OpenEXR 3.4.14__tar.gz → 3.4.16__tar.gz

{openexr-3.4.14 → openexr-3.4.16}/CHANGES.md

@@ -3,6 +3,8 @@
 
 # OpenEXR Release Notes
 
+* [Version 3.4.16](#version-3416-september-28-2026) September 28, 2026
+* [Version 3.4.15](#version-3415-august-21-2026) August 21, 2026
 * [Version 3.4.14](#version-3414-august-6-2026) August 6, 2026
 * [Version 3.4.13](#version-3413-june-19-2026) June 19, 2026
 * [Version 3.4.12](#version-3412-may-24-2026) May 24, 2026
@@ -106,6 +108,55 @@
 * [Version 1.0.1](#version-101)
 * [Version 1.0](#version-10)
 
+## Version 3.4.16 (September 28, 2026)
+
+v3.4.16 fixes a bug which created unreadable DWAB files in certain circumstances.
+There is also a fix to prevent 'undefined behavior' warnings with the BytesAttribute
+
+### Merged Pull Requests
+
+  * [2653](https://github.com/AcademySoftwareFoundation/openexr/pull/2653)
+Fix DWAB corrupted file
+  * [2650](https://github.com/AcademySoftwareFoundation/openexr/pull/2650)
+Fix null pointer memcpy in BytesAttribute for zero-length data (follow-up to #2615)
+
+### Merged Workflow Pull Requests
+
+
+## Version 3.4.15 (August 21, 2026)
+
+v3.4.15 fixes two memory issues when parsing IDManifests. Corrupt
+or maliciously formed OpenEXR images could trigger excessive memory
+allocation, but only in code which decodes the idmanifest attribute.
+Other code is unaffected, even when handling files with idmanifest attributes
+
+CVEs have been requested for these issues.
+
+This release also fixes a missing export for Windows builds, and reduces
+compiler warnings when compiling example code.
+
+### Merged Pull Requests
+
+  * [2594](git@github.com:AcademySoftwareFoundation/openexr/pull/2594)
+Add missing IMF_EXPORT to KeyCode::operator==
+  * [2582](git@github.com:AcademySoftwareFoundation/openexr/pull/2582)
+Fix/suppress compiler warnings
+  * [2575](git@github.com:AcademySoftwareFoundation/openexr/pull/2575)
+don't preallocate manifest when parsing IDManifests
+  * [2572](git@github.com:AcademySoftwareFoundation/openexr/pull/2572)
+Bound IDManifest uncompressed size and version-field read
+
+### Merged Workflow Pull Requests
+
+  * [2598](git@github.com:AcademySoftwareFoundation/openexr/pull/2598)
+Bump the codeql group with 3 updates
+  * [2585](git@github.com:AcademySoftwareFoundation/openexr/pull/2585)
+Bump the codeql group with 3 updates
+  * [2574](git@github.com:AcademySoftwareFoundation/openexr/pull/2574)
+Bump vmactions/freebsd-vm from 1.5.2 to 1.5.3
+  * [2573](git@github.com:AcademySoftwareFoundation/openexr/pull/2573)
+Bump the codeql group with 3 updates
+
 ## Version 3.4.14 (August 6, 2026)
 
 v3.4.14 is a security-focused patch release. It fixes 15 CVEs plus a

{openexr-3.4.14 → openexr-3.4.16}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.2
 Name: OpenEXR
-Version: 3.4.14
+Version: 3.4.16
 Summary: Python bindings for the OpenEXR image file format
 Author-Email: Contributors to the OpenEXR project <info@openexr.com>
 Project-URL: Homepage, https://openexr.com

{openexr-3.4.14 → openexr-3.4.16}/src/lib/OpenEXR/ImfBytesAttribute.cpp

@@ -34,19 +34,21 @@ BytesAttribute::BytesAttribute (
     {
         THROW (IEX_NAMESPACE::ArgExc, "Invalid data pointer.");
     }
-    memcpy (
-        (unsigned char*) _data,
-        (const unsigned char*) data,
-        size);
+    if (size > 0)
+        memcpy (
+            (unsigned char*) _data,
+            (const unsigned char*) data,
+            size);
 }
 
 BytesAttribute::BytesAttribute (const BytesAttribute& other)
     : typeHint (other.typeHint), _data (other._data.size ())
 {
-    memcpy (
-        (unsigned char*) _data,
-        (const unsigned char*) other._data,
-        other._data.size ());
+    if (other._data.size () > 0)
+        memcpy (
+            (unsigned char*) _data,
+            (const unsigned char*) other._data,
+            other._data.size ());
 }
 
 // Note the destructor is defined here and not in the header file to

{openexr-3.4.14 → openexr-3.4.16}/src/lib/OpenEXR/ImfDeepScanLineOutputFile.cpp

@@ -1287,6 +1287,15 @@ DeepScanLineOutputFile::writePixels (int numScanLines)
 
                 _data->missingScanLines -= numLines;
 
+                //
+                // A background compression task may have failed without
+                // clearing partiallyFull; surface that before treating the
+                // buffer as legitimately incomplete.
+                //
+
+                if (writeBuffer->hasException)
+                    throw IEX_NAMESPACE::IoExc (writeBuffer->exception);
+
                 //
                 // If the line buffer is only partially full, then it is
                 // not complete and we cannot write it to disk yet.

