Skip to content

Commit c09a374

Browse files
musicinmybraincgohlkecary-ilm
authored and
pixar-oss
committed
Backport several OpenEXRCore security fixes
This includes the following commits from OpenEXR upstream: - ??? via AcademySoftwareFoundation/openexr@7567d41 - https://www.cve.org/CVERecord?id=CVE-2026-34378 / GHSA-v76p-4qvv-vh4g via AcademySoftwareFoundation/openexr@7a1c64c - https://www.cve.org/CVERecord?id=CVE-2026-34380 / GHSA-q3v8-hw4m-59w5 via AcademySoftwareFoundation/openexr@f5beec2 - https://www.cve.org/CVERecord?id=CVE-2026-34588 / GHSA-588r-cr5c-w6hf via AcademySoftwareFoundation/openexr@e464a33 - https://www.cve.org/CVERecord?id=CVE-2026-34589 / GHSA-p8xc-w3q4-h64x via AcademySoftwareFoundation/openexr@7c31424 - https://www.cve.org/CVERecord?id=CVE-2026-34379 / GHSA-w88v-vqhq-5p24 via AcademySoftwareFoundation/openexr@3ad9b29 Closes #4030 (Internal change: 2404286) Co-authored-by: Christoph Gohlke <cgohlke@cgohlke.com> Co-authored-by: Cary Phillips <cary@ilm.com>
1 parent 0c4e59b commit c09a374

5 files changed

Lines changed: 61 additions & 45 deletions

File tree

‎pxr/imaging/plugin/hioOpenEXR/OpenEXR/OpenEXRCore/internal_dwa_decoder.h‎

Lines changed: 15 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -265,7 +265,7 @@ LossyDctDecoder_execute (
265265
}
266266

267267
for (int comp = 1; comp < numComp; ++comp)
268-
rowBlock[comp] = rowBlock[comp - 1] + numBlocksX * 64;
268+
rowBlock[comp] = rowBlock[comp - 1] + (size_t) numBlocksX * 64;
269269

270270
//
271271
// Pack DC components together by common plane, so we can get
@@ -275,7 +275,7 @@ LossyDctDecoder_execute (
275275

276276
currDcComp[0] = (uint16_t*) d->_packedDc;
277277
for (int comp = 1; comp < numComp; ++comp)
278-
currDcComp[comp] = currDcComp[comp - 1] + numBlocksX * numBlocksY;
278+
currDcComp[comp] = currDcComp[comp - 1] + (size_t) numBlocksX * numBlocksY;
279279

280280
for (int blocky = 0; blocky < numBlocksY; ++blocky)
281281
{
@@ -651,13 +651,22 @@ LossyDctDecoder_execute (
651651
/* process in place in reverse to avoid temporary buffer */
652652
for (int y = 0; y < d->_height; ++y)
653653
{
654-
float* floatXdrPtr = (float*) chanData[chan]->_rows[y];
655-
uint16_t* halfXdr = (uint16_t*) floatXdrPtr;
654+
uint8_t* rowBytes = chanData[chan]->_rows[y];
656655

657656
for (int x = d->_width - 1; x >= 0; --x)
658657
{
659-
floatXdrPtr[x] = one_from_native_float (
660-
half_to_float (one_to_native16 (halfXdr[x])));
658+
// TODO: make an unaligned_store32f that takes the float and
659+
// packages up a one_from_native_float and calls memcpy
660+
// instead of the two memcpy. We should look at the metrics
661+
// for dwa and see if there's a performance difference to do
662+
// so at some point. See:
663+
// https://github.com/AcademySoftwareFoundation/openexr/pull/2324
664+
665+
uint16_t h = unaligned_load16 (rowBytes + x * sizeof (uint16_t));
666+
float f = half_to_float (h);
667+
uint32_t bits;
668+
memcpy (&bits, &f, sizeof (bits));
669+
unaligned_store32 (rowBytes + x * sizeof (float), bits);
661670
}
662671
}
663672
}

