImageChannel`/`SampleCountChannel` row
+  addressing assumed a data window originating at (0, 0). Crafted files
+  with a nonzero data window origin caused row-address computations to
+  land outside the allocated buffer, producing a heap read or write out
+  of bounds.
+
+* **Crashes from malformed metadata (denial of service)**
+  ([CVE-2026-61555](https://www.cve.org/CVERecord?id=CVE-2026-61555),
+  [CVE-2026-59183](https://www.cve.org/CVERecord?id=CVE-2026-59183)).
+  An empty `multiView` attribute could crash `viewFromChannelName()`,
+  and a signed integer overflow while decoding deep tile chunks could
+  lead to an out-of-bounds access. Both are reachable simply by opening
+  a crafted file and result in a crash rather than corrupting memory
+  in an attacker-controlled way.
+
+A couple of the merged pull requests below are incidental hardening
+rather than fixes for a specific numbered CVE — avoiding an unnecessary
+allocation in idmanifest parsing and a `Name::operator=`
+null-termination fix — but the bulk of this release is driven by the
+CVEs above.
+
+CVEs addressed:
+
+* [CVE-2026-61555](https://www.cve.org/CVERecord?id=CVE-2026-61555)
+  empty multiView viewFromChannelName file crash
+* [CVE-2026-59985](https://www.cve.org/CVERecord?id=CVE-2026-59985)
+  ILP32 OpenEXRCore RLE decode heap OOB read DoS
+* [CVE-2026-59984](https://www.cve.org/CVERecord?id=CVE-2026-59984)
+  ILP32 B44 InputFile decode scratch buffer overflow
+* [CVE-2026-59983](https://www.cve.org/CVERecord?id=CVE-2026-59983)
+  ILP32 DeepTiledInputFile sample count table decode OOB read
+* [CVE-2026-59982](https://www.cve.org/CVERecord?id=CVE-2026-59982)
+  ILP32 DWAA InputFile packed AC buffer overflow
+* [CVE-2026-59981](https://www.cve.org/CVERecord?id=CVE-2026-59981)
+  OpenEXRUtil SampleCountChannel row nonzero dataWindow heap OOB read
+* [CVE-2026-59189](https://www.cve.org/CVERecord?id=CVE-2026-59189)
+  OpenEXRUtil DeepImageChannel row nonzero dataWindow heap OOB read
+* [CVE-2026-59186](https://www.cve.org/CVERecord?id=CVE-2026-59186)
+  OpenEXR ILP32 TiledRgbaInputFile large tile Array2D heap OOB write
+* [CVE-2026-59184](https://www.cve.org/CVERecord?id=CVE-2026-59184)
+  OpenEXRUtil FlatImageChannel row nonzero dataWindow heap OOB write
+* [CVE-2026-59183](https://www.cve.org/CVERecord?id=CVE-2026-59183)
+  Signed Integer Overflow Leading to Out-of-Bounds Memory Access in Deep Tile Decoding
+
+### Merged Pull Requests
+
+* [2530](https://github.com/AcademySoftwareFoundation/openexr/pull/2530)
+  Fix exrmultiview heap OOB when union dataWindow misaligns with subsampling
+* [2500](https://github.com/AcademySoftwareFoundation/openexr/pull/2500)
+  Fix Name::operator= to null-terminate long strings
+* [2498](https://github.com/AcademySoftwareFoundation/openexr/pull/2498)
+  Avoid memory allocation in idmanifest parsing
+* [2496](https://github.com/AcademySoftwareFoundation/openexr/pull/2496)
+  Fix empty multiView crash in viewFromChannelName()
+* [2494](https://github.com/AcademySoftwareFoundation/openexr/pull/2494)
+  Reject oversized DWAA buffer allocations on ILP32
+* [2493](https://github.com/AcademySoftwareFoundation/openexr/pull/2493)
+  Fix ILP32 unpacked buffer size truncation in RLE decode
+* [2492](https://github.com/AcademySoftwareFoundation/openexr/pull/2492)
+  Fix ILP32 deep sample-count table size overflow in decoding
+* [2491](https://github.com/AcademySoftwareFoundation/openexr/pull/2491)
+  Fix ILP32 B44/B44A scratch buffer overflow in decode
+* [2488](https://github.com/AcademySoftwareFoundation/openexr/pull/2488)
+  Fix OpenEXRUtil row() OOB read with non-zero data window origin
+* [2486](https://github.com/AcademySoftwareFoundation/openexr/pull/2486)
+  Fix integer overflow in Array2D::resizeErase() on ILP32/LLP64 builds
+* [2484](https://github.com/AcademySoftwareFoundation/openexr/pull/2484)
+  Fix signed integer overflow in unpack_sample_table()
+
 ## Version 3.2.10 (June 21, 2026)
 