{openexr-3.4.14 → openexr-3.4.16}/src/lib/OpenEXR/ImfIDManifest.cpp

@@ -14,6 +14,7 @@
 #include <openexr_compression.h>
 
 #include <algorithm>
+#include <limits>
 #include <stdint.h>
 #include <stdlib.h>
 #include <string.h>
@@ -348,6 +349,11 @@ IDManifest::IDManifest (const char* data, const char* endOfData)
 void
 IDManifest::init (const char* data, const char* endOfData)
 {
+    if (data + sizeof (unsigned int) > endOfData)
+    {
+        throw IEX_NAMESPACE::InputExc (
+            "IDManifest too small for version field");
+    }
 
     unsigned int version;
     Xdr::read<CharPtrIO> (data, version);
@@ -478,13 +484,17 @@ IDManifest::init (const char* data, const char* endOfData)
 
     _manifest.clear ();
 
-    _manifest.resize (manifestEntries);
+    if (manifestEntries <0)
+    {
+        throw IEX_NAMESPACE::InputExc ("bad number of ChannelGroupsManifests in IDManifest");
+    }
 
     for (int manifestEntry = 0; manifestEntry < manifestEntries;
          ++manifestEntry)
     {
 
-        ChannelGroupManifest& m = _manifest[manifestEntry];
+        _manifest.push_back(ChannelGroupManifest());
+        ChannelGroupManifest& m = _manifest.back();
 
         //
         // read header of this manifest entry
@@ -575,6 +585,34 @@ IDManifest::init (const char* data, const char* endOfData)
 
 IDManifest::IDManifest (const CompressedIDManifest& compressed)
 {
+    //
+    // Reject an implausible declared uncompressed size before allocating
+    // anything for it. The declared size is otherwise an unvalidated
+    // 64-bit value taken directly from the file, used as a buffer size
+    // before decompression (and thus before any check on its contents),
+    // which allows a tiny file to force an enormous, fully-committed
+    // allocation (a denial of service) or, at 0, a null-pointer
+    // dereference during `init`.
+    //
+    // OpenEXR places no fixed limit on data size (see setMaxImageSize(),
+    // which is off/unlimited by default), so a manifest legitimately may
+    // be very large; an absolute cap here would reject valid files. What
+    // must hold regardless of size is zlib's own maximum expansion ratio
+    // of ~1032:1, so scale the bound by the compressed size actually
+    // present in the file instead of an arbitrary constant.
+    //
+    static const uint64_t MAX_EXPANSION = 1032;
+
+    if (compressed._uncompressedDataSize == 0 ||
+        compressed._compressedDataSize >
+            std::numeric_limits<uint64_t>::max () / MAX_EXPANSION ||
+        compressed._uncompressedDataSize >
+            compressed._compressedDataSize * MAX_EXPANSION)
+    {
+        throw IEX_NAMESPACE::InputExc (
+            "IDManifest has an implausible uncompressed data size");
+    }
+
     //
     // decompress the compressed manifest
     //
@@ -599,7 +637,7 @@ IDManifest::IDManifest (const CompressedIDManifest& compressed)
             "IDManifest decompression (zlib) failed: mismatch in decompressed data size");
     }
 
-    init ((const char*) &uncomp[0], (const char*) &uncomp[0] + outSize);
+    init (uncomp.data (), uncomp.data () + outSize);
 }
 
 void

{openexr-3.4.14 → openexr-3.4.16}/src/lib/OpenEXR/ImfKeyCode.h

@@ -93,6 +93,7 @@ public:
     IMF_EXPORT
     KeyCode& operator= (const KeyCode& other);
 
+    IMF_EXPORT
     bool operator== (const KeyCode& other) const;
 
     //----------------------------

{openexr-3.4.14 → openexr-3.4.16}/src/lib/OpenEXR/ImfOutputFile.cpp

@@ -1105,6 +1105,15 @@ OutputFile::writePixels (int numScanLines)
 
                 _data->missingScanLines -= numLines;
 
+                //
+                // A background compression task may have failed without
+                // clearing partiallyFull; surface that before treating the
+                // buffer as legitimately incomplete.
+                //
+
+                if (writeBuffer->hasException)
+                    throw IEX_NAMESPACE::IoExc (writeBuffer->exception);
+
                 //
                 // If the line buffer is only partially full, then it is
                 // not complete and we cannot write it to disk yet.

