OpenEXR 3.4.16__tar.gz → 3.4.17__tar.gz

{openexr-3.4.16 → openexr-3.4.17}/CHANGES.md

@@ -3,6 +3,7 @@
 
 # OpenEXR Release Notes
 
+* [Version 3.4.17](#version-3417-october-30-2026) October 30 2026
 * [Version 3.4.16](#version-3416-september-28-2026) September 28, 2026
 * [Version 3.4.15](#version-3415-august-21-2026) August 21, 2026
 * [Version 3.4.14](#version-3414-august-6-2026) August 6, 2026
@@ -108,6 +109,62 @@
 * [Version 1.0.1](#version-101)
 * [Version 1.0](#version-10)
 
+## Version 3.4.17 (October 30, 2026)
+
+Patch release that addresses the following security vulnerabilities:
+
+* ***CVE Pending*** ([GHSA-WHF5-29MJ-GP53](https://github.com/AcademySoftwareFoundation/openexr/security/advisories/GHSA-WHF5-29MJ-GP53)) Heap Out-of-Bounds Write via Signed Integer Overflow in DWAA/DWAB `LossyDctDecoder`
+* ***CVE Pending*** ([GHSA-VP77-HHRC-M2C3](https://github.com/AcademySoftwareFoundation/openexr/security/advisories/GHSA-VP77-HHRC-M2C3)) Subsampled chunk-height miscount: heap overflow in B44 encoder, NULL dereference in DWA decoder/encoder
+* ***CVE Pending*** ([GHSA-RXWG-X3WX-PGFH](https://github.com/AcademySoftwareFoundation/openexr/security/advisories/GHSA-RXWG-X3WX-PGFH)) Heap out-of-bounds write via 32-bit tile-area integer overflow in `DeepTiledOutputFile` (deep-image re-save path) — possible incomplete fix of PR #939
+* ***CVE Pending*** ([GHSA-RJG8-982X-JHC2](https://github.com/AcademySoftwareFoundation/openexr/security/advisories/GHSA-RJG8-982X-JHC2)) Uninitialized Heap Memory Disclosure in DWA Decompression via Short zlib Stream Mapped to Success
+* ***CVE Pending*** ([GHSA-J76P-H7GW-VMPF](https://github.com/AcademySoftwareFoundation/openexr/security/advisories/GHSA-J76P-H7GW-VMPF)) Heap buffer overflow in the OpenEXR Python bindings when two RGB channel groups coalesce to the same key
+* ***CVE Pending*** ([GHSA-G248-596F-9995](https://github.com/AcademySoftwareFoundation/openexr/security/advisories/GHSA-G248-596F-9995)) Unvalidated extra `chlist` header attributes merged into `Header::channels()` cause a heap overflow in `run_fill`
+* ***CVE Pending*** ([GHSA-FRX8-5P4H-J8M7](https://github.com/AcademySoftwareFoundation/openexr/security/advisories/GHSA-FRX8-5P4H-J8M7)) Heap OOB Write via Integer Overflow in B44 Chunk Unpacked-Size Computation — Remote Code Execution in OpenEXRCore
+* ***CVE Pending*** ([GHSA-638X-X7MR-89XC](https://github.com/AcademySoftwareFoundation/openexr/security/advisories/GHSA-638X-X7MR-89XC)) Out-of-bounds write at an attacker-chosen displacement in legacy Python `InputFile.channel()`
+* ***CVE Pending*** ([GHSA-3CP4-779M-H837](https://github.com/AcademySoftwareFoundation/openexr/security/advisories/GHSA-3CP4-779M-H837)) Use-after-free in OpenEXRCore `exr_copy_unset_attributes()` when a channel name exceeds 31 bytes
+
+This version also addresses a regression introduced in v3.4.14 in
+reading deep images on big-endian hosts, due to a byte-order bug in
+the deep sample count table. Little-endian hosts are unaffected.
+
+### Merged Pull Requests
+
+* [2787](https://github.com/AcademySoftwareFoundation/openexr/pull/2787)
+ Fix byte-swapped deep sample count table on big-endian hosts (by @cary-ilm/Cary Phillips)
+* [2762](https://github.com/AcademySoftwareFoundation/openexr/pull/2762)
+  Fix compute_sampled_height() for chunks with no sampled row (by @cary-ilm/Cary Phillips)
+* [2760](https://github.com/AcademySoftwareFoundation/openexr/pull/2760)
+  Fix dangling channels pointer in exr_copy_unset_attributes() (by @cary-ilm/Cary Phillips)
+* [2757](https://github.com/AcademySoftwareFoundation/openexr/pull/2757)
+  Fix unsigned wraparound in legacy Python InputFile.channel() (by @cary-ilm/Cary Phillips)
+* [2749](https://github.com/AcademySoftwareFoundation/openexr/pull/2749)
+  Use size_t block indexing in DWA lossy DCT decoder (by @cary-ilm/Cary Phillips)
+* [2748](https://github.com/AcademySoftwareFoundation/openexr/pull/2748)
+  Fix tile area overflow in DeepTiledOutputFile::initialize (by @cary-ilm/Cary Phillips)
+* [2747](https://github.com/AcademySoftwareFoundation/openexr/pull/2747)
+  Reject Python RGB channel groups that coalesce to the same key (by @cary-ilm/Cary Phillips)
+* [2745](https://github.com/AcademySoftwareFoundation/openexr/pull/2745)
+  Only merge the "channels" chlist attribute into Header::channels() (by @cary-ilm/Cary Phillips)
+* [2744](https://github.com/AcademySoftwareFoundation/openexr/pull/2744)
+  Grow the part table geometrically when adding parts (by @cary-ilm/Cary Phillips)
+* [2726](https://github.com/AcademySoftwareFoundation/openexr/pull/2726)
+  Fix heap OOB read in deep PIZ encoder path (by @kalt2212/Kalt2212)
+* [2718](https://github.com/AcademySoftwareFoundation/openexr/pull/2718)
+  Fix B44 integer overflow OOB write (by @cary-ilm/Cary Phillips)
+* [2717](https://github.com/AcademySoftwareFoundation/openexr/pull/2717)
+  Fix DWA uninitialized heap memory disclosure (by @cary-ilm/Cary Phillips)
+
+### Merged Workflow Pull Requests
+
+* [2731](https://github.com/AcademySoftwareFoundation/openexr/pull/2731)
+  Bump actions/upload-artifact from 7.0.1 to 7.0.2 (by @app/dependabot)
+* [2711](https://github.com/AcademySoftwareFoundation/openexr/pull/2711)
+  Bump vmactions/freebsd-vm from 1.5.8 to 1.5.9 (by @app/dependabot)
+* [2703](https://github.com/AcademySoftwareFoundation/openexr/pull/2703)
+  Strip Contributors from notes in slack release post (by @cary-ilm/Cary Phillips)
+* [2692](https://github.com/AcademySoftwareFoundation/openexr/pull/2692)
+  Bump jmertic/slack-release-notifier from 20260820 to 20260930 (by @app/dependabot)
+
 ## Version 3.4.16 (September 28, 2026)
 
