OpenEXR 3.3.13__tar.gz → 3.3.15__tar.gz

{openexr-3.3.13 → openexr-3.3.15}/CHANGES.md

@@ -16,6 +16,8 @@
 * [Version 3.4.2](#version-342-october-15-2025) October 15, 2025
 * [Version 3.4.1](#version-341-october-8-2025) October 8, 2025
 * [Version 3.4.0](#version-340-september-5-2025) September 5, 2025
+* [Version 3.3.15](#version-3315-october-30-2026) October 30, 2026
+* [Version 3.3.14](#version-3314-august-21-2026) August 21, 2026
 * [Version 3.3.13](#version-3313-august-6-2026) August 6, 2026
 * [Version 3.3.12](#version-3312-june-21-2026) June 21, 2026
 * [Version 3.3.11](#version-3311-april-29-2026) April 29, 2026
@@ -1032,6 +1034,67 @@ Fetch master branch of libdeflate on main
 * [1852](https://github.com/AcademySoftwareFoundation/openexr/pull/1852)
 Add an option to use TBB as the global provider
 
+## Version 3.3.15 (October 30, 2026)
+
+Patch release that addresses the following security vulnerabilities:
+
+* ***CVE Pending*** ([GHSA-WHF5-29MJ-GP53](https://github.com/AcademySoftwareFoundation/openexr/security/advisories/GHSA-WHF5-29MJ-GP53)) Heap Out-of-Bounds Write via Signed Integer Overflow in DWAA/DWAB `LossyDctDecoder`
+* ***CVE Pending*** ([GHSA-RXWG-X3WX-PGFH](https://github.com/AcademySoftwareFoundation/openexr/security/advisories/GHSA-RXWG-X3WX-PGFH)) Heap out-of-bounds write via 32-bit tile-area integer overflow in `DeepTiledOutputFile` (deep-image re-save path) — possible incomplete fix of PR #939
+* ***CVE Pending*** ([GHSA-RJG8-982X-JHC2](https://github.com/AcademySoftwareFoundation/openexr/security/advisories/GHSA-RJG8-982X-JHC2)) Uninitialized Heap Memory Disclosure in DWA Decompression via Short zlib Stream Mapped to Success
+* ***CVE Pending*** ([GHSA-J76P-H7GW-VMPF](https://github.com/AcademySoftwareFoundation/openexr/security/advisories/GHSA-J76P-H7GW-VMPF)) Heap buffer overflow in the OpenEXR Python bindings when two RGB channel groups coalesce to the same key
+* ***CVE Pending*** ([GHSA-G248-596F-9995](https://github.com/AcademySoftwareFoundation/openexr/security/advisories/GHSA-G248-596F-9995)) Unvalidated extra `chlist` header attributes merged into `Header::channels()` cause a heap overflow in `run_fill`
+* ***CVE Pending*** ([GHSA-FRX8-5P4H-J8M7](https://github.com/AcademySoftwareFoundation/openexr/security/advisories/GHSA-FRX8-5P4H-J8M7)) Heap OOB Write via Integer Overflow in B44 Chunk Unpacked-Size Computation — Remote Code Execution in OpenEXRCore
+* ***CVE Pending*** ([GHSA-638X-X7MR-89XC](https://github.com/AcademySoftwareFoundation/openexr/security/advisories/GHSA-638X-X7MR-89XC)) Out-of-bounds write at an attacker-chosen displacement in legacy Python `InputFile.channel()`
+* ***CVE Pending*** ([GHSA-3CP4-779M-H837](https://github.com/AcademySoftwareFoundation/openexr/security/advisories/GHSA-3CP4-779M-H837)) Use-after-free in OpenEXRCore `exr_copy_unset_attributes()` when a channel name exceeds 31 bytes
+
+### Merged Pull Requests
+
+* [2760](https://github.com/AcademySoftwareFoundation/openexr/pull/2760)
+  Fix dangling channels pointer in exr_copy_unset_attributes() (by @cary-ilm/Cary Phillips)
+* [2757](https://github.com/AcademySoftwareFoundation/openexr/pull/2757)
+  Fix unsigned wraparound in legacy Python InputFile.channel() (by @cary-ilm/Cary Phillips)
+* [2749](https://github.com/AcademySoftwareFoundation/openexr/pull/2749)
+  Use size_t block indexing in DWA lossy DCT decoder (by @cary-ilm/Cary Phillips)
+* [2748](https://github.com/AcademySoftwareFoundation/openexr/pull/2748)
+  Fix tile area overflow in DeepTiledOutputFile::initialize (by @cary-ilm/Cary Phillips)
+* [2747](https://github.com/AcademySoftwareFoundation/openexr/pull/2747)
+  Reject Python RGB channel groups that coalesce to the same key (by @cary-ilm/Cary Phillips)
+* [2745](https://github.com/AcademySoftwareFoundation/openexr/pull/2745)
+  Only merge the "channels" chlist attribute into Header::channels() (by @cary-ilm/Cary Phillips)
+* [2744](https://github.com/AcademySoftwareFoundation/openexr/pull/2744)
+  Grow the part table geometrically when adding parts (by @cary-ilm/Cary Phillips)
+* [2718](https://github.com/AcademySoftwareFoundation/openexr/pull/2718)
+  Fix B44 integer overflow OOB write (by @cary-ilm/Cary Phillips)
+* [2717](https://github.com/AcademySoftwareFoundation/openexr/pull/2717)
+  Fix DWA uninitialized heap memory disclosure (by @cary-ilm/Cary Phillips)
+
+### Merged Workflow Pull Requests
+
+* [2711](https://github.com/AcademySoftwareFoundation/openexr/pull/2711)
+  Bump vmactions/freebsd-vm from 1.5.8 to 1.5.9 (by @app/dependabot)
+* [2703](https://github.com/AcademySoftwareFoundation/openexr/pull/2703)
+  Strip Contributors from notes in slack release post (by @cary-ilm/Cary Phillips)
+
+## Version 3.3.14 (August 21, 2026)
+
+v3.4.15 fixes two memory issues when parsing IDManifests. Corrupt
+or maliciously formed OpenEXR images could trigger excessive memory
+allocation, but only in code which decodes the idmanifest attribute.
+Other code is unaffected, even when handling files with idmanifest attributes
+
+CVEs have been requested for these issues.
+
+
+### Merged Pull Requests
+
+  * [2575](git@github.com:AcademySoftwareFoundation/openexr/pull/2575)
+don't preallocate manifest when parsing IDManifests
+  * [2572](git@github.com:AcademySoftwareFoundation/openexr/pull/2572)
+Bound IDManifest uncompressed size and version-field read
+
+### Merged Workflow Pull Requests
+
+
 ## Version 3.3.13 (August 6, 2026)
 
