OpenEXR 3.3.12__tar.gz → 3.3.13__tar.gz

{openexr-3.3.12 → openexr-3.3.13}/CHANGES.md

@@ -16,6 +16,7 @@
 * [Version 3.4.2](#version-342-october-15-2025) October 15, 2025
 * [Version 3.4.1](#version-341-october-8-2025) October 8, 2025
 * [Version 3.4.0](#version-340-september-5-2025) September 5, 2025
+* [Version 3.3.13](#version-3313-august-6-2026) August 6, 2026
 * [Version 3.3.12](#version-3312-june-21-2026) June 21, 2026
 * [Version 3.3.11](#version-3311-april-29-2026) April 29, 2026
 * [Version 3.3.10](#version-339-april-17-2026) April 17, 2026
@@ -1031,10 +1032,164 @@ Fetch master branch of libdeflate on main
 * [1852](https://github.com/AcademySoftwareFoundation/openexr/pull/1852)
 Add an option to use TBB as the global provider
 
-## Version 3.3.12 (June 21, 2026)
+## Version 3.3.13 (August 6, 2026)
+
+v3.3.13 is a security-focused patch release for the v3.3 release
+stream. It fixes 15 CVEs plus a broad set of additional hardening
+changes uncovered by the same fuzzing/audit effort.
+
+For each of these vulnerabilities, an attacker's vector is a
+maliciously crafted `.exr` file that must be opened by a victim,
+whether through the OpenEXR/OpenEXRUtil C++ libraries, the
+command-line tools (`exrmetrics`, `exrmultiview`, `exrmultipart`), or
+the PyOpenEXR Python bindings. The primary flaw for most of the CVEs
+is **memory corruption** — heap buffer overflows and out-of-bounds
+reads/writes — which at minimum crashes the reading process (denial of
+service) and in several cases could plausibly be leveraged for
+information disclosure or, in the worst cases, arbitrary code
+execution.
+
+No user interaction beyond opening the file is required, so any
+pipeline, service, or application that decodes untrusted or
+third-party EXR files should treat this as a priority
+upgrade. Severity generally ranges from **moderate** (crash-only, or
+requiring an uncommon build configuration) to **high** (heap overflow
+reachable with a small, easily-crafted file on common configurations).
+
+The individual vulnerabilities fall into four broad groups:
+
+* **PyOpenEXR RGB-channel-coalescing bugs**
+  ([CVE-2026-68514](https://www.cve.org/CVERecord?id=CVE-2026-68514),
+  [CVE-2026-68513](https://www.cve.org/CVERecord?id=CVE-2026-68513),
+  [CVE-2026-62986](https://www.cve.org/CVERecord?id=CVE-2026-62986),
+  [CVE-2026-61703](https://www.cve.org/CVERecord?id=CVE-2026-61703)).
+  When the Python bindings combine per-channel data (e.g. `left.R`,
+  `left.G`, `left.B`) into a single coalesced RGB array, conflicting or
+  mismatched channel names/types were not fully validated, which could
+  undersize the destination NumPy buffer. The result is a heap buffer
+  overflow on read, or, in the deep-image case, disclosure of
+  uninitialized ("stale") heap memory through the returned array. This
+  affects only code paths that read files with `separate_channels=False`
+  (the default for RGB coalescing).
+
+* **Integer-overflow-driven heap overflows on 32-bit (ILP32) builds**
+  ([CVE-2026-59985](https://www.cve.org/CVERecord?id=CVE-2026-59985),
+  [CVE-2026-59984](https://www.cve.org/CVERecord?id=CVE-2026-59984),
+  [CVE-2026-59983](https://www.cve.org/CVERecord?id=CVE-2026-59983),
+  [CVE-2026-59982](https://www.cve.org/CVERecord?id=CVE-2026-59982),
+  [CVE-2026-59981](https://www.cve.org/CVERecord?id=CVE-2026-59981),
+  [CVE-2026-59189](https://www.cve.org/CVERecord?id=CVE-2026-59189),
+  [CVE-2026-59186](https://www.cve.org/CVERecord?id=CVE-2026-59186)).
+  On platforms where `size_t`/`int` are 32 bits, buffer sizes computed
+  from attacker-controlled header fields (dimensions, sample counts,
+  tile sizes) could overflow before an allocation or bounds check,
+  yielding an undersized buffer and a subsequent heap out-of-bounds
+  read or write during RLE, B44/B44A, or DWAA decompression, deep
+  sample-count-table decoding, or large-tile handling. These do not