 v3.4.16 fixes a bug which created unreadable DWAB files in certain circumstances.

{openexr-3.4.16 → openexr-3.4.17}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.2
 Name: OpenEXR
-Version: 3.4.16
+Version: 3.4.17
 Summary: Python bindings for the OpenEXR image file format
 Author-Email: Contributors to the OpenEXR project <info@openexr.com>
 Project-URL: Homepage, https://openexr.com

{openexr-3.4.16 → openexr-3.4.17}/src/lib/OpenEXR/ImfContext.cpp

@@ -499,7 +499,12 @@ Context::header (int partidx) const
                 break;
 
             case EXR_ATTR_CHLIST: {
-                ChannelList& chans = hdr.channels ();
+                // Only the attribute named "channels" is validated by the
+                // core library and describes the pixel data; any other
+                // chlist attribute is kept as an ordinary attribute.
+                const bool   isChannels = !strcmp (cur->name, "channels");
+                ChannelList  other;
+                ChannelList& chans = isChannels ? hdr.channels () : other;
 
                 for (int c = 0; c < cur->chlist->num_channels; ++c)
                 {
@@ -513,6 +518,9 @@ Context::header (int partidx) const
                             curc.y_sampling,
                             curc.p_linear != 0));
                 }
+
+                if (!isChannels)
+                    hdr.insert (cur->name, ChannelListAttribute (other));
                 break;
             }
 