‎pxr/imaging/plugin/hioOpenEXR/OpenEXR/OpenEXRCore/internal_piz.c‎

Lines changed: 23 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -10,6 +10,7 @@
1010
#include "internal_huf.h"
1111
#include "internal_xdr.h"
1212

13+
#include <limits.h>
1314
#include <string.h>
1415

1516
/**************************************/
@@ -171,10 +172,11 @@ wdec16 (uint16_t l, uint16_t h, uint16_t* a, uint16_t* b)
171172
static void
172173
wav_2D_encode (uint16_t* in, int nx, int ox, int ny, int oy, uint16_t mx)
173174
{
174-
int w14 = (mx < (1 << 14)) ? 1 : 0;
175-
int n = (nx > ny) ? ny : nx;
176-
int p = 1; // == 1 << level
177-
int p2 = 2; // == 1 << (level+1)
175+
int w14 = (mx < (1 << 14)) ? 1 : 0;
176+
int n = (nx > ny) ? ny : nx;
177+
int p = 1; // == 1 << level
178+
int p2 = 2; // == 1 << (level+1)
179+
int64_t oy64 = oy;
178180

179181
//
180182
// Hierarchical loop on smaller dimension n
@@ -183,9 +185,9 @@ wav_2D_encode (uint16_t* in, int nx, int ox, int ny, int oy, uint16_t mx)
183185
while (p2 <= n)
184186
{
185187
uint16_t* py = in;
186-
uint16_t* ey = in + oy * (ny - p2);
187-
int oy1 = oy * p;
188-
int oy2 = oy * p2;
188+
uint16_t* ey = in + oy64 * (ny - p2);
189+
int64_t oy1 = oy64 * p;
190+
int64_t oy2 = oy64 * p2;
189191
int ox1 = ox * p;
190192
int ox2 = ox * p2;
191193
uint16_t i00, i01, i10, i11;
@@ -284,10 +286,11 @@ wav_2D_decode (
284286
int oy, // i : y offset
285287
uint16_t mx) // i : maximum in[x][y] value
286288
{
287-
int w14 = (mx < (1 << 14)) ? 1 : 0;
288-
int n = (nx > ny) ? ny : nx;
289-
int p = 1;
290-
int p2;
289+
int w14 = (mx < (1 << 14)) ? 1 : 0;
290+
int n = (nx > ny) ? ny : nx;
291+
int p = 1;
292+
int p2;
293+
int64_t oy64 = oy;
291294

292295
//
293296
// Search max level
@@ -307,9 +310,9 @@ wav_2D_decode (
307310
while (p >= 1)
308311
{
309312
uint16_t* py = in;
310-
uint16_t* ey = in + oy * (ny - p2);
311-
int oy1 = oy * p;
312-
int oy2 = oy * p2;
313+
uint16_t* ey = in + oy64 * (ny - p2);
314+
int64_t oy1 = oy64 * p;
315+
int64_t oy2 = oy64 * p2;
313316
int ox1 = ox * p;
314317
int ox2 = ox * p2;
315318
uint16_t i00, i01, i10, i11;
@@ -502,11 +505,13 @@ internal_exr_apply_piz (exr_encode_pipeline_t* encode)
502505
nx = curc->width;
503506
ny = curc->height;
504507
wcount = (int) (curc->bytes_per_element / 2);
508+
if (wcount > 0 && nx > INT_MAX / wcount)
509+
return EXR_ERR_CORRUPT_CHUNK;
505510
for (int j = 0; j < wcount; ++j)
506511
{
507512
wav_2D_encode (wavbuf + j, nx, wcount, ny, wcount * nx, maxValue);
508513
}
509-
wavbuf += nx * ny * wcount;
514+
wavbuf += (uint64_t) nx * ny * wcount;
510515
}
511516