 v3.3.13 is a security-focused patch release for the v3.3 release

{openexr-3.3.13 → openexr-3.3.15}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: OpenEXR
-Version: 3.3.13
+Version: 3.3.15
 Summary: Python bindings for the OpenEXR image file format
 Author-Email: Contributors to the OpenEXR project <info@openexr.com>
 Project-URL: Homepage, https://openexr.com

{openexr-3.3.13 → openexr-3.3.15}/src/lib/OpenEXR/ImfContext.cpp

@@ -492,7 +492,12 @@ Context::header (int partidx) const
                 break;
 
             case EXR_ATTR_CHLIST: {
-                ChannelList& chans = hdr.channels ();
+                // Only the attribute named "channels" is validated by the
+                // core library and describes the pixel data; any other
+                // chlist attribute is kept as an ordinary attribute.
+                const bool   isChannels = !strcmp (cur->name, "channels");
+                ChannelList  other;
+                ChannelList& chans = isChannels ? hdr.channels () : other;
 
                 for (int c = 0; c < cur->chlist->num_channels; ++c)
                 {
@@ -506,6 +511,9 @@ Context::header (int partidx) const
                             curc.y_sampling,
                             curc.p_linear != 0));
                 }
+
+                if (!isChannels)
+                    hdr.insert (cur->name, ChannelListAttribute (other));
                 break;
             }
 