{openexr-3.4.16 → openexr-3.4.17}/src/lib/OpenEXR/ImfDeepScanLineOutputFile.cpp

@@ -923,6 +923,15 @@ DeepScanLineOutputFile::initialize (const Header& header)
 
     _data->header.setType (DEEPSCANLINE);
 
+    //
+    // header.sanityCheck() runs before the type is stamped above, so the
+    // deep-data compression restriction is never applied there. Reject any
+    // compression that is not valid for deep data explicitly.
+    //
+    if (!isValidDeepCompression (_data->header.compression ()))
+        throw IEX_NAMESPACE::ArgExc (
+            "Compression type in header not valid for deep data");
+
     const Box2i& dataWindow = header.dataWindow ();
 
     _data->currentScanLine = (header.lineOrder () == INCREASING_Y)

{openexr-3.4.16 → openexr-3.4.17}/src/lib/OpenEXR/ImfDeepTiledOutputFile.cpp

@@ -1182,6 +1182,16 @@ DeepTiledOutputFile::initialize (const Header& header)
 {
     _data->header = header;
     _data->header.setType (DEEPTILE);
+
+    //
+    // header.sanityCheck() runs before the type is stamped above, so the
+    // deep-data compression restriction is never applied there. Reject any
+    // compression that is not valid for deep data explicitly.
+    //
+    if (!isValidDeepCompression (_data->header.compression ()))
+        throw IEX_NAMESPACE::ArgExc (
+            "Compression type in header not valid for deep data");
+
     _data->lineOrder = _data->header.lineOrder ();
 
     //
@@ -1200,22 +1210,25 @@ DeepTiledOutputFile::initialize (const Header& header)
     _data->minY             = dataWindow.min.y;
     _data->maxY             = dataWindow.max.y;
 
-    _data->maxSampleCountTableSize =
-        _data->tileDesc.ySize * _data->tileDesc.xSize * sizeof (int);
+    // widen before multiplying: the 32-bit product of the tile
+    // dimensions can wrap to 0 and bypass the limit below
+    const uint64_t tileArea = static_cast<uint64_t> (_data->tileDesc.ySize) *
+                              static_cast<uint64_t> (_data->tileDesc.xSize);
 
     //
     // impose limit of 2^32 bytes of storage for maxSampleCountTableSize
     // (disallow files with very large tile areas that would otherwise cause excessive memory allocation)
     //
 
-    if (_data->maxSampleCountTableSize >
-        std::numeric_limits<unsigned int>::max ())
+    if (tileArea > std::numeric_limits<unsigned int>::max () / sizeof (int))
     {
         THROW (
             IEX_NAMESPACE::ArgExc,
             "Deep tile size exceeds maximum permitted area");
     }
 
+    _data->maxSampleCountTableSize = tileArea * sizeof (int);
+
     //
     // Precompute level and tile information to speed up utility functions
     //

{openexr-3.4.16 → openexr-3.4.17}/src/lib/OpenEXRCore/chunk.c

@@ -1651,12 +1651,11 @@ exr_read_deep_chunk (
 
     if (rv != EXR_ERR_SUCCESS) return rv;
 
-    /* the on-disk sample count table is little-endian; convert to native so
-     * callers receive host-order counts (matching unpacked pixel data) */
-    if (sample_data && cinfo->sample_count_table_size > 0)
-        priv_to_native32 (
-            sample_data,
-            (int) (cinfo->sample_count_table_size / sizeof (uint32_t)));
+    /* Both buffers are returned exactly as stored in the file, like
+     * exr_read_chunk: the sample count table may be compressed, and when
+     * it isn't, its counts are little-endian. The decode pipeline
+     * (unpack_sample_table) does the conversion to native order, and the
+     * raw chunk readers in the C++ API copy these bytes verbatim. */
 
     if (packed_data && cinfo->packed_size > 0)
     {

{openexr-3.4.16 → openexr-3.4.17}/src/lib/OpenEXRCore/internal_b44.c

@@ -7,6 +7,7 @@
 #include "internal_decompress.h"
 