512517
nBytes = 0;
@@ -655,11 +660,13 @@ internal_exr_undo_piz (
655660
nx = curc->width;
656661
ny = curc->height;
657662
wcount = (int) (curc->bytes_per_element / 2);
663+
if (wcount > 0 && nx > INT_MAX / wcount)
664+
return EXR_ERR_CORRUPT_CHUNK;
658665
for (int j = 0; j < wcount; ++j)
659666
{
660667
wav_2D_decode (wavbuf + j, nx, wcount, ny, wcount * nx, maxValue);
661668
}
662-
wavbuf += nx * ny * wcount;
669+
wavbuf += (uint64_t) nx * ny * wcount;
663670
}
664671

665672
//

‎pxr/imaging/plugin/hioOpenEXR/OpenEXR/OpenEXRCore/internal_pxr24.c‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -182,7 +182,7 @@ apply_pxr24_impl (exr_encode_pipeline_t* encode)
182182
if (nOut + nBytes > encode->scratch_alloc_size_1)
183183
return EXR_ERR_OUT_OF_MEMORY;
184184
nOut += nBytes;
185-
lastIn += w * 4;
185+
lastIn += (uint64_t) w * 4;
186186

187187
ptr[0] = out;
188188
out += w;
@@ -371,7 +371,7 @@ undo_pxr24_impl (
371371
ptr[2] = lastIn;
372372
lastIn += w;
373373

374-
if (nDec + (uint64_t) (w * 3) > outSize)
374+
if (nDec + (uint64_t) w * 3 > outSize)
375375
return EXR_ERR_CORRUPT_CHUNK;
376376

377377
for (int x = 0; x < w; ++x)
@@ -384,7 +384,7 @@ undo_pxr24_impl (
384384
unaligned_store32 (dout, pixel);
385385
++dout;
386386
}
387-
nDec += (uint64_t) (w * 3);
387+
nDec += (uint64_t) w * 3;
388388
break;
389389
}
390390
default: return EXR_ERR_INVALID_ARGUMENT;

‎pxr/imaging/plugin/hioOpenEXR/OpenEXR/OpenEXRCore/internal_zip.c‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -367,7 +367,7 @@ apply_zip_impl (exr_encode_pipeline_t* encode)
367367

368368
if (rv == EXR_ERR_SUCCESS)
369369
{
370-
if (compbufsz > encode->packed_bytes)
370+
if (compbufsz >= encode->packed_bytes)
371371
{
372372
memcpy (
373373
encode->compressed_buffer,

‎pxr/imaging/plugin/hioOpenEXR/OpenEXR/OpenEXRCore/unpack.c‎

Lines changed: 19 additions & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -229,7 +229,7 @@ unpack_16bit_3chan_interleave (exr_decode_pipeline_t* decode)
229229
in1 = in0 + w;
230230
in2 = in1 + w;
231231

232-
srcbuffer += w * 6; // 3 * sizeof(uint16_t), avoid type conversion
232+
srcbuffer += (int64_t) w * 6; // 3 * sizeof(uint16_t), avoid type conversion
233233
for (int x = 0; x < w; ++x)
234234
{
235235
out[0] = one_to_native16 (in0[x]);
@@ -269,7 +269,7 @@ unpack_16bit_3chan_interleave_rev (exr_decode_pipeline_t* decode)
269269
in1 = in0 + w; // G
270270
in2 = in1 + w; // R
271271

272-
srcbuffer += w * 6; // 3 * sizeof(uint16_t), avoid type conversion
272+
srcbuffer += (int64_t) w * 6; // 3 * sizeof(uint16_t), avoid type conversion
273273
for (int x = 0; x < w; ++x)
274274
{
275275
out[0] = one_to_native16 (in2[x]);
@@ -309,7 +309,7 @@ unpack_half_to_float_3chan_interleave (exr_decode_pipeline_t* decode)
309309
in1 = in0 + w;
310310
in2 = in1 + w;
311311

312-
srcbuffer += w * 6; // 3 * sizeof(uint16_t), avoid type conversion
312+
srcbuffer += (int64_t) w * 6; // 3 * sizeof(uint16_t), avoid type conversion
313313
for (int x = 0; x < w; ++x)
314314
{
315315
out[0] = half_to_float (one_to_native16 (in0[x]));
@@ -349,7 +349,7 @@ unpack_half_to_float_3chan_interleave_rev (exr_decode_pipeline_t* decode)
349349
in1 = in0 + w;
350350
in2 = in1 + w;
351351