{openexr-3.3.13 → openexr-3.3.15}/src/lib/OpenEXR/ImfDeepTiledOutputFile.cpp

@@ -1200,22 +1200,25 @@ DeepTiledOutputFile::initialize (const Header& header)
     _data->minY             = dataWindow.min.y;
     _data->maxY             = dataWindow.max.y;
 
-    _data->maxSampleCountTableSize =
-        _data->tileDesc.ySize * _data->tileDesc.xSize * sizeof (int);
+    // widen before multiplying: the 32-bit product of the tile
+    // dimensions can wrap to 0 and bypass the limit below
+    const uint64_t tileArea = static_cast<uint64_t> (_data->tileDesc.ySize) *
+                              static_cast<uint64_t> (_data->tileDesc.xSize);
 
     //
     // impose limit of 2^32 bytes of storage for maxSampleCountTableSize
     // (disallow files with very large tile areas that would otherwise cause excessive memory allocation)
     //
 
-    if (_data->maxSampleCountTableSize >
-        std::numeric_limits<unsigned int>::max ())
+    if (tileArea > std::numeric_limits<unsigned int>::max () / sizeof (int))
     {
         THROW (
             IEX_NAMESPACE::ArgExc,
             "Deep tile size exceeds maximum permitted area");
     }
 
+    _data->maxSampleCountTableSize = tileArea * sizeof (int);
+
     //
     // Precompute level and tile information to speed up utility functions
     //

{openexr-3.3.13 → openexr-3.3.15}/src/lib/OpenEXR/ImfIDManifest.cpp

@@ -14,6 +14,7 @@
 #include <openexr_compression.h>
 
 #include <algorithm>
+#include <limits>
 #include <stdint.h>
 #include <stdlib.h>
 #include <string.h>
@@ -348,6 +349,11 @@ IDManifest::IDManifest (const char* data, const char* endOfData)
 void
 IDManifest::init (const char* data, const char* endOfData)
 {
+    if (data + sizeof (unsigned int) > endOfData)
+    {
+        throw IEX_NAMESPACE::InputExc (
+            "IDManifest too small for version field");
+    }
 
     unsigned int version;
     Xdr::read<CharPtrIO> (data, version);
@@ -478,13 +484,17 @@ IDManifest::init (const char* data, const char* endOfData)
 
     _manifest.clear ();
 
-    _manifest.resize (manifestEntries);
+    if (manifestEntries <0)
+    {
+        throw IEX_NAMESPACE::InputExc ("bad number of ChannelGroupsManifests in IDManifest");
+    }
 
     for (int manifestEntry = 0; manifestEntry < manifestEntries;
          ++manifestEntry)
     {
 
-        ChannelGroupManifest& m = _manifest[manifestEntry];
+        _manifest.push_back(ChannelGroupManifest());
+        ChannelGroupManifest& m = _manifest.back();
 
         //
         // read header of this manifest entry
@@ -575,6 +585,34 @@ IDManifest::init (const char* data, const char* endOfData)
 
 IDManifest::IDManifest (const CompressedIDManifest& compressed)
 {
+    //
+    // Reject an implausible declared uncompressed size before allocating
+    // anything for it. The declared size is otherwise an unvalidated
+    // 64-bit value taken directly from the file, used as a buffer size
+    // before decompression (and thus before any check on its contents),
+    // which allows a tiny file to force an enormous, fully-committed
+    // allocation (a denial of service) or, at 0, a null-pointer
+    // dereference during `init`.
+    //
+    // OpenEXR places no fixed limit on data size (see setMaxImageSize(),
+    // which is off/unlimited by default), so a manifest legitimately may
+    // be very large; an absolute cap here would reject valid files. What
+    // must hold regardless of size is zlib's own maximum expansion ratio
+    // of ~1032:1, so scale the bound by the compressed size actually
+    // present in the file instead of an arbitrary constant.
+    //
+    static const uint64_t MAX_EXPANSION = 1032;
+
+    if (compressed._uncompressedDataSize == 0 ||
+        compressed._compressedDataSize >
+            std::numeric_limits<uint64_t>::max () / MAX_EXPANSION ||
+        compressed._uncompressedDataSize >
+            compressed._compressedDataSize * MAX_EXPANSION)
+    {
+        throw IEX_NAMESPACE::InputExc (
+            "IDManifest has an implausible uncompressed data size");
+    }
+
     //
     // decompress the compressed manifest
     //
@@ -599,7 +637,7 @@ IDManifest::IDManifest (const CompressedIDManifest& compressed)
             "IDManifest decompression (zlib) failed: mismatch in decompressed data size");
     }
 