 Patch release for 3.2 addressing security issues

{openexr-3.2.10 → openexr-3.2.11}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: OpenEXR
-Version: 3.2.10
+Version: 3.2.11
 Summary: Python bindings for the OpenEXR image file format
 Author-Email: Contributors to the OpenEXR project <info@openexr.com>
 Project-URL: Homepage, https://openexr.com

{openexr-3.2.10 → openexr-3.2.11}/src/bin/exrmultiview/makeMultiView.cpp

@@ -110,6 +110,14 @@ makeMultiView (
             string         inChanName = j.name ();
             string outChanName = insertViewName (inChanName, viewNames, i);
 
+            if (inChannel.xSampling != 1 || inChannel.ySampling != 1)
+                THROW (IEX_NAMESPACE::ArgExc,
+                       "no support for subsampling:"
+                       << " channel " << inChanName
+                       << " of " << inFileNames[i]
+                       << " has subsampling " << inChannel.xSampling
+                       << ", " << inChannel.ySampling);
+            
             image.addChannel (outChanName, inChannel);
             image.channel (outChanName).black ();
 

{openexr-3.2.10 → openexr-3.2.11}/src/lib/OpenEXR/ImfArray.h

@@ -7,6 +7,9 @@
 #define INCLUDED_IMF_ARRAY_H
 
 #include "ImfForward.h"
+#include "IexBaseExc.h"
+
+#include <cstddef>
 
 //-------------------------------------------------------------------------
 //
@@ -54,8 +57,11 @@ public:
         _data = 0;
         _size = 0;
     }
-    Array (long size)
+    Array (long size) : _size (0), _data (0)
     {
+        if (size < 0)
+            throw IEX_NAMESPACE::ArgExc ("Array size must be non-negative");
+
         _data = new T[size];
         _size = size;
     }
@@ -158,6 +164,9 @@ template <class T>
 inline void
 Array<T>::resizeErase (long size)
 {
+    if (size < 0)
+        throw IEX_NAMESPACE::ArgExc ("Array size must be non-negative");
+
     T* tmp = new T[size];
     delete[] _data;
     _size = size;
@@ -168,6 +177,9 @@ template <class T>
 inline void
 Array<T>::resizeEraseUnsafe (long size)
 {
+    if (size < 0)
+        throw IEX_NAMESPACE::ArgExc ("Array size must be non-negative");
+
     delete[] _data;
     _data = 0;
     _size = 0;
@@ -183,9 +195,14 @@ inline Array2D<T>::Array2D () : _sizeX (0), _sizeY (0), _data (0)
 
 template <class T>
 inline Array2D<T>::Array2D (long sizeX, long sizeY)
-    : _sizeX (sizeX), _sizeY (sizeY), _data (new T[sizeX * sizeY])
+    : _sizeX (0), _sizeY (0), _data (0)
 {
-    // empty
+    if (sizeX < 0 || sizeY < 0)
+        throw IEX_NAMESPACE::ArgExc ("Array2D dimensions must be non-negative");
+
+    _sizeX = sizeX;
+    _sizeY = sizeY;
+    _data  = new T[(size_t) sizeX * (size_t) sizeY];
 }
 
 template <class T> inline Array2D<T>::~Array2D ()
@@ -211,7 +228,10 @@ template <class T>
 inline void
 Array2D<T>::resizeErase (long sizeX, long sizeY)
 {
-    T* tmp = new T[sizeX * sizeY];
+    if (sizeX < 0 || sizeY < 0)
+        throw IEX_NAMESPACE::ArgExc ("Array2D dimensions must be non-negative");
+
+    T* tmp = new T[(size_t) sizeX * (size_t) sizeY];
     delete[] _data;
     _sizeX = sizeX;
     _sizeY = sizeY;
@@ -222,11 +242,14 @@ template <class T>
 inline void
 Array2D<T>::resizeEraseUnsafe (long sizeX, long sizeY)
 {
+    if (sizeX < 0 || sizeY < 0)
+        throw IEX_NAMESPACE::ArgExc ("Array2D dimensions must be non-negative");
+
     delete[] _data;
     _data  = 0;
     _sizeX = 0;
     _sizeY = 0;
-    _data  = new T[sizeX * sizeY];
+    _data  = new T[(size_t) sizeX * (size_t) sizeY];
     _sizeX = sizeX;
     _sizeY = sizeY;
 }