 #include "internal_coding.h"
+#include "internal_util.h"
 #include "internal_xdr.h"
 
 #include <string.h>
@@ -676,8 +677,14 @@ compute_scratch_buffer_size (
         if (nx % 4) nx += 4 - nx % 4;
         if (ny % 4) ny += 4 - ny % 4;
 
-        comp += (uint64_t) (ny) * (uint64_t) (nx) *
-                (uint64_t) (curc->bytes_per_element);
+        /* guard against a wrapped accumulation producing an
+         * implausibly small scratch requirement relative to what the
+         * decompressor will actually touch (see GHSA-frx8-5p4h-j8m7) */
+        if (checked_mul_accum_u64 (
+                &comp,
+                (uint64_t) ny * (uint64_t) nx,
+                (uint64_t) curc->bytes_per_element))
+            return UINT64_MAX;
     }
     if (comp > ret) ret = comp;
     return ret;
@@ -695,7 +702,8 @@ internal_exr_undo_b44 (
 {
     exr_result_t rv;
     uint64_t     scratch_sz = compute_scratch_buffer_size (decode, uncompressed_size);
-    if (scratch_sz != (size_t) scratch_sz) return EXR_ERR_OUT_OF_MEMORY;
+    if (scratch_sz == UINT64_MAX || scratch_sz != (size_t) scratch_sz)
+        return EXR_ERR_OUT_OF_MEMORY;
     rv = internal_decode_alloc_buffer (
         decode,
         EXR_TRANSCODE_BUFFER_SCRATCH1,
@@ -724,7 +732,8 @@ internal_exr_undo_b44a (
 {
     exr_result_t rv;
     uint64_t     scratch_sz = compute_scratch_buffer_size (decode, uncompressed_size);
-    if (scratch_sz != (size_t) scratch_sz) return EXR_ERR_OUT_OF_MEMORY;
+    if (scratch_sz == UINT64_MAX || scratch_sz != (size_t) scratch_sz)
+        return EXR_ERR_OUT_OF_MEMORY;
     rv = internal_decode_alloc_buffer (
         decode,
         EXR_TRANSCODE_BUFFER_SCRATCH1,

{openexr-3.4.16 → openexr-3.4.17}/src/lib/OpenEXRCore/internal_dwa_compressor.h

@@ -916,6 +916,8 @@ DwaCompressor_uncompress (
 
     if (unknownCompressedSize > 0)
     {
+        size_t unknownActualOut;
+
         if (unknownUncompressedSize > me->_planarUncBufferSize[UNKNOWN])
         {
             return EXR_ERR_CORRUPT_CHUNK;
@@ -927,7 +929,18 @@ DwaCompressor_uncompress (
                                    unknownCompressedSize,
                                    me->_planarUncBuffer[UNKNOWN],
                                    unknownUncompressedSize,
-                                   NULL))
+                                   &unknownActualOut))
+        {
+            return EXR_ERR_CORRUPT_CHUNK;
+        }
+
+        /* A short zlib stream (fewer bytes produced than requested) is
+         * reported as success (see translate_deflate_result), leaving
+         * the tail of _planarUncBuffer[UNKNOWN] filled with stale heap
+         * contents that are then copied into the decoded image. Reject
+         * it explicitly instead of trusting the full buffer was written
+         * (see GHSA-rjg8-982x-jhc2). */
+        if (unknownActualOut != unknownUncompressedSize)
         {
             return EXR_ERR_CORRUPT_CHUNK;
         }

{openexr-3.4.16 → openexr-3.4.17}/src/lib/OpenEXRCore/internal_dwa_decoder.h

@@ -292,8 +292,8 @@ LossyDctDecoder_execute (
     int                  numComp = d->_channel_decode_data_count;
     DctCoderChannelData* chanData[3];
     int                  lastNonZero = 0;
-    int                  numBlocksX  = (d->_width + 7) / 8;
-    int                  numBlocksY  = (d->_height + 7) / 8;
+    int                  numBlocksX  = (int) (((int64_t) d->_width + 7) / 8);
+    int                  numBlocksY  = (int) (((int64_t) d->_height + 7) / 8);
     int                  leftoverX   = d->_width - (numBlocksX - 1) * 8;
     int                  leftoverY   = d->_height - (numBlocksY - 1) * 8;
 