-    init ((const char*) &uncomp[0], (const char*) &uncomp[0] + outSize);
+    init (uncomp.data (), uncomp.data () + outSize);
 }
 
 void

{openexr-3.3.13 → openexr-3.3.15}/src/lib/OpenEXRCore/internal_b44.c

@@ -7,6 +7,7 @@
 #include "internal_decompress.h"
 
 #include "internal_coding.h"
+#include "internal_util.h"
 #include "internal_xdr.h"
 
 #include <string.h>
@@ -673,8 +674,14 @@ compute_scratch_buffer_size (
         if (nx % 4) nx += 4 - nx % 4;
         if (ny % 4) ny += 4 - ny % 4;
 
-        comp += (uint64_t) (ny) * (uint64_t) (nx) *
-                (uint64_t) (curc->bytes_per_element);
+        /* guard against a wrapped accumulation producing an
+         * implausibly small scratch requirement relative to what the
+         * decompressor will actually touch (see GHSA-frx8-5p4h-j8m7) */
+        if (checked_mul_accum_u64 (
+                &comp,
+                (uint64_t) ny * (uint64_t) nx,
+                (uint64_t) curc->bytes_per_element))
+            return UINT64_MAX;
     }
     if (comp > ret) ret = comp;
     return ret;
@@ -692,7 +699,8 @@ internal_exr_undo_b44 (
 {
     exr_result_t rv;
     uint64_t     scratch_sz = compute_scratch_buffer_size (decode, uncompressed_size);
-    if (scratch_sz != (size_t) scratch_sz) return EXR_ERR_OUT_OF_MEMORY;
+    if (scratch_sz == UINT64_MAX || scratch_sz != (size_t) scratch_sz)
+        return EXR_ERR_OUT_OF_MEMORY;
     rv = internal_decode_alloc_buffer (
         decode,
         EXR_TRANSCODE_BUFFER_SCRATCH1,
@@ -719,7 +727,8 @@ internal_exr_undo_b44a (
 {
     exr_result_t rv;
     uint64_t     scratch_sz = compute_scratch_buffer_size (decode, uncompressed_size);
-    if (scratch_sz != (size_t) scratch_sz) return EXR_ERR_OUT_OF_MEMORY;
+    if (scratch_sz == UINT64_MAX || scratch_sz != (size_t) scratch_sz)
+        return EXR_ERR_OUT_OF_MEMORY;
     rv = internal_decode_alloc_buffer (
         decode,
         EXR_TRANSCODE_BUFFER_SCRATCH1,

{openexr-3.3.13 → openexr-3.3.15}/src/lib/OpenEXRCore/internal_dwa_compressor.h

@@ -872,6 +872,8 @@ DwaCompressor_uncompress (
 
     if (unknownCompressedSize > 0)
     {
+        size_t unknownActualOut;
+
         if (unknownUncompressedSize > me->_planarUncBufferSize[UNKNOWN])
         {
             return EXR_ERR_CORRUPT_CHUNK;
@@ -883,7 +885,18 @@ DwaCompressor_uncompress (
                                    unknownCompressedSize,
                                    me->_planarUncBuffer[UNKNOWN],
                                    unknownUncompressedSize,
-                                   NULL))
+                                   &unknownActualOut))
+        {
+            return EXR_ERR_CORRUPT_CHUNK;
+        }
+
+        /* A short zlib stream (fewer bytes produced than requested) is
+         * reported as success (see translate_deflate_result), leaving
+         * the tail of _planarUncBuffer[UNKNOWN] filled with stale heap
+         * contents that are then copied into the decoded image. Reject
+         * it explicitly instead of trusting the full buffer was written
+         * (see GHSA-rjg8-982x-jhc2). */
+        if (unknownActualOut != unknownUncompressedSize)
         {
             return EXR_ERR_CORRUPT_CHUNK;
         }