{openexr-3.2.10 → openexr-3.2.11}/src/lib/OpenEXR/ImfIDManifest.cpp

@@ -177,21 +177,53 @@ readStringList (
         Xdr::read<CharPtrIO> (readPtr, numberOfStrings);
     }
 
-    vector<size_t> lengths (numberOfStrings);
+
+    if (numberOfStrings < 0)
+    {
+        throw IEX_NAMESPACE::InputExc (
+            "Negative count for number of strings");
+    }
+
+    if (readPtr + numberOfStrings > endPtr)
+    {
+        throw IEX_NAMESPACE::InputExc (
+            "IDManifest too small for string length table");
+    }
+
+
+    //
+    // compute total table size
+    //
+    const char* tablePtr = readPtr;
+
+    size_t totalTableSize = 0;
 
     for (int i = 0; i < numberOfStrings; ++i)
     {
-        lengths[i] = readVariableLengthInteger (readPtr, endPtr);
+        totalTableSize += readVariableLengthInteger (readPtr, endPtr);
+    }
+
+
+    if(readPtr + totalTableSize > endPtr)
+    {
+        throw IEX_NAMESPACE::InputExc ("IDManifest too small for string table");
     }
+
+    //
+    // now tablePtr points to size of string in string table, and readPtr
+    // points to the string itself
+    //
+
     for (int i = 0; i < numberOfStrings; ++i)
     {
 
-        if (readPtr + lengths[i] > endPtr)
+        size_t length = readVariableLengthInteger (tablePtr, endPtr);
+        if (readPtr + length > endPtr)
         {
             throw IEX_NAMESPACE::InputExc ("IDManifest too small for string");
         }
-        outputVector.insert (outputVector.end (), string (readPtr, lengths[i]));
-        readPtr += lengths[i];
+        outputVector.insert (outputVector.end (), string (readPtr, length));
+        readPtr += length;
     }
 }
 

{openexr-3.2.10 → openexr-3.2.11}/src/lib/OpenEXR/ImfMultiView.cpp

@@ -118,7 +118,7 @@ viewFromChannelName (const string& channel, const StringVector& multiView)
         // in the name belong to the default view.
         //
 
-        return multiView[0];
+        return defaultViewName (multiView);
     }
     else
     {

{openexr-3.2.10 → openexr-3.2.11}/src/lib/OpenEXR/ImfName.h

@@ -72,6 +72,7 @@ inline Name&
 Name::operator= (const char text[])
 {
     strncpy (_text, text, MAX_LENGTH);
+    _text[MAX_LENGTH] = 0;
     return *this;
 }
 

{openexr-3.2.10 → openexr-3.2.11}/src/lib/OpenEXRCore/decoding.c

@@ -24,12 +24,14 @@ update_pack_unpack_ptrs (exr_decode_pipeline_t* decode)
     if (stortype == EXR_STORAGE_DEEP_SCANLINE ||
         stortype == EXR_STORAGE_DEEP_TILED)
     {
-        size_t sampsize =
-            (((size_t) decode->chunk.width) * ((size_t) decode->chunk.height));
+        uint64_t sampsize64 =
+            ((uint64_t) decode->chunk.width) * ((uint64_t) decode->chunk.height);
 
         if ((decode->decode_flags & EXR_DECODE_SAMPLE_COUNTS_AS_INDIVIDUAL))
-            sampsize += 1;
-        sampsize *= sizeof (int32_t);
+            sampsize64 += 1;
+        sampsize64 *= sizeof (int32_t);
+        if (sampsize64 != (size_t) sampsize64) return EXR_ERR_OUT_OF_MEMORY;
+        size_t sampsize = (size_t) sampsize64;
 