@@ -320,9 +320,15 @@ LossyDctDecoder_execute (
     // Allocate a temp aligned buffer to hold a rows worth of full
     // 8x8 half-float blocks
     //
-    rowBlockHandle = alloc_fn (
-        (size_t) numComp * (size_t) numBlocksX * 64 * sizeof (uint16_t) +
-        _SSE_ALIGNMENT);
+    // (computed in 64 bits: with a 32-bit size_t the product can wrap
+    // and under-allocate for very wide chunks)
+    //
+    uint64_t rowBlockBytes = (uint64_t) numComp * (uint64_t) numBlocksX * 64 *
+                                 sizeof (uint16_t) +
+                             _SSE_ALIGNMENT;
+    if (rowBlockBytes > SIZE_MAX) return EXR_ERR_OUT_OF_MEMORY;
+
+    rowBlockHandle = alloc_fn ((size_t) rowBlockBytes);
     if (!rowBlockHandle) return EXR_ERR_OUT_OF_MEMORY;
 
     rowBlock[0] = (uint16_t*) simd_align_pointer (rowBlockHandle);
@@ -513,13 +519,13 @@ LossyDctDecoder_execute (
                 if (!blockIsConstant)
                 {
                     (*convertFloatToHalf64) (
-                        &rowBlock[comp][blockx * 64], chanData[comp]->_dctData);
+                        &rowBlock[comp][(uint64_t) blockx * 64], chanData[comp]->_dctData);
                 }
                 else
                 {
 #ifdef IMF_HAVE_SSE2
 
-                    __m128i* dst = (__m128i*) &rowBlock[comp][blockx * 64];
+                    __m128i* dst = (__m128i*) &rowBlock[comp][(uint64_t) blockx * 64];
 
                     dst[0] = _mm_set1_epi16 (
                         (short) float_to_half (chanData[comp]->_dctData[0]));
@@ -534,7 +540,7 @@ LossyDctDecoder_execute (
 
 #else /* IMF_HAVE_SSE2 */
 
-                    uint16_t* dst = &rowBlock[comp][blockx * 64];
+                    uint16_t* dst = &rowBlock[comp][(uint64_t) blockx * 64];
 
                     dst[0] = float_to_half (chanData[comp]->_dctData[0]);
 
@@ -661,7 +667,7 @@ LossyDctDecoder_execute (
                     for (int blockx = 0; blockx < numFullBlocksX; ++blockx)
                     {
                         uint16_t* restrict src =
-                            &rowBlock[comp][blockx * 64 + ((y & 0x7) * 8)];
+                            &rowBlock[comp][(uint64_t) blockx * 64 + ((y & 0x7) * 8)];
 
                         dst[0] = d->_toLinear[src[0]];
                         dst[1] = d->_toLinear[src[1]];
@@ -687,7 +693,7 @@ LossyDctDecoder_execute (
                     for (int blockx = 0; blockx < numFullBlocksX; ++blockx)
                     {
                         uint16_t* src =
-                            &rowBlock[comp][blockx * 64 + ((y & 0x7) * 8)];
+                            &rowBlock[comp][(uint64_t) blockx * 64 + ((y & 0x7) * 8)];
                         memcpy (dst, src, 8*sizeof(uint16_t));
                         dst += 8;
                     }
@@ -706,7 +712,7 @@ LossyDctDecoder_execute (
                 for (int y = 8 * blocky; y < 8 * blocky + maxY; ++y)
                 {
                     uint16_t* src = (uint16_t*) &rowBlock[comp]
-                                                         [numFullBlocksX * 64 +
+                                                         [(uint64_t) numFullBlocksX * 64 +
                                                           ((y & 0x7) * 8)];
 
                     uint16_t* dst = (uint16_t*) chanData[comp]->_rows[y];

{openexr-3.4.16 → openexr-3.4.17}/src/lib/OpenEXRCore/internal_structs.c

@@ -9,6 +9,7 @@
 #include "internal_constants.h"
 #include "internal_memory.h"
 