{openexr-3.4.14 → openexr-3.4.16}/src/lib/OpenEXRCore/internal_huf.c

@@ -1874,7 +1874,10 @@ internal_huf_compress (
     }
 
     if (outsz < 20) return EXR_ERR_INVALID_ARGUMENT;
-    if (sparebytes != internal_exr_huf_compress_spare_bytes ())
+    // The spare buffer is partitioned using fixed offsets, so it only needs
+    // to be *at least* the required size. Callers (e.g. the DWA compressor)
+    // may legitimately pass a larger, reused scratch buffer.
+    if (sparebytes < internal_exr_huf_compress_spare_bytes ())
         return EXR_ERR_INVALID_ARGUMENT;
 
     freq  = (uint64_t*) spare;
@@ -1937,7 +1940,10 @@ internal_huf_decompress (
         return EXR_ERR_SUCCESS;
     }
 
-    if (sparebytes != internal_exr_huf_decompress_spare_bytes ())
+    // The spare buffer is partitioned using fixed offsets, so it only needs
+    // to be *at least* the required size. Callers (e.g. the DWA decompressor)
+    // may legitimately pass a larger, reused scratch buffer.
+    if (sparebytes < internal_exr_huf_decompress_spare_bytes ())
         return EXR_ERR_INVALID_ARGUMENT;
 
     im = readUInt (compressed);

{openexr-3.4.14 → openexr-3.4.16}/src/lib/OpenEXRCore/openexr_version.h

@@ -10,6 +10,6 @@
 
 #    define OPENEXR_VERSION_MAJOR 3
 #    define OPENEXR_VERSION_MINOR 4
-#    define OPENEXR_VERSION_PATCH 14
+#    define OPENEXR_VERSION_PATCH 16
 
 #endif

{openexr-3.4.14 → openexr-3.4.16}/src/lib/OpenEXRCore/parse_header.c

@@ -557,7 +557,7 @@ extract_attr_float_vector (
                 tname);
         }
 
-        priv_to_native32 (attrdata->arr, n);
+        priv_to_native32 ((void*) attrdata->arr, n);
     }
 
     return rv;

{openexr-3.4.14 → openexr-3.4.16}/src/test/OpenEXRTest/testStandardAttributes.cpp

@@ -386,6 +386,10 @@ writeReadKeyCode (const char fileName[])
         3,      // perfsPerFrame
         80);    // perfsPerCount
 
+    KeyCode k2 = k1;
+
+    assert (k2 == k1);
+    
     assert (k1.filmMfcCode () == 12);
     assert (k1.filmType () == 34);
     assert (k1.prefix () == 123456);

{openexr-3.4.14 → openexr-3.4.16}/src/wrappers/python/PyOpenEXR_old.cpp

@@ -104,7 +104,6 @@ using namespace std;
 using namespace OPENEXR_IMF_NAMESPACE;
 using namespace IMATH_NAMESPACE;
 
-static PyObject* OpenEXR_error = NULL;
 static PyObject* pModuleImath;
 
 int

{openexr-3.4.14 → openexr-3.4.16}/website/src/all.cpp

@@ -3,23 +3,38 @@
 // Copyright (c) Contributors to the OpenEXR Project.
 //
 
-#include <ImfHeader.h>
-#include <ImfArray.h>
-#include <ImfInputFile.h>
-#include <ImfFrameBuffer.h>
-#include <ImfOutputFile.h>
-#include <ImfPreviewImage.h>
-#include <ImfRgbaFile.h>
-#include <ImfRgba.h>
-#include <ImfTiledInputFile.h>
-#include <ImfTiledRgbaFile.h>
-#include <ImfDeepScanLineInputFile.h>
-#include <ImfDeepTiledInputFile.h>
-#include <ImfDeepTiledOutputFile.h>
-#include <ImfDeepFrameBuffer.h>
-#include <ImfStandardAttributes.h>
-#include <ImfChannelList.h>
-#include <ImfPartType.h>
+// This file assembles a collection of documentation code snippets
+// (via #include of individual .cpp files below) that are compiled
+// here purely to verify they build, not to be run in any meaningful
+// way. As a result, several of the snippets intentionally leave
+// variables unused; suppress those warnings for the whole file
+// rather than editing each snippet.
+#if defined(_MSC_VER)
+#    pragma warning(push)
+#    pragma warning(disable : 4101) // unused local variable
+#elif defined(__GNUC__) || defined(__clang__)
+#    pragma GCC diagnostic push
+#    pragma GCC diagnostic ignored "-Wunused-variable"
+#    pragma GCC diagnostic ignored "-Wunused-but-set-variable"
+#endif
+
+#include "ImfHeader.h"
+#include "ImfArray.h"
+#include "ImfInputFile.h"
+#include "ImfFrameBuffer.h"
+#include "ImfOutputFile.h"
+#include "ImfPreviewImage.h"
+#include "ImfRgbaFile.h"
+#include "ImfRgba.h"
+#include "ImfTiledInputFile.h"
+#include "ImfTiledRgbaFile.h"
+#include "ImfDeepScanLineInputFile.h"
+#include "ImfDeepTiledInputFile.h"
+#include "ImfDeepTiledOutputFile.h"
+#include "ImfDeepFrameBuffer.h"
+#include "ImfStandardAttributes.h"
+#include "ImfChannelList.h"
+#include "ImfPartType.h"
 
 #include <Iex.h>
 #include <ImathFun.h>
@@ -137,3 +152,9 @@ int
 main(int argc, char* argv[])
 {
 }
+
+#if defined(_MSC_VER)
+#    pragma warning(pop)
+#elif defined(__GNUC__) || defined(__clang__)
+#    pragma GCC diagnostic pop
+#endif