+  affect typical 64-bit desktop/server builds, but are significant for
+  32-bit Linux, embedded, and some mobile/CI targets.
+
+* **Heap out-of-bounds access in `OpenEXRUtil` and the command-line
+  tools with non-default data windows**
+  ([CVE-2026-59981](https://www.cve.org/CVERecord?id=CVE-2026-59981),
+  [CVE-2026-59189](https://www.cve.org/CVERecord?id=CVE-2026-59189),
+  [CVE-2026-59187](https://www.cve.org/CVERecord?id=CVE-2026-59187),
+  [CVE-2026-59186](https://www.cve.org/CVERecord?id=CVE-2026-59186),
+  [CVE-2026-59184](https://www.cve.org/CVERecord?id=CVE-2026-59184)).
+  `FlatImageChannel`/`DeepImageChannel`/`SampleCountChannel` row
+  addressing, and the deep-pixel path in `exrmetrics`, assumed a
+  data window originating at (0, 0). Crafted files with a nonzero data
+  window origin, or subsampled channels, caused row-address
+  computations to land outside the allocated buffer, producing a heap
+  read or write out of bounds.
+
+* **Crashes from malformed metadata (denial of service)**
+  ([CVE-2026-61555](https://www.cve.org/CVERecord?id=CVE-2026-61555),
+  [CVE-2026-59183](https://www.cve.org/CVERecord?id=CVE-2026-59183)).
+  An empty `multiView` attribute could crash `viewFromChannelName()`,
+  and a signed integer overflow while decoding deep tile chunks could
+  lead to an out-of-bounds access. Both are reachable simply by opening
+  a crafted file and result in a crash rather than corrupting memory
+  in an attacker-controlled way.
+
+A handful of the merged pull requests below are incidental hardening
+rather than fixes for a specific numbered CVE — for example, avoiding an
+unnecessary allocation in idmanifest parsing, a `Name::operator=`
+null-termination fix, and the unrelated (non-security) multi-part
+loading fix carried over from PR #2148 — but the bulk of this release is
+driven by the CVEs above.
+
+CVEs addressed:
+
+* [CVE-2026-68514](https://www.cve.org/CVERecord?id=CVE-2026-68514)
+  PyOpenEXR deep prefixed literal RGB key collision heap buffer overflow
+* [CVE-2026-68513](https://www.cve.org/CVERecord?id=CVE-2026-68513)
+  PyOpenEXR prefixed literal RGB key collision heap buffer overflow
+* [CVE-2026-62986](https://www.cve.org/CVERecord?id=CVE-2026-62986)
+  PyOpenEXR deep prefixed RGB stale lane disclosure
+* [CVE-2026-61703](https://www.cve.org/CVERecord?id=CVE-2026-61703)
+  PyOpenEXR deep mixed RGB heap buffer overflow
+* [CVE-2026-61555](https://www.cve.org/CVERecord?id=CVE-2026-61555)
+  empty multiView viewFromChannelName file crash
+* [CVE-2026-59985](https://www.cve.org/CVERecord?id=CVE-2026-59985)
+  ILP32 OpenEXRCore RLE decode heap OOB read DoS
+* [CVE-2026-59984](https://www.cve.org/CVERecord?id=CVE-2026-59984)
+  ILP32 B44 InputFile decode scratch buffer overflow
+* [CVE-2026-59983](https://www.cve.org/CVERecord?id=CVE-2026-59983)
+  ILP32 DeepTiledInputFile sample count table decode OOB read
+* [CVE-2026-59982](https://www.cve.org/CVERecord?id=CVE-2026-59982)
+  ILP32 DWAA InputFile packed AC buffer overflow
+* [CVE-2026-59981](https://www.cve.org/CVERecord?id=CVE-2026-59981)
+  OpenEXRUtil SampleCountChannel row nonzero dataWindow heap OOB read
+* [CVE-2026-59189](https://www.cve.org/CVERecord?id=CVE-2026-59189)
+  OpenEXRUtil DeepImageChannel row nonzero dataWindow heap OOB read
+* [CVE-2026-59187](https://www.cve.org/CVERecord?id=CVE-2026-59187)
+  OpenEXR exrmetrics deep pixelmode heap buffer overflow
+* [CVE-2026-59186](https://www.cve.org/CVERecord?id=CVE-2026-59186)
+  OpenEXR ILP32 TiledRgbaInputFile large tile Array2D heap OOB write
+* [CVE-2026-59184](https://www.cve.org/CVERecord?id=CVE-2026-59184)
+  OpenEXRUtil FlatImageChannel row nonzero dataWindow heap OOB write
+* [CVE-2026-59183](https://www.cve.org/CVERecord?id=CVE-2026-59183)
+  Signed Integer Overflow Leading to Out-of-Bounds Memory Access in Deep Tile Decoding
 