+#include <limits.h>
 #include <stdarg.h>
 #include <stdio.h>
 #include <string.h>
@@ -178,8 +179,9 @@ internal_exr_destroy_parts (exr_context_t ctxt)
 
     if (ctxt->parts != &(ctxt->init_part)) ctxt->free_fn (ctxt->parts);
     ctxt->init_part = NULL;
-    ctxt->parts     = NULL;
-    ctxt->num_parts = 0;
+    ctxt->parts         = NULL;
+    ctxt->part_capacity = 0;
+    ctxt->num_parts     = 0;
 }
 
 /**************************************/
@@ -191,6 +193,7 @@ internal_exr_add_part (
     int              ncount = f->num_parts + 1;
     exr_priv_part_t  part;
     exr_priv_part_t* nptrs = NULL;
+    int              newcapacity = 0;
 
     if (new_index) *new_index = f->num_parts;
 
@@ -201,18 +204,32 @@ internal_exr_add_part (
         /* also need a pointer to pointer... */
         f->init_part = part;
         nptrs        = &(f->init_part);
+        newcapacity  = 1;
     }
     else
     {
         part = f->alloc_fn (sizeof (struct _priv_exr_part_t));
         if (!part) return f->standard_error (f, EXR_ERR_OUT_OF_MEMORY);
 
-        nptrs = f->alloc_fn (sizeof (exr_priv_part_t) * (size_t) ncount);
-        if (!nptrs)
+        if (ncount > f->part_capacity)
         {
-            f->free_fn (part);
-            return f->standard_error (f, EXR_ERR_OUT_OF_MEMORY);
+            /* grow geometrically so adding N parts is O(N), not O(N^2) */
+            int newcap = f->part_capacity < 4
+                             ? 4
+                             : (f->part_capacity <= INT_MAX / 2
+                                    ? f->part_capacity * 2
+                                    : ncount);
+
+            nptrs = f->alloc_fn (sizeof (exr_priv_part_t) * (size_t) newcap);
+            if (!nptrs)
+            {
+                f->free_fn (part);
+                return f->standard_error (f, EXR_ERR_OUT_OF_MEMORY);
+            }
+            newcapacity = newcap;
         }
+        else
+            nptrs = f->parts;
     }
     memset (part, 0, sizeof (struct _priv_exr_part_t));
 
@@ -229,15 +246,19 @@ internal_exr_add_part (
     part->dwa_compression_level = f->default_dwa_quality;
 
     /* put it into the part table */
-    for (int p = 0; p < f->num_parts; ++p)
+    if (nptrs != f->parts)
     {
-        nptrs[p] = f->parts[p];
+        for (int p = 0; p < f->num_parts; ++p)
+        {
+            nptrs[p] = f->parts[p];
+        }
+
+        if (f->parts && f->parts != &(f->init_part)) { f->free_fn (f->parts); }
+        f->parts         = nptrs;
+        f->part_capacity = newcapacity;
     }
     nptrs[f->num_parts] = part;
-
-    if (f->parts && f->parts != &(f->init_part)) { f->free_fn (f->parts); }
-    f->parts     = nptrs;
-    f->num_parts = ncount;
+    f->num_parts        = ncount;
     if (outpart) *outpart = part;
 
     return EXR_ERR_SUCCESS;
@@ -272,7 +293,8 @@ internal_exr_revert_add_part (
         if (ctxt->parts && ctxt->parts != &(ctxt->init_part))
             ctxt->free_fn (ctxt->parts);
 
-        ctxt->parts = NULL;
+        ctxt->parts         = NULL;
+        ctxt->part_capacity = 0;
     }
     ctxt->num_parts = ncount;
 }

{openexr-3.4.16 → openexr-3.4.17}/src/lib/OpenEXRCore/internal_structs.h

@@ -229,6 +229,8 @@ struct _priv_exr_context_t
     /* cheap array of one */
     exr_priv_part_t  init_part;
     exr_priv_part_t* parts;
+    /* allocated capacity of the parts array, grown geometrically */
+    int part_capacity;
 
     exr_attribute_list_t custom_handlers;
 