{openexr-3.3.13 → openexr-3.3.15}/src/lib/OpenEXRCore/internal_dwa_decoder.h

@@ -292,8 +292,8 @@ LossyDctDecoder_execute (
     int                  numComp = d->_channel_decode_data_count;
     DctCoderChannelData* chanData[3];
     int                  lastNonZero = 0;
-    int                  numBlocksX  = (d->_width + 7) / 8;
-    int                  numBlocksY  = (d->_height + 7) / 8;
+    int                  numBlocksX  = (int) (((int64_t) d->_width + 7) / 8);
+    int                  numBlocksY  = (int) (((int64_t) d->_height + 7) / 8);
     int                  leftoverX   = d->_width - (numBlocksX - 1) * 8;
     int                  leftoverY   = d->_height - (numBlocksY - 1) * 8;
 
@@ -320,9 +320,15 @@ LossyDctDecoder_execute (
     // Allocate a temp aligned buffer to hold a rows worth of full
     // 8x8 half-float blocks
     //
-    rowBlockHandle = alloc_fn (
-        (size_t) numComp * (size_t) numBlocksX * 64 * sizeof (uint16_t) +
-        _SSE_ALIGNMENT);
+    // (computed in 64 bits: with a 32-bit size_t the product can wrap
+    // and under-allocate for very wide chunks)
+    //
+    uint64_t rowBlockBytes = (uint64_t) numComp * (uint64_t) numBlocksX * 64 *
+                                 sizeof (uint16_t) +
+                             _SSE_ALIGNMENT;
+    if (rowBlockBytes > SIZE_MAX) return EXR_ERR_OUT_OF_MEMORY;
+
+    rowBlockHandle = alloc_fn ((size_t) rowBlockBytes);
     if (!rowBlockHandle) return EXR_ERR_OUT_OF_MEMORY;
 
     rowBlock[0] = (uint16_t*) simd_align_pointer (rowBlockHandle);
@@ -513,13 +519,13 @@ LossyDctDecoder_execute (
                 if (!blockIsConstant)
                 {
                     (*convertFloatToHalf64) (
-                        &rowBlock[comp][blockx * 64], chanData[comp]->_dctData);
+                        &rowBlock[comp][(uint64_t) blockx * 64], chanData[comp]->_dctData);
                 }
                 else
                 {
 #ifdef IMF_HAVE_SSE2
 
-                    __m128i* dst = (__m128i*) &rowBlock[comp][blockx * 64];
+                    __m128i* dst = (__m128i*) &rowBlock[comp][(uint64_t) blockx * 64];
 
                     dst[0] = _mm_set1_epi16 (
                         (short) float_to_half (chanData[comp]->_dctData[0]));
@@ -534,7 +540,7 @@ LossyDctDecoder_execute (
 
 #else /* IMF_HAVE_SSE2 */
 
-                    uint16_t* dst = &rowBlock[comp][blockx * 64];
+                    uint16_t* dst = &rowBlock[comp][(uint64_t) blockx * 64];
 
                     dst[0] = float_to_half (chanData[comp]->_dctData[0]);
 
@@ -661,7 +667,7 @@ LossyDctDecoder_execute (
                     for (int blockx = 0; blockx < numFullBlocksX; ++blockx)
                     {
                         uint16_t* restrict src =
-                            &rowBlock[comp][blockx * 64 + ((y & 0x7) * 8)];
+                            &rowBlock[comp][(uint64_t) blockx * 64 + ((y & 0x7) * 8)];
 