+### Merged Pull Requests
 
-### Security
+* [2530](https://github.com/AcademySoftwareFoundation/openexr/pull/2530)
+  Fix exrmultiview heap OOB when union dataWindow misaligns with subsampling
+* [2529](https://github.com/AcademySoftwareFoundation/openexr/pull/2529)
+  Refuse to coalesce RGB channels when there's a conflicting channel name
+* [2527](https://github.com/AcademySoftwareFoundation/openexr/pull/2527)
+  Upgrade manylinux cibuildwheel images to manylinux_2_28
+* [2522](https://github.com/AcademySoftwareFoundation/openexr/pull/2522)
+  Fix name comparison in deep prefixed RGB channel coalescing
+* [2502](https://github.com/AcademySoftwareFoundation/openexr/pull/2502)
+  Reject mixed pixel types when coalescing RGB channels in PyOpenEXR.
+* [2500](https://github.com/AcademySoftwareFoundation/openexr/pull/2500)
+  Fix Name::operator= to null-terminate long strings
+* [2498](https://github.com/AcademySoftwareFoundation/openexr/pull/2498)
+  Avoid memory allocation in idmanifest parsing
+* [2496](https://github.com/AcademySoftwareFoundation/openexr/pull/2496)
+  Fix empty multiView crash in viewFromChannelName()
+* [2494](https://github.com/AcademySoftwareFoundation/openexr/pull/2494)
+  Reject oversized DWAA buffer allocations on ILP32
+* [2493](https://github.com/AcademySoftwareFoundation/openexr/pull/2493)
+  Fix ILP32 unpacked buffer size truncation in RLE decode
+* [2492](https://github.com/AcademySoftwareFoundation/openexr/pull/2492)
+  Fix ILP32 deep sample-count table size overflow in decoding
+* [2491](https://github.com/AcademySoftwareFoundation/openexr/pull/2491)
+  Fix ILP32 B44/B44A scratch buffer overflow in decode
+* [2488](https://github.com/AcademySoftwareFoundation/openexr/pull/2488)
+  Fix OpenEXRUtil row() OOB read with non-zero data window origin
+* [2487](https://github.com/AcademySoftwareFoundation/openexr/pull/2487)
+  Fix deep pixelmode heap buffer overflow in exrmetrics
+* [2486](https://github.com/AcademySoftwareFoundation/openexr/pull/2486)
+  Fix integer overflow in Array2D::resizeErase() on ILP32/LLP64 builds
+* [2484](https://github.com/AcademySoftwareFoundation/openexr/pull/2484)
+  Fix signed integer overflow in unpack_sample_table()
+* [2148](https://github.com/AcademySoftwareFoundation/openexr/pull/2148)
+  Fix unfinished multi-part file loading in the python wrapper
+
+## Version 3.3.12 (June 21, 2026)
 
 This release addresses the following security vulnerabilities:
 
@@ -1047,23 +1202,20 @@ This release addresses the following security vulnerabilities:
 