         if (decode->chunk.sample_count_table_size == sampsize)
         {
@@ -70,12 +72,14 @@ update_pack_unpack_ptrs (exr_decode_pipeline_t* decode)
     }
     else
     {
+        if (decode->chunk.unpacked_size != (size_t) decode->chunk.unpacked_size)
+            return EXR_ERR_OUT_OF_MEMORY;
         rv = internal_decode_alloc_buffer (
             decode,
             EXR_TRANSCODE_BUFFER_UNPACKED,
             &(decode->unpacked_buffer),
             &(decode->unpacked_alloc_size),
-            decode->chunk.unpacked_size);
+            (size_t) decode->chunk.unpacked_size);
     }
 
     return rv;
@@ -339,8 +343,8 @@ unpack_sample_table (
     const struct _internal_exr_context* pctxt, exr_decode_pipeline_t* decode)
 {
     exr_result_t rv           = EXR_ERR_SUCCESS;
-    int32_t      w            = decode->chunk.width;
-    int32_t      h            = decode->chunk.height;
+    int64_t      w            = decode->chunk.width;
+    int64_t      h            = decode->chunk.height;
     uint64_t     totsamp      = 0;
     int32_t*     samptable    = decode->sample_count_table;
     size_t       combSampSize = 0;
@@ -350,7 +354,7 @@ unpack_sample_table (
 
     if ((decode->decode_flags & EXR_DECODE_SAMPLE_COUNTS_AS_INDIVIDUAL))
     {
-        for (int32_t y = 0; y < h; ++y)
+        for (int64_t y = 0; y < h; ++y)
         {
             int32_t *cursampline = samptable + y * w;
             int32_t prevsamp = 0;
@@ -371,7 +375,7 @@ unpack_sample_table (
     }
     else
     {
-        for (int32_t y = 0; y < h; ++y)
+        for (int64_t y = 0; y < h; ++y)
         {
             int32_t *cursampline = samptable + y * w;
             int32_t prevsamp = 0;

{openexr-3.2.10 → openexr-3.2.11}/src/lib/OpenEXRCore/internal_b44.c

@@ -648,12 +648,14 @@ internal_exr_undo_b44 (
     uint64_t               uncompressed_size)
 {
     exr_result_t rv;
+    uint64_t     scratch_sz = compute_scratch_buffer_size (decode, uncompressed_size);
+    if (scratch_sz != (size_t) scratch_sz) return EXR_ERR_OUT_OF_MEMORY;
     rv = internal_decode_alloc_buffer (
         decode,
         EXR_TRANSCODE_BUFFER_SCRATCH1,
         &(decode->scratch_buffer_1),
         &(decode->scratch_alloc_size_1),
-        compute_scratch_buffer_size (decode, uncompressed_size));
+        (size_t) scratch_sz);
     if (rv != EXR_ERR_SUCCESS) return rv;
 
     return uncompress_b44_impl (
@@ -673,12 +675,14 @@ internal_exr_undo_b44a (
     uint64_t               uncompressed_size)
 {
     exr_result_t rv;
+    uint64_t     scratch_sz = compute_scratch_buffer_size (decode, uncompressed_size);
+    if (scratch_sz != (size_t) scratch_sz) return EXR_ERR_OUT_OF_MEMORY;
     rv = internal_decode_alloc_buffer (
         decode,
         EXR_TRANSCODE_BUFFER_SCRATCH1,
         &(decode->scratch_buffer_1),
         &(decode->scratch_alloc_size_1),
-        compute_scratch_buffer_size (decode, uncompressed_size));
+        (size_t) scratch_sz);
     if (rv != EXR_ERR_SUCCESS) return rv;
 
     return uncompress_b44_impl (

{openexr-3.2.10 → openexr-3.2.11}/src/lib/OpenEXRCore/internal_dwa_compressor.h

@@ -1396,10 +1396,15 @@ DwaCompressor_initializeBuffers (DwaCompressor* me, size_t* bufferSize)
     if (maxLossyDctAcSize * numLossyDctChans > me->_packedAcBufferSize)
     {
         me->_packedAcBufferSize = maxLossyDctAcSize * numLossyDctChans;
+        if (me->_packedAcBufferSize > SIZE_MAX)
+        {
+            return EXR_ERR_OUT_OF_MEMORY;
+        }
+
         if (me->_packedAcBuffer != NULL) me->free_fn (me->_packedAcBuffer);
-        me->_packedAcBuffer = me->alloc_fn (me->_packedAcBufferSize);
+        me->_packedAcBuffer = me->alloc_fn ((size_t) me->_packedAcBufferSize);
         if (!me->_packedAcBuffer) return EXR_ERR_OUT_OF_MEMORY;
-        memset (me->_packedAcBuffer, 0, me->_packedAcBufferSize);
+        memset (me->_packedAcBuffer, 0, (size_t) me->_packedAcBufferSize);
     }
 