{openexr-3.4.16 → openexr-3.4.17}/src/lib/OpenEXRCore/internal_util.h

@@ -38,7 +38,7 @@ compute_sampled_height (int height, int y_sampling, int start_y)
         }
 
         tmph = height - off;
-        if (tmph == 0) return 0;
+        if (tmph <= 0) return 0;
         --tmph;
         nlines = tmph / y_sampling + 1;
     }
@@ -61,4 +61,26 @@ compute_sampled_width (int width, int x_sampling, int start_x)
     return (width == 1) ? 1 : (width / x_sampling);
 }
 
+/* Multiplies @p a by @p b and adds the result into @p accum, all as
+ * uint64_t. Returns 1 and leaves @p accum unmodified if either the
+ * multiplication or the subsequent accumulation would overflow a
+ * 64-bit unsigned integer, otherwise returns 0. Used to guard
+ * unpacked / scratch buffer size computations (width * height *
+ * bytes-per-pixel * channel-count) against wraparound on crafted
+ * files with extreme dimensions or channel counts. */
+static inline int
+checked_mul_accum_u64 (uint64_t* accum, uint64_t a, uint64_t b)
+{
+    uint64_t prod, sum;
+
+    if (a != 0 && b > (UINT64_MAX / a)) return 1;
+    prod = a * b;
+
+    sum = *accum + prod;
+    if (sum < *accum) return 1;
+
+    *accum = sum;
+    return 0;
+}
+
 #endif /* OPENEXR_PRIVATE_UTIL_H */

{openexr-3.4.16 → openexr-3.4.17}/src/lib/OpenEXRCore/openexr_chunkio.h

@@ -106,6 +106,12 @@ exr_result_t exr_read_chunk (
  * but this is a routine to get the sample count table and the packed
  * data in one go, or if you want to pre-read the sample count data,
  * you can get just that buffer.
+ *
+ * Both buffers are returned as stored in the file. If the part is
+ * compressed, the sample count table is compressed too. If it is not,
+ * the table holds cumulative per-scanline counts as little-endian
+ * 32-bit integers, which callers must convert on big-endian hosts. Use
+ * the decode pipeline to get native-order counts.
  */
 EXR_EXPORT
 exr_result_t exr_read_deep_chunk (

{openexr-3.4.16 → openexr-3.4.17}/src/lib/OpenEXRCore/openexr_version.h

@@ -10,6 +10,6 @@
 
 #    define OPENEXR_VERSION_MAJOR 3
 #    define OPENEXR_VERSION_MINOR 4
-#    define OPENEXR_VERSION_PATCH 16
+#    define OPENEXR_VERSION_PATCH 17
 
 #endif

{openexr-3.4.16 → openexr-3.4.17}/src/lib/OpenEXRCore/parse_header.c

@@ -2531,14 +2531,14 @@ internal_exr_compute_chunk_offset_size (exr_priv_part_t curpart)
         for (int c = 0; c < channels->num_channels; ++c)
         {
             /* tiles do not allow x/y sub sampling */
-            uint64_t cunpsz = 0;
-            if (channels->entries[c].pixel_type == EXR_PIXEL_HALF)
-                cunpsz = 2;
-            else
-                cunpsz = 4;
-            cunpsz *= (uint64_t) tiledesc->x_size;
-            cunpsz *= (uint64_t) tiledesc->y_size;
-            unpackedsize += cunpsz;
+            uint64_t cunpsz = (channels->entries[c].pixel_type == EXR_PIXEL_HALF)
+                                  ? 2
+                                  : 4;
+            if (checked_mul_accum_u64 (
+                    &unpackedsize,
+                    cunpsz,
+                    (uint64_t) tiledesc->x_size * (uint64_t) tiledesc->y_size))
+                return -1;
         }
         curpart->unpacked_size_per_chunk = unpackedsize;
         curpart->chan_has_line_sampling  = ((int16_t) hasLineSample);
@@ -2557,16 +2557,17 @@ internal_exr_compute_chunk_offset_size (exr_priv_part_t curpart)
         {
             int xsamp  = channels->entries[c].x_sampling;
             int ysamp  = channels->entries[c].y_sampling;
-            uint64_t cunpsz = 0;
-            if (channels->entries[c].pixel_type == EXR_PIXEL_HALF)
-                cunpsz = 2;
-            else
-                cunpsz = 4;
-            cunpsz *= (uint64_t) compute_sampled_width (w, xsamp, dw.min.x);
-            cunpsz *= (uint64_t) compute_sampled_height (linePerChunk, ysamp, dw.min.y);
+            uint64_t cunpsz = (channels->entries[c].pixel_type == EXR_PIXEL_HALF)
+                                  ? 2
+                                  : 4;
+            uint64_t sampw =
+                (uint64_t) compute_sampled_width ((int) w, xsamp, dw.min.x);
+            uint64_t samph = (uint64_t) compute_sampled_height (
+                linePerChunk, ysamp, dw.min.y);
             if (ysamp > 1)
                 hasLineSample = 1;
-            unpackedsize += cunpsz;
+            if (checked_mul_accum_u64 (&unpackedsize, cunpsz, sampw * samph))
+                return -1;
         }
 