352-
srcbuffer += w * 6; // 3 * sizeof(uint16_t), avoid type conversion
352+
srcbuffer += (int64_t) w * 6; // 3 * sizeof(uint16_t), avoid type conversion
353353
for (int x = 0; x < w; ++x)
354354
{
355355
out[0] = half_to_float (one_to_native16 (in2[x]));
@@ -390,7 +390,7 @@ unpack_16bit_3chan_planar (exr_decode_pipeline_t* decode)
390390
in0 = (const uint16_t*) srcbuffer;
391391
in1 = in0 + w;
392392
in2 = in1 + w;
393-
srcbuffer += w * 6; // 3 * sizeof(uint16_t), avoid type conversion
393+
srcbuffer += (int64_t) w * 6; // 3 * sizeof(uint16_t), avoid type conversion
394394
/* specialise to memcpy if we can */
395395
#if EXR_HOST_IS_NOT_LITTLE_ENDIAN
396396
for (int x = 0; x < w; ++x)
@@ -440,7 +440,7 @@ unpack_half_to_float_3chan_planar (exr_decode_pipeline_t* decode)
440440
in0 = (const uint16_t*) srcbuffer;
441441
in1 = in0 + w;
442442
in2 = in1 + w;
443-
srcbuffer += w * 6; // 3 * sizeof(uint16_t), avoid type conversion
443+
srcbuffer += (int64_t) w * 6; // 3 * sizeof(uint16_t), avoid type conversion
444444
/* specialise to memcpy if we can */
445445
half_to_float_buffer ((float*) out0, in0, w);
446446
half_to_float_buffer ((float*) out1, in1, w);
@@ -485,7 +485,7 @@ unpack_16bit_3chan (exr_decode_pipeline_t* decode)
485485
in0 = (const uint16_t*) srcbuffer;
486486
in1 = in0 + w;
487487
in2 = in1 + w;
488-
srcbuffer += w * 6; // 3 * sizeof(uint16_t), avoid type conversion
488+
srcbuffer += (int64_t) w * 6; // 3 * sizeof(uint16_t), avoid type conversion
489489
for (int x = 0; x < w; ++x)
490490
*((uint16_t*) (out0 + x * inc0)) = one_to_native16 (in0[x]);
491491
for (int x = 0; x < w; ++x)
@@ -539,7 +539,7 @@ unpack_16bit_4chan_interleave (exr_decode_pipeline_t* decode)
539539
in2 = in1 + w;
540540
in3 = in2 + w;
541541

542-
srcbuffer += w * 8; // 4 * sizeof(uint16_t), avoid type conversion
542+
srcbuffer += (int64_t) w * 8; // 4 * sizeof(uint16_t), avoid type conversion
543543
for (int x = 0; x < w; ++x)
544544
{
545545
combined.a = one_to_native16 (in0[x]);
@@ -592,7 +592,7 @@ unpack_16bit_4chan_interleave_rev (exr_decode_pipeline_t* decode)
592592
in2 = in1 + w;
593593
in3 = in2 + w;
594594

595-
srcbuffer += w * 8; // 4 * sizeof(uint16_t), avoid type conversion
595+
srcbuffer += (int64_t) w * 8; // 4 * sizeof(uint16_t), avoid type conversion
596596
for (int x = 0; x < w; ++x)
597597
{
598598
combined.a = one_to_native16 (in0[x]);
@@ -633,7 +633,7 @@ unpack_half_to_float_4chan_interleave (exr_decode_pipeline_t* decode)
633633
in2 = in1 + w;
634634
in3 = in2 + w;
635635

636-
srcbuffer += w * 8; // 4 * sizeof(uint16_t), avoid type conversion
636+
srcbuffer += (int64_t) w * 8; // 4 * sizeof(uint16_t), avoid type conversion
637637
for (int x = 0; x < w; ++x)
638638
{
639639
out[0] = half_to_float (one_to_native16 (in3[x]));
@@ -674,7 +674,7 @@ unpack_half_to_float_4chan_interleave_rev (exr_decode_pipeline_t* decode)
674674
in2 = in1 + w;
675675
in3 = in2 + w;
676676