                         dst[0] = d->_toLinear[src[0]];
                         dst[1] = d->_toLinear[src[1]];
@@ -687,7 +693,7 @@ LossyDctDecoder_execute (
                     for (int blockx = 0; blockx < numFullBlocksX; ++blockx)
                     {
                         uint16_t* src =
-                            &rowBlock[comp][blockx * 64 + ((y & 0x7) * 8)];
+                            &rowBlock[comp][(uint64_t) blockx * 64 + ((y & 0x7) * 8)];
                         memcpy (dst, src, 8*sizeof(uint16_t));
                         dst += 8;
                     }
@@ -706,7 +712,7 @@ LossyDctDecoder_execute (
                 for (int y = 8 * blocky; y < 8 * blocky + maxY; ++y)
                 {
                     uint16_t* src = (uint16_t*) &rowBlock[comp]
-                                                         [numFullBlocksX * 64 +
+                                                         [(uint64_t) numFullBlocksX * 64 +
                                                           ((y & 0x7) * 8)];
 
                     uint16_t* dst = (uint16_t*) chanData[comp]->_rows[y];

{openexr-3.3.13 → openexr-3.3.15}/src/lib/OpenEXRCore/internal_structs.c

@@ -9,6 +9,7 @@
 #include "internal_constants.h"
 #include "internal_memory.h"
 
+#include <limits.h>
 #include <stdarg.h>
 #include <stdio.h>
 #include <string.h>
@@ -178,8 +179,9 @@ internal_exr_destroy_parts (exr_context_t ctxt)
 
     if (ctxt->parts != &(ctxt->init_part)) ctxt->free_fn (ctxt->parts);
     ctxt->init_part = NULL;
-    ctxt->parts     = NULL;
-    ctxt->num_parts = 0;
+    ctxt->parts         = NULL;
+    ctxt->part_capacity = 0;
+    ctxt->num_parts     = 0;
 }
 
 /**************************************/
@@ -191,6 +193,7 @@ internal_exr_add_part (
     int              ncount = f->num_parts + 1;
     exr_priv_part_t  part;
     exr_priv_part_t* nptrs = NULL;
+    int              newcapacity = 0;
 
     if (new_index) *new_index = f->num_parts;
 
@@ -201,18 +204,32 @@ internal_exr_add_part (
         /* also need a pointer to pointer... */
         f->init_part = part;
         nptrs        = &(f->init_part);
+        newcapacity  = 1;
     }
     else
     {
         part = f->alloc_fn (sizeof (struct _priv_exr_part_t));
         if (!part) return f->standard_error (f, EXR_ERR_OUT_OF_MEMORY);
 
-        nptrs = f->alloc_fn (sizeof (exr_priv_part_t) * (size_t) ncount);
-        if (!nptrs)
+        if (ncount > f->part_capacity)
         {
-            f->free_fn (part);
-            return f->standard_error (f, EXR_ERR_OUT_OF_MEMORY);
+            /* grow geometrically so adding N parts is O(N), not O(N^2) */
+            int newcap = f->part_capacity < 4
+                             ? 4
+                             : (f->part_capacity <= INT_MAX / 2
+                                    ? f->part_capacity * 2
+                                    : ncount);
+
+            nptrs = f->alloc_fn (sizeof (exr_priv_part_t) * (size_t) newcap);
+            if (!nptrs)
+            {
+                f->free_fn (part);
+                return f->standard_error (f, EXR_ERR_OUT_OF_MEMORY);
+            }
+            newcapacity = newcap;
         }
+        else
+            nptrs = f->parts;
     }
     memset (part, 0, sizeof (struct _priv_exr_part_t));
 
@@ -229,15 +246,19 @@ internal_exr_add_part (
     part->dwa_compression_level = f->default_dwa_quality;
 
     /* put it into the part table */
-    for (int p = 0; p < f->num_parts; ++p)
+    if (nptrs != f->parts)
     {
-        nptrs[p] = f->parts[p];
+        for (int p = 0; p < f->num_parts; ++p)
+        {
+            nptrs[p] = f->parts[p];
+        }
+
+        if (f->parts && f->parts != &(f->init_part)) { f->free_fn (f->parts); }
+        f->parts         = nptrs;
+        f->part_capacity = newcapacity;
     }
     nptrs[f->num_parts] = part;
-
-    if (f->parts && f->parts != &(f->init_part)) { f->free_fn (f->parts); }
-    f->parts     = nptrs;
-    f->num_parts = ncount;
+    f->num_parts        = ncount;
     if (outpart) *outpart = part;
 
     return EXR_ERR_SUCCESS;
@@ -272,7 +293,8 @@ internal_exr_revert_add_part (
         if (ctxt->parts && ctxt->parts != &(ctxt->init_part))
             ctxt->free_fn (ctxt->parts);
 