     //
@@ -1409,19 +1414,29 @@ DwaCompressor_initializeBuffers (DwaCompressor* me, size_t* bufferSize)
     if (maxLossyDctDcSize * numLossyDctChans > me->_packedDcBufferSize)
     {
         me->_packedDcBufferSize = maxLossyDctDcSize * numLossyDctChans;
+        if (me->_packedDcBufferSize > SIZE_MAX)
+        {
+            return EXR_ERR_OUT_OF_MEMORY;
+        }
+
         if (me->_packedDcBuffer != NULL) me->free_fn (me->_packedDcBuffer);
-        me->_packedDcBuffer = me->alloc_fn (me->_packedDcBufferSize);
+        me->_packedDcBuffer = me->alloc_fn ((size_t) me->_packedDcBufferSize);
         if (!me->_packedDcBuffer) return EXR_ERR_OUT_OF_MEMORY;
-        memset (me->_packedDcBuffer, 0, me->_packedDcBufferSize);
+        memset (me->_packedDcBuffer, 0, (size_t) me->_packedDcBufferSize);
     }
 
     if (rleBufferSize > me->_rleBufferSize)
     {
         me->_rleBufferSize = rleBufferSize;
+        if (rleBufferSize > SIZE_MAX)
+        {
+            return EXR_ERR_OUT_OF_MEMORY;
+        }
+
         if (me->_rleBuffer != 0) me->free_fn (me->_rleBuffer);
-        me->_rleBuffer = me->alloc_fn (rleBufferSize);
+        me->_rleBuffer = me->alloc_fn ((size_t) rleBufferSize);
         if (!me->_rleBuffer) return EXR_ERR_OUT_OF_MEMORY;
-        memset (me->_rleBuffer, 0, rleBufferSize);
+        memset (me->_rleBuffer, 0, (size_t) rleBufferSize);
     }
 
     //

{openexr-3.2.10 → openexr-3.2.11}/src/lib/OpenEXRCore/openexr_version.h

@@ -10,6 +10,6 @@
 
 #    define OPENEXR_VERSION_MAJOR 3
 #    define OPENEXR_VERSION_MINOR 2
-#    define OPENEXR_VERSION_PATCH 10
+#    define OPENEXR_VERSION_PATCH 11
 
 #endif

{openexr-3.2.10 → openexr-3.2.11}/src/lib/OpenEXRUtil/ImfDeepImageChannel.h

@@ -248,14 +248,14 @@ template <class T>
 inline T* const*
 TypedDeepImageChannel<T>::row (int r)
 {
-    return _base + r * pixelsPerRow ();
+    return _sampleListPointers + r * pixelsPerRow ();
 }
 
 template <class T>
 inline const T* const*
 TypedDeepImageChannel<T>::row (int r) const
 {
-    return _base + r * pixelsPerRow ();
+    return _sampleListPointers + r * pixelsPerRow ();
 }
 
 #ifndef COMPILING_IMF_DEEP_IMAGE_CHANNEL

{openexr-3.2.10 → openexr-3.2.11}/src/lib/OpenEXRUtil/ImfFlatImageChannel.h

@@ -199,14 +199,14 @@ template <class T>
 inline T*
 TypedFlatImageChannel<T>::row (int r)
 {
-    return _base + r * pixelsPerRow ();
+    return _pixels + r * pixelsPerRow ();
 }
 
 template <class T>
 inline const T*
 TypedFlatImageChannel<T>::row (int n) const
 {
-    return _base + n * pixelsPerRow ();
+    return _pixels + n * pixelsPerRow ();
 }
 
 #ifndef COMPILING_IMF_FLAT_IMAGE_CHANNEL

{openexr-3.2.10 → openexr-3.2.11}/src/lib/OpenEXRUtil/ImfSampleCountChannel.h

@@ -316,7 +316,7 @@ SampleCountChannel::at (int x, int y) const
 inline const unsigned int*
 SampleCountChannel::row (int n) const
 {
-    return _base + n * pixelsPerRow ();
+    return _numSamples + n * pixelsPerRow ();
 }
 
 OPENEXR_IMF_INTERNAL_NAMESPACE_HEADER_EXIT