677-
srcbuffer += w * 8; // 4 * sizeof(uint16_t), avoid type conversion
677+
srcbuffer += (int64_t) w * 8; // 4 * sizeof(uint16_t), avoid type conversion
678678
for (int x = 0; x < w; ++x)
679679
{
680680
out[0] = half_to_float (one_to_native16 (in0[x]));
@@ -719,7 +719,7 @@ unpack_16bit_4chan_planar (exr_decode_pipeline_t* decode)
719719
in1 = in0 + w;
720720
in2 = in1 + w;
721721
in3 = in2 + w;
722-
srcbuffer += w * 8; // 4 * sizeof(uint16_t), avoid type conversion
722+
srcbuffer += (int64_t) w * 8; // 4 * sizeof(uint16_t), avoid type conversion
723723
/* specialize to memcpy if we can */
724724
#if EXR_HOST_IS_NOT_LITTLE_ENDIAN
725725
for (int x = 0; x < w; ++x)
@@ -775,7 +775,7 @@ unpack_half_to_float_4chan_planar (exr_decode_pipeline_t* decode)
775775
in1 = in0 + w;
776776
in2 = in1 + w;
777777
in3 = in2 + w;
778-
srcbuffer += w * 8; // 4 * sizeof(uint16_t), avoid type conversion
778+
srcbuffer += (int64_t) w * 8; // 4 * sizeof(uint16_t), avoid type conversion
779779

780780
half_to_float_buffer ((float*) out0, in0, w);
781781
half_to_float_buffer ((float*) out1, in1, w);
@@ -825,7 +825,7 @@ unpack_16bit_4chan (exr_decode_pipeline_t* decode)
825825
in1 = in0 + w;
826826
in2 = in1 + w;
827827
in3 = in2 + w;
828-
srcbuffer += w * 8; // 4 * sizeof(uint16_t), avoid type conversion
828+
srcbuffer += (int64_t) w * 8; // 4 * sizeof(uint16_t), avoid type conversion
829829
for (int x = 0; x < w; ++x)
830830
*((uint16_t*) (out0 + x * inc0)) = one_to_native16 (in0[x]);
831831
for (int x = 0; x < w; ++x)
@@ -898,7 +898,7 @@ unpack_16bit (exr_decode_pipeline_t* decode)
898898
}
899899
}
900900
#endif
901-
srcbuffer += w * 2;
901+
srcbuffer += (int64_t) w * 2;
902902
}
903903
}
904904
return EXR_ERR_SUCCESS;
@@ -963,7 +963,7 @@ unpack_32bit (exr_decode_pipeline_t* decode)
963963
}
964964
}
965965
#endif
966-
srcbuffer += w * 4;
966+
srcbuffer += (int64_t) w * 4;
967967
}
968968
}
969969
return EXR_ERR_SUCCESS;
@@ -1118,7 +1118,7 @@ generic_unpack (exr_decode_pipeline_t* decode)
11181118
(uint64_t) decc->user_line_stride);
11191119
else
11201120
{
1121-
srcbuffer += w * bpc;
1121+
srcbuffer += (int64_t) w * bpc;
11221122
continue;
11231123
}
11241124
}
@@ -1128,12 +1128,12 @@ generic_unpack (exr_decode_pipeline_t* decode)
11281128
}
11291129
else
11301130
{
1131-
srcbuffer += w * bpc;
1131+
srcbuffer += (int64_t) w * bpc;
11321132
continue;
11331133
}
11341134

11351135
UNPACK_SAMPLES (w)
1136-
srcbuffer += w * bpc;
1136+
srcbuffer += (int64_t) w * bpc;
11371137
}
11381138
}
11391139
return EXR_ERR_SUCCESS;

0 commit comments

Comments
 (0)
⚡