         curpart->unpacked_size_per_chunk = unpackedsize;

{openexr-3.4.16 → openexr-3.4.17}/src/lib/OpenEXRCore/part_attr.c

@@ -497,8 +497,29 @@ copy_attr (
         default: rv = ctxt->standard_error (ctxt, EXR_ERR_INVALID_ATTR); break;
     }
 
-    if (rv != EXR_ERR_SUCCESS)
+    if (rv != EXR_ERR_SUCCESS && attr)
+    {
+        // the required attributes are cached in the part; don't leave any of
+        // them pointing at the attribute that is about to be freed
+        exr_attribute_t** cached[] = {
+            &part->channels,
+            &part->compression,
+            &part->dataWindow,
+            &part->displayWindow,
+            &part->lineOrder,
+            &part->pixelAspectRatio,
+            &part->screenWindowCenter,
+            &part->screenWindowWidth,
+            &part->tiles,
+            &part->name,
+            &part->type,
+            &part->version,
+            &part->chunkCount};
+        for (size_t i = 0; i < sizeof (cached) / sizeof (cached[0]); ++i)
+            if (*cached[i] == attr) *cached[i] = NULL;
+
         exr_attr_list_remove (ctxt, &(part->attributes), attr);
+    }
 
     return rv;
 }
@@ -552,7 +573,7 @@ exr_copy_unset_attributes (
         else { rv = EXR_ERR_SUCCESS; }
     }
 
-    if (update_tiles)
+    if (update_tiles && rv == EXR_ERR_SUCCESS)
         rv = internal_exr_compute_tile_information (ctxt, part, 1);
 
     if (source != ctxt) internal_exr_unlock (source);

{openexr-3.4.16 → openexr-3.4.17}/src/lib/OpenEXRCore/validation.c

@@ -11,6 +11,7 @@
 
 #include <limits.h>
 #include <math.h>
+#include <stdint.h>
 #include <stdio.h>
 #include <string.h>
 
@@ -414,6 +415,22 @@ validate_channels (
         return f->report_error (
             f, EXR_ERR_FILE_BAD_HEADER, "At least one channel required");
 
+    /* Internal coding pipeline structures (exr_coding_channel_info_t
+     * descriptor counts, exr_decode/encode_pipeline_t::channel_count)
+     * store the channel count in an int16_t. A channel list larger than
+     * this silently truncates downstream (e.g. 73,728 channels wraps to
+     * 8,192), decoupling the actual channel count from the one used to
+     * size scratch/unpacked buffers and leading to undersized
+     * allocations relative to the data actually unpacked. Reject such
+     * files outright. */
+    if (channels->num_channels > INT16_MAX)
+        return f->print_error (
+            f,
+            EXR_ERR_FILE_BAD_HEADER,
+            "Channel count (%d) exceeds maximum supported value (%d)",
+            channels->num_channels,
+            (int) INT16_MAX);
+
     dw = curpart->data_window;
     w  = (int64_t) dw.max.x - (int64_t) dw.min.x + 1;
     h  = (int64_t) dw.max.y - (int64_t) dw.min.y + 1;