Backport fix for CVE-2026-34544 in OpenEXRCore

[musicinmybrain]

Description of Change(s)

This backports AcademySoftwareFoundation/openexr@35e7aa3 from OpenEXR upstream to address https://www.cve.org/CVERecord?id=CVE-2026-34544 / GHSA-h762-rhv3-h25v.

All I did was the following, in a git checkout of OpenUSD:

curl -L -O https://github.com/AcademySoftwareFoundation/openexr/commit/35e7aa35e22c1975606be86e859f31cc1fc598ee.patch
git am --directory=pxr/imaging/plugin/hioOpenEXR/OpenEXR -p3 35e7aa35e22c1975606be86e859f31cc1fc598ee.patch

The following text is from the upstream commit message. Note that the upstream fix was LLM-assisted