 ### Merged Pull Requests
 
-  * [2476](git@github.com:AcademySoftwareFoundation/openexr/pull/2476)
-Fix the DWAA size checks regression
-  * [2472](git@github.com:AcademySoftwareFoundation/openexr/pull/2472)
-Unlock write context in exr_get_chunk_table_offset() return paths
-  * [2468](git@github.com:AcademySoftwareFoundation/openexr/pull/2468)
-Fix infinite loop in SampleCountChannel roundListSizeUp()
-  * [2464](git@github.com:AcademySoftwareFoundation/openexr/pull/2464)
-Fix heap out-of-bounds write in SampleCountChannel row setter.
-  * [2463](git@github.com:AcademySoftwareFoundation/openexr/pull/2463)
-Fix integer overflow and invalid delete in OpenEXRUtil Image::resize()
-  * [2442](git@github.com:AcademySoftwareFoundation/openexr/pull/2442)
-Bugfix: Fix interger overflows
-  * [2438](git@github.com:AcademySoftwareFoundation/openexr/pull/2438)
-Break release.py into separate small scripts for each step
-
-### Merged Workflow Pull Requests
-
+* [2476](git@github.com:AcademySoftwareFoundation/openexr/pull/2476)
+  Fix the DWAA size checks regression
+* [2472](git@github.com:AcademySoftwareFoundation/openexr/pull/2472)
+  Unlock write context in exr_get_chunk_table_offset() return paths
+* [2468](git@github.com:AcademySoftwareFoundation/openexr/pull/2468)
+  Fix infinite loop in SampleCountChannel roundListSizeUp()
+* [2464](git@github.com:AcademySoftwareFoundation/openexr/pull/2464)
+  Fix heap out-of-bounds write in SampleCountChannel row setter.
+* [2463](git@github.com:AcademySoftwareFoundation/openexr/pull/2463)
+  Fix integer overflow and invalid delete in OpenEXRUtil Image::resize()
+* [2442](git@github.com:AcademySoftwareFoundation/openexr/pull/2442)
+  Bugfix: Fix interger overflows
+* [2438](git@github.com:AcademySoftwareFoundation/openexr/pull/2438)
+  Break release.py into separate small scripts for each step
 
 ## Version 3.3.11 (April 29, 2026)
 
@@ -1085,13 +1237,13 @@ Heap-buffer-overflow in `DwaCompressor_uncompress`
 ### Merged Pull Requests
 
 * [2383](https://github.com/AcademySoftwareFoundation/openexr/pull/2383)
-validate that the uncompressed sizes recorded in the dwa header are valid
+  validate that the uncompressed sizes recorded in the dwa header are valid
 * [2378](https://github.com/AcademySoftwareFoundation/openexr/pull/2378)
-Harden IDManifest parsing against illegal shift and string prefix OOB
+  Harden IDManifest parsing against illegal shift and string prefix OOB
 * [2377](https://github.com/AcademySoftwareFoundation/openexr/pull/2377)
-Fix OOB read when expanding IDManifest prefix-compressed strings
+  Fix OOB read when expanding IDManifest prefix-compressed strings
 * [2367](https://github.com/AcademySoftwareFoundation/openexr/pull/2367)
-Fix int overflow in ImageChannel::resize pixel count
+  Fix int overflow in ImageChannel::resize pixel count
 
 ## Version 3.3.10 (April 17, 2026)
 
@@ -1103,7 +1255,7 @@ Patch release that addresses the following security vulnerabilities:
 ### Merged Pull Requests
 
 * [2346](https://github.com/AcademySoftwareFoundation/openexr/pull/2346)
-Fix integer overflow in internal_dwa_compressor.h
+  Fix integer overflow in internal_dwa_compressor.h
 
 ## Version 3.3.9 (April 4, 2026)
 
@@ -6852,4 +7004,4 @@ the source code.
 
 ### Detailed Changes:
 
-* Initial release.
+* Initial release.

{openexr-3.3.12 → openexr-3.3.13}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: OpenEXR
-Version: 3.3.12
+Version: 3.3.13
 Summary: Python bindings for the OpenEXR image file format
 Author-Email: Contributors to the OpenEXR project <info@openexr.com>
 Project-URL: Homepage, https://openexr.com

{openexr-3.3.12 → openexr-3.3.13}/pyproject.toml

@@ -80,9 +80,9 @@ test-extras = ["test"]
 test-skip = ["*universal2:arm64"]
 build-verbosity = 1
 
-manylinux-x86_64-image = "manylinux2014"
-manylinux-i686-image = "manylinux2014"
-manylinux-aarch64-image = "manylinux2014"
+manylinux-x86_64-image = "manylinux_2_28"
+manylinux-i686-image = "manylinux_2_28"
+manylinux-aarch64-image = "manylinux_2_28"
 
 # Needed for full C++17 support
 [tool.cibuildwheel.macos.environment]

{openexr-3.3.12 → openexr-3.3.13}/src/bin/exrmetrics/exrmetrics.cpp

@@ -379,8 +379,8 @@ initAndReadDeepScanLine (
 
     sampleData.resize (numChans);
     channelNumber = 0;
-    for (ChannelList::ConstIterator i = in.header ().channels ().begin ();
-         i != in.header ().channels ().end ();
+    for (ChannelList::ConstIterator i = outHeader.channels ().begin ();
+         i != outHeader.channels ().end ();
          ++i)
     {
         int samplesize = pixelTypeSize (i.channel ().type);

{openexr-3.3.12 → openexr-3.3.13}/src/bin/exrmultiview/makeMultiView.cpp

@@ -107,6 +107,14 @@ makeMultiView (
             string         inChanName = j.name ();
             string outChanName = insertViewName (inChanName, viewNames, i);
 
+            if (inChannel.xSampling != 1 || inChannel.ySampling != 1)
+                THROW (IEX_NAMESPACE::ArgExc,
+                       "no support for subsampling:"
+                       << " channel " << inChanName
+                       << " of " << inFileNames[i]
+                       << " has subsampling " << inChannel.xSampling
+                       << ", " << inChannel.ySampling);
+            
             image.addChannel (outChanName, inChannel);
             image.channel (outChanName).black ();
 

{openexr-3.3.12 → openexr-3.3.13}/src/lib/OpenEXR/ImfArray.h

@@ -7,6 +7,9 @@
 #define INCLUDED_IMF_ARRAY_H
 
 #include "ImfForward.h"
+#include "IexBaseExc.h"
+
+#include <cstddef>
 
 //-------------------------------------------------------------------------
 //
@@ -54,8 +57,11 @@ public:
         _data = 0;
         _size = 0;
     }
-    Array (long size)
+    Array (long size) : _size (0), _data (0)
     {
+        if (size < 0)
+            throw IEX_NAMESPACE::ArgExc ("Array size must be non-negative");
+
         _data = new T[size];
         _size = size;
     }
@@ -158,6 +164,9 @@ template <class T>
 inline void
 Array<T>::resizeErase (long size)
 {
+    if (size < 0)
+        throw IEX_NAMESPACE::ArgExc ("Array size must be non-negative");
+
     T* tmp = new T[size];
     delete[] _data;
     _size = size;
@@ -168,6 +177,9 @@ template <class T>
 inline void
 Array<T>::resizeEraseUnsafe (long size)
 {
+    if (size < 0)
+        throw IEX_NAMESPACE::ArgExc ("Array size must be non-negative");
+
     delete[] _data;
     _data = 0;
     _size = 0;
@@ -183,9 +195,14 @@ inline Array2D<T>::Array2D () : _sizeX (0), _sizeY (0), _data (0)
 
 template <class T>
 inline Array2D<T>::Array2D (long sizeX, long sizeY)
-    : _sizeX (sizeX), _sizeY (sizeY), _data (new T[sizeX * sizeY])
+    : _sizeX (0), _sizeY (0), _data (0)
 {
-    // empty
+    if (sizeX < 0 || sizeY < 0)
+        throw IEX_NAMESPACE::ArgExc ("Array2D dimensions must be non-negative");
+
+    _sizeX = sizeX;
+    _sizeY = sizeY;
+    _data  = new T[(size_t) sizeX * (size_t) sizeY];
 }
 
 template <class T> inline Array2D<T>::~Array2D ()
@@ -211,7 +228,10 @@ template <class T>
 inline void
 Array2D<T>::resizeErase (long sizeX, long sizeY)
 {
-    T* tmp = new T[sizeX * sizeY];
+    if (sizeX < 0 || sizeY < 0)
+        throw IEX_NAMESPACE::ArgExc ("Array2D dimensions must be non-negative");
+
+    T* tmp = new T[(size_t) sizeX * (size_t) sizeY];
     delete[] _data;
     _sizeX = sizeX;
     _sizeY = sizeY;
@@ -222,11 +242,14 @@ template <class T>
 inline void
 Array2D<T>::resizeEraseUnsafe (long sizeX, long sizeY)
 {
+    if (sizeX < 0 || sizeY < 0)
+        throw IEX_NAMESPACE::ArgExc ("Array2D dimensions must be non-negative");
+
     delete[] _data;
     _data  = 0;
     _sizeX = 0;
     _sizeY = 0;
-    _data  = new T[sizeX * sizeY];
+    _data  = new T[(size_t) sizeX * (size_t) sizeY];
     _sizeX = sizeX;
     _sizeY = sizeY;
 }

{openexr-3.3.12 → openexr-3.3.13}/src/lib/OpenEXR/ImfIDManifest.cpp

@@ -177,21 +177,53 @@ readStringList (
         Xdr::read<CharPtrIO> (readPtr, numberOfStrings);
     }
 
-    vector<size_t> lengths (numberOfStrings);
+
+    if (numberOfStrings < 0)
+    {
+        throw IEX_NAMESPACE::InputExc (
+            "Negative count for number of strings");
+    }
+
+    if (readPtr + numberOfStrings > endPtr)
+    {
+        throw IEX_NAMESPACE::InputExc (
+            "IDManifest too small for string length table");
+    }
+
+
+    //
+    // compute total table size
+    //
+    const char* tablePtr = readPtr;
+
+    size_t totalTableSize = 0;
 
     for (int i = 0; i < numberOfStrings; ++i)
     {
-        lengths[i] = readVariableLengthInteger (readPtr, endPtr);
+        totalTableSize += readVariableLengthInteger (readPtr, endPtr);
+    }
+
+
+    if(readPtr + totalTableSize > endPtr)
+    {
+        throw IEX_NAMESPACE::InputExc ("IDManifest too small for string table");
     }
+
+    //
+    // now tablePtr points to size of string in string table, and readPtr
+    // points to the string itself
+    //
+
     for (int i = 0; i < numberOfStrings; ++i)
     {
 
-        if (readPtr + lengths[i] > endPtr)
+        size_t length = readVariableLengthInteger (tablePtr, endPtr);
+        if (readPtr + length > endPtr)
         {
             throw IEX_NAMESPACE::InputExc ("IDManifest too small for string");
         }
-        outputVector.insert (outputVector.end (), string (readPtr, lengths[i]));
-        readPtr += lengths[i];
+        outputVector.insert (outputVector.end (), string (readPtr, length));
+        readPtr += length;
     }
 }
 

{openexr-3.3.12 → openexr-3.3.13}/src/lib/OpenEXR/ImfMultiView.cpp

@@ -118,7 +118,7 @@ viewFromChannelName (const string& channel, const StringVector& multiView)
         // in the name belong to the default view.
         //
 
-        return multiView[0];
+        return defaultViewName (multiView);
     }
     else
     {

{openexr-3.3.12 → openexr-3.3.13}/src/lib/OpenEXR/ImfName.h

@@ -72,6 +72,7 @@ inline Name&
 Name::operator= (const char text[])
 {
     strncpy (_text, text, MAX_LENGTH);
+    _text[MAX_LENGTH] = 0;
     return *this;
 }
 

{openexr-3.3.12 → openexr-3.3.13}/src/lib/OpenEXRCore/decoding.c

@@ -26,12 +26,14 @@ update_pack_unpack_ptrs (exr_decode_pipeline_t* decode)
     if (stortype == EXR_STORAGE_DEEP_SCANLINE ||
         stortype == EXR_STORAGE_DEEP_TILED)
     {
-        size_t sampsize =
-            (((size_t) decode->chunk.width) * ((size_t) decode->chunk.height));
+        uint64_t sampsize64 =
+            ((uint64_t) decode->chunk.width) * ((uint64_t) decode->chunk.height);
 
         if ((decode->decode_flags & EXR_DECODE_SAMPLE_COUNTS_AS_INDIVIDUAL))
-            sampsize += 1;
-        sampsize *= sizeof (int32_t);
+            sampsize64 += 1;
+        sampsize64 *= sizeof (int32_t);
+        if (sampsize64 != (size_t) sampsize64) return EXR_ERR_OUT_OF_MEMORY;
+        size_t sampsize = (size_t) sampsize64;
 
         if (decode->chunk.sample_count_table_size == sampsize)
         {
@@ -72,12 +74,14 @@ update_pack_unpack_ptrs (exr_decode_pipeline_t* decode)
     }
     else
     {
+        if (decode->chunk.unpacked_size != (size_t) decode->chunk.unpacked_size)
+            return EXR_ERR_OUT_OF_MEMORY;
         rv = internal_decode_alloc_buffer (
             decode,
             EXR_TRANSCODE_BUFFER_UNPACKED,
             &(decode->unpacked_buffer),
             &(decode->unpacked_alloc_size),
-            decode->chunk.unpacked_size);
+            (size_t) decode->chunk.unpacked_size);
     }
 
     return rv;
@@ -215,8 +219,8 @@ static exr_result_t
 unpack_sample_table (exr_const_context_t ctxt, exr_decode_pipeline_t* decode)
 {
     exr_result_t rv           = EXR_ERR_SUCCESS;
-    int32_t      w            = decode->chunk.width;
-    int32_t      h            = decode->chunk.height;
+    int64_t      w            = decode->chunk.width;
+    int64_t      h            = decode->chunk.height;
     uint64_t     totsamp      = 0;
     int32_t*     samptable    = decode->sample_count_table;
     size_t       combSampSize = 0;
@@ -226,7 +230,7 @@ unpack_sample_table (exr_const_context_t ctxt, exr_decode_pipeline_t* decode)
 
     if ((decode->decode_flags & EXR_DECODE_SAMPLE_COUNTS_AS_INDIVIDUAL))
     {
-        for (int32_t y = 0; y < h; ++y)
+        for (int64_t y = 0; y < h; ++y)
         {
             int32_t* cursampline = samptable + y * w;
             int32_t  prevsamp    = 0;
@@ -246,7 +250,7 @@ unpack_sample_table (exr_const_context_t ctxt, exr_decode_pipeline_t* decode)
     }
     else
     {
-        for (int32_t y = 0; y < h; ++y)
+        for (int64_t y = 0; y < h; ++y)
         {
             int32_t* cursampline = samptable + y * w;
             int32_t  prevsamp    = 0;

{openexr-3.3.12 → openexr-3.3.13}/src/lib/OpenEXRCore/internal_b44.c

@@ -691,12 +691,14 @@ internal_exr_undo_b44 (
     uint64_t               uncompressed_size)
 {
     exr_result_t rv;
+    uint64_t     scratch_sz = compute_scratch_buffer_size (decode, uncompressed_size);
+    if (scratch_sz != (size_t) scratch_sz) return EXR_ERR_OUT_OF_MEMORY;
     rv = internal_decode_alloc_buffer (
         decode,
         EXR_TRANSCODE_BUFFER_SCRATCH1,
         &(decode->scratch_buffer_1),
         &(decode->scratch_alloc_size_1),
-        compute_scratch_buffer_size (decode, uncompressed_size));
+        (size_t) scratch_sz);
     if (rv != EXR_ERR_SUCCESS) return rv;
 
     return uncompress_b44_impl (
@@ -716,12 +718,14 @@ internal_exr_undo_b44a (
     uint64_t               uncompressed_size)
 {
     exr_result_t rv;
+    uint64_t     scratch_sz = compute_scratch_buffer_size (decode, uncompressed_size);
+    if (scratch_sz != (size_t) scratch_sz) return EXR_ERR_OUT_OF_MEMORY;
     rv = internal_decode_alloc_buffer (
         decode,
         EXR_TRANSCODE_BUFFER_SCRATCH1,
         &(decode->scratch_buffer_1),
         &(decode->scratch_alloc_size_1),
-        compute_scratch_buffer_size (decode, uncompressed_size));
+        (size_t) scratch_sz);
     if (rv != EXR_ERR_SUCCESS) return rv;
 
     return uncompress_b44_impl (

{openexr-3.3.12 → openexr-3.3.13}/src/lib/OpenEXRCore/internal_dwa_compressor.h

@@ -1402,10 +1402,15 @@ DwaCompressor_initializeBuffers (DwaCompressor* me, size_t* bufferSize)
     if (maxLossyDctAcSize * numLossyDctChans > me->_packedAcBufferSize)
     {
         me->_packedAcBufferSize = maxLossyDctAcSize * numLossyDctChans;
+        if (me->_packedAcBufferSize > SIZE_MAX)
+        {
+            return EXR_ERR_OUT_OF_MEMORY;
+        }
+
         if (me->_packedAcBuffer != NULL) me->free_fn (me->_packedAcBuffer);
-        me->_packedAcBuffer = me->alloc_fn (me->_packedAcBufferSize);
+        me->_packedAcBuffer = me->alloc_fn ((size_t) me->_packedAcBufferSize);
         if (!me->_packedAcBuffer) return EXR_ERR_OUT_OF_MEMORY;
-        memset (me->_packedAcBuffer, 0, me->_packedAcBufferSize);
+        memset (me->_packedAcBuffer, 0, (size_t) me->_packedAcBufferSize);
     }
 
