OpenEXR 3.2.11__tar.gz → 3.2.12__tar.gz

{openexr-3.2.11 → openexr-3.2.12}/CHANGES.md

@@ -28,6 +28,7 @@
 * [Version 3.3.2](#version-332-november-11-2024) November 11, 2024
 * [Version 3.3.1](#version-331-october-8-2024) October 8, 2024
 * [Version 3.3.0](#version-330-september-30-2024) September 30, 2024
+* [Version 3.2.12](#version-3212-august-21-2026) August 21, 2026
 * [Version 3.2.11](#version-3211-august-6-2026) August 6, 2026
 * [Version 3.2.10](#version-3210-june-21-2026) June 21, 2026
 * [Version 3.2.9](#version-329-april-29-2026) April 29, 2026
@@ -1762,6 +1763,26 @@ Fix macOS arm64 build
 Propagate dwa core 3 1
 * [1418](https://github.com/AcademySoftwareFoundation/openexr/pull/1418)
 
+## Version 3.2.12 (August 21, 2026)
+
+v3.2.12 fixes two memory issues when parsing IDManifests. Corrupt
+or maliciously formed OpenEXR images could trigger excessive memory
+allocation, but only in code which decodes the idmanifest attribute.
+Other code is unaffected, even when handling files with idmanifest attributes
+
+CVEs have been requested for these issues.
+
+
+### Merged Pull Requests
+
+  * [2575](git@github.com:AcademySoftwareFoundation/openexr/pull/2575)
+don't preallocate manifest when parsing IDManifests
+  * [2572](git@github.com:AcademySoftwareFoundation/openexr/pull/2572)
+Bound IDManifest uncompressed size and version-field read
+
+### Merged Workflow Pull Requests
+
+
 ## Version 3.2.11 (August 6, 2026)
 
 v3.2.11 is a security-focused patch release for the v3.2 release

{openexr-3.2.11 → openexr-3.2.12}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: OpenEXR
-Version: 3.2.11
+Version: 3.2.12
 Summary: Python bindings for the OpenEXR image file format
 Author-Email: Contributors to the OpenEXR project <info@openexr.com>
 Project-URL: Homepage, https://openexr.com

{openexr-3.2.11 → openexr-3.2.12}/src/lib/OpenEXR/ImfIDManifest.cpp

@@ -14,6 +14,7 @@
 #include <openexr_compression.h>
 
 #include <algorithm>
+#include <limits>
 #include <stdint.h>
 #include <stdlib.h>
 #include <string.h>
@@ -348,6 +349,11 @@ IDManifest::IDManifest (const char* data, const char* endOfData)
 void
 IDManifest::init (const char* data, const char* endOfData)
 {
+    if (data + sizeof (unsigned int) > endOfData)
+    {
+        throw IEX_NAMESPACE::InputExc (
+            "IDManifest too small for version field");
+    }
 
     unsigned int version;
     Xdr::read<CharPtrIO> (data, version);
@@ -481,13 +487,17 @@ IDManifest::init (const char* data, const char* endOfData)
 
     _manifest.clear ();
 
-    _manifest.resize (manifestEntries);
+    if (manifestEntries <0)
+    {
+        throw IEX_NAMESPACE::InputExc ("bad number of ChannelGroupsManifests in IDManifest");
+    }
 
     for (int manifestEntry = 0; manifestEntry < manifestEntries;
          ++manifestEntry)
     {
 
-        ChannelGroupManifest& m = _manifest[manifestEntry];
+        _manifest.push_back(ChannelGroupManifest());
+        ChannelGroupManifest& m = _manifest.back();
 
         //
         // read header of this manifest entry
@@ -578,6 +588,34 @@ IDManifest::init (const char* data, const char* endOfData)
 
 IDManifest::IDManifest (const CompressedIDManifest& compressed)
 {
+    //
+    // Reject an implausible declared uncompressed size before allocating
+    // anything for it. The declared size is otherwise an unvalidated
+    // 64-bit value taken directly from the file, used as a buffer size
+    // before decompression (and thus before any check on its contents),
+    // which allows a tiny file to force an enormous, fully-committed
+    // allocation (a denial of service) or, at 0, a null-pointer
+    // dereference during `init`.
+    //
+    // OpenEXR places no fixed limit on data size (see setMaxImageSize(),
+    // which is off/unlimited by default), so a manifest legitimately may
+    // be very large; an absolute cap here would reject valid files. What
+    // must hold regardless of size is zlib's own maximum expansion ratio
+    // of ~1032:1, so scale the bound by the compressed size actually
+    // present in the file instead of an arbitrary constant.
+    //
+    static const uint64_t MAX_EXPANSION = 1032;
+
+    if (compressed._uncompressedDataSize == 0 ||
+        compressed._compressedDataSize >
+            std::numeric_limits<uint64_t>::max () / MAX_EXPANSION ||
+        compressed._uncompressedDataSize >
+            compressed._compressedDataSize * MAX_EXPANSION)
+    {
+        throw IEX_NAMESPACE::InputExc (
+            "IDManifest has an implausible uncompressed data size");
+    }
+
     //
     // decompress the compressed manifest
     //
@@ -602,7 +640,7 @@ IDManifest::IDManifest (const CompressedIDManifest& compressed)
             "IDManifest decompression (zlib) failed: mismatch in decompressed data size");
     }
 
-    init ((const char*) &uncomp[0], (const char*) &uncomp[0] + outSize);
+    init (uncomp.data (), uncomp.data () + outSize);
 }
 
 void

{openexr-3.2.11 → openexr-3.2.12}/src/lib/OpenEXRCore/openexr_version.h

@@ -10,6 +10,6 @@
 
 #    define OPENEXR_VERSION_MAJOR 3
 #    define OPENEXR_VERSION_MINOR 2
-#    define OPENEXR_VERSION_PATCH 11
+#    define OPENEXR_VERSION_PATCH 12
 
 #endif