-        ctxt->parts = NULL;
+        ctxt->parts         = NULL;
+        ctxt->part_capacity = 0;
     }
     ctxt->num_parts = ncount;
 }

{openexr-3.3.13 → openexr-3.3.15}/src/lib/OpenEXRCore/internal_structs.h

@@ -229,6 +229,8 @@ struct _priv_exr_context_t
     /* cheap array of one */
     exr_priv_part_t  init_part;
     exr_priv_part_t* parts;
+    /* allocated capacity of the parts array, grown geometrically */
+    int part_capacity;
 
     exr_attribute_list_t custom_handlers;
 

{openexr-3.3.13 → openexr-3.3.15}/src/lib/OpenEXRCore/internal_util.h

@@ -58,4 +58,26 @@ compute_sampled_width (int width, int x_sampling, int start_x)
     return (width == 1) ? 1 : (width / x_sampling);
 }
 
+/* Multiplies @p a by @p b and adds the result into @p accum, all as
+ * uint64_t. Returns 1 and leaves @p accum unmodified if either the
+ * multiplication or the subsequent accumulation would overflow a
+ * 64-bit unsigned integer, otherwise returns 0. Used to guard
+ * unpacked / scratch buffer size computations (width * height *
+ * bytes-per-pixel * channel-count) against wraparound on crafted
+ * files with extreme dimensions or channel counts. */
+static inline int
+checked_mul_accum_u64 (uint64_t* accum, uint64_t a, uint64_t b)
+{
+    uint64_t prod, sum;
+
+    if (a != 0 && b > (UINT64_MAX / a)) return 1;
+    prod = a * b;
+
+    sum = *accum + prod;
+    if (sum < *accum) return 1;
+
+    *accum = sum;
+    return 0;
+}
+
 #endif /* OPENEXR_PRIVATE_UTIL_H */

{openexr-3.3.13 → openexr-3.3.15}/src/lib/OpenEXRCore/openexr_version.h

@@ -10,6 +10,6 @@
 
 #    define OPENEXR_VERSION_MAJOR 3
 #    define OPENEXR_VERSION_MINOR 3
-#    define OPENEXR_VERSION_PATCH 13
+#    define OPENEXR_VERSION_PATCH 15
 
 #endif

{openexr-3.3.13 → openexr-3.3.15}/src/lib/OpenEXRCore/parse_header.c

@@ -2465,14 +2465,14 @@ internal_exr_compute_chunk_offset_size (exr_priv_part_t curpart)
         for (int c = 0; c < channels->num_channels; ++c)
         {
             /* tiles do not allow x/y sub sampling */
-            uint64_t cunpsz = 0;
-            if (channels->entries[c].pixel_type == EXR_PIXEL_HALF)
-                cunpsz = 2;
-            else
-                cunpsz = 4;
-            cunpsz *= (uint64_t) tiledesc->x_size;
-            cunpsz *= (uint64_t) tiledesc->y_size;
-            unpackedsize += cunpsz;
+            uint64_t cunpsz = (channels->entries[c].pixel_type == EXR_PIXEL_HALF)
+                                  ? 2
+                                  : 4;
+            if (checked_mul_accum_u64 (
+                    &unpackedsize,
+                    cunpsz,
+                    (uint64_t) tiledesc->x_size * (uint64_t) tiledesc->y_size))
+                return -1;
         }
         curpart->unpacked_size_per_chunk = unpackedsize;
         curpart->chan_has_line_sampling  = ((int16_t) hasLineSample);
@@ -2491,16 +2491,17 @@ internal_exr_compute_chunk_offset_size (exr_priv_part_t curpart)
         {
             int xsamp  = channels->entries[c].x_sampling;
             int ysamp  = channels->entries[c].y_sampling;
-            uint64_t cunpsz = 0;
-            if (channels->entries[c].pixel_type == EXR_PIXEL_HALF)
-                cunpsz = 2;
-            else
-                cunpsz = 4;
-            cunpsz *= (uint64_t) compute_sampled_width (w, xsamp, dw.min.x);
-            cunpsz *= (uint64_t) compute_sampled_height (linePerChunk, ysamp, dw.min.y);
+            uint64_t cunpsz = (channels->entries[c].pixel_type == EXR_PIXEL_HALF)
+                                  ? 2
+                                  : 4;
+            uint64_t sampw =
+                (uint64_t) compute_sampled_width ((int) w, xsamp, dw.min.x);
+            uint64_t samph = (uint64_t) compute_sampled_height (
+                linePerChunk, ysamp, dw.min.y);
             if (ysamp > 1)
                 hasLineSample = 1;
-            unpackedsize += cunpsz;
+            if (checked_mul_accum_u64 (&unpackedsize, cunpsz, sampw * samph))
+                return -1;
         }
 