     //
@@ -1415,19 +1420,29 @@ DwaCompressor_initializeBuffers (DwaCompressor* me, size_t* bufferSize)
     if (maxLossyDctDcSize * numLossyDctChans > me->_packedDcBufferSize)
     {
         me->_packedDcBufferSize = maxLossyDctDcSize * numLossyDctChans;
+        if (me->_packedDcBufferSize > SIZE_MAX)
+        {
+            return EXR_ERR_OUT_OF_MEMORY;
+        }
+
         if (me->_packedDcBuffer != NULL) me->free_fn (me->_packedDcBuffer);
-        me->_packedDcBuffer = me->alloc_fn (me->_packedDcBufferSize);
+        me->_packedDcBuffer = me->alloc_fn ((size_t) me->_packedDcBufferSize);
         if (!me->_packedDcBuffer) return EXR_ERR_OUT_OF_MEMORY;
-        memset (me->_packedDcBuffer, 0, me->_packedDcBufferSize);
+        memset (me->_packedDcBuffer, 0, (size_t) me->_packedDcBufferSize);
     }
 
     if (rleBufferSize > me->_rleBufferSize)
     {
         me->_rleBufferSize = rleBufferSize;
+        if (rleBufferSize > SIZE_MAX)
+        {
+            return EXR_ERR_OUT_OF_MEMORY;
+        }
+
         if (me->_rleBuffer != 0) me->free_fn (me->_rleBuffer);
-        me->_rleBuffer = me->alloc_fn (rleBufferSize);
+        me->_rleBuffer = me->alloc_fn ((size_t) rleBufferSize);
         if (!me->_rleBuffer) return EXR_ERR_OUT_OF_MEMORY;
-        memset (me->_rleBuffer, 0, rleBufferSize);
+        memset (me->_rleBuffer, 0, (size_t) rleBufferSize);
     }
 
     //

{openexr-3.3.12 → openexr-3.3.13}/src/lib/OpenEXRCore/openexr_version.h

@@ -10,6 +10,6 @@
 
 #    define OPENEXR_VERSION_MAJOR 3
 #    define OPENEXR_VERSION_MINOR 3
-#    define OPENEXR_VERSION_PATCH 12
+#    define OPENEXR_VERSION_PATCH 13
 
 #endif

{openexr-3.3.12 → openexr-3.3.13}/src/lib/OpenEXRUtil/ImfDeepImageChannel.h

@@ -248,14 +248,14 @@ template <class T>
 inline T* const*
 TypedDeepImageChannel<T>::row (int r)
 {
-    return _base + r * pixelsPerRow ();
+    return _sampleListPointers + r * pixelsPerRow ();
 }
 
 template <class T>
 inline const T* const*
 TypedDeepImageChannel<T>::row (int r) const
 {
-    return _base + r * pixelsPerRow ();
+    return _sampleListPointers + r * pixelsPerRow ();
 }
 
 #ifndef COMPILING_IMF_DEEP_IMAGE_CHANNEL

{openexr-3.3.12 → openexr-3.3.13}/src/lib/OpenEXRUtil/ImfFlatImageChannel.h

@@ -199,14 +199,14 @@ template <class T>
 inline T*
 TypedFlatImageChannel<T>::row (int r)
 {
-    return _base + r * pixelsPerRow ();
+    return _pixels + r * pixelsPerRow ();
 }
 
 template <class T>
 inline const T*
 TypedFlatImageChannel<T>::row (int n) const
 {
-    return _base + n * pixelsPerRow ();
+    return _pixels + n * pixelsPerRow ();
 }
 
 #ifndef COMPILING_IMF_FLAT_IMAGE_CHANNEL

{openexr-3.3.12 → openexr-3.3.13}/src/lib/OpenEXRUtil/ImfSampleCountChannel.h

@@ -316,7 +316,7 @@ SampleCountChannel::at (int x, int y) const
 inline const unsigned int*
 SampleCountChannel::row (int n) const
 {
-    return _base + n * pixelsPerRow ();
+    return _numSamples + n * pixelsPerRow ();
 }
 
 OPENEXR_IMF_INTERNAL_NAMESPACE_HEADER_EXIT