         curpart->unpacked_size_per_chunk = unpackedsize;

{openexr-3.3.13 → openexr-3.3.15}/src/lib/OpenEXRCore/part_attr.c

@@ -494,8 +494,29 @@ copy_attr (
         default: rv = ctxt->standard_error (ctxt, EXR_ERR_INVALID_ATTR); break;
     }
 
-    if (rv != EXR_ERR_SUCCESS)
+    if (rv != EXR_ERR_SUCCESS && attr)
+    {
+        // the required attributes are cached in the part; don't leave any of
+        // them pointing at the attribute that is about to be freed
+        exr_attribute_t** cached[] = {
+            &part->channels,
+            &part->compression,
+            &part->dataWindow,
+            &part->displayWindow,
+            &part->lineOrder,
+            &part->pixelAspectRatio,
+            &part->screenWindowCenter,
+            &part->screenWindowWidth,
+            &part->tiles,
+            &part->name,
+            &part->type,
+            &part->version,
+            &part->chunkCount};
+        for (size_t i = 0; i < sizeof (cached) / sizeof (cached[0]); ++i)
+            if (*cached[i] == attr) *cached[i] = NULL;
+
         exr_attr_list_remove (ctxt, &(part->attributes), attr);
+    }
 
     return rv;
 }
@@ -549,7 +570,7 @@ exr_copy_unset_attributes (
         else { rv = EXR_ERR_SUCCESS; }
     }
 
-    if (update_tiles)
+    if (update_tiles && rv == EXR_ERR_SUCCESS)
         rv = internal_exr_compute_tile_information (ctxt, part, 1);
 
     if (source != ctxt) internal_exr_unlock (source);

{openexr-3.3.13 → openexr-3.3.15}/src/lib/OpenEXRCore/validation.c

@@ -11,6 +11,7 @@
 
 #include <limits.h>
 #include <math.h>
+#include <stdint.h>
 #include <stdio.h>
 #include <string.h>
 
@@ -414,6 +415,22 @@ validate_channels (
         return f->report_error (
             f, EXR_ERR_FILE_BAD_HEADER, "At least one channel required");
 
+    /* Internal coding pipeline structures (exr_coding_channel_info_t
+     * descriptor counts, exr_decode/encode_pipeline_t::channel_count)
+     * store the channel count in an int16_t. A channel list larger than
+     * this silently truncates downstream (e.g. 73,728 channels wraps to
+     * 8,192), decoupling the actual channel count from the one used to
+     * size scratch/unpacked buffers and leading to undersized
+     * allocations relative to the data actually unpacked. Reject such
+     * files outright. */
+    if (channels->num_channels > INT16_MAX)
+        return f->print_error (
+            f,
+            EXR_ERR_FILE_BAD_HEADER,
+            "Channel count (%d) exceeds maximum supported value (%d)",
+            channels->num_channels,
+            (int) INT16_MAX);
+
     dw = curpart->data_window;
     w  = (int64_t) dw.max.x - (int64_t) dw.min.x + 1;
     h  = (int64_t) dw.max.y - (int64_t) dw.min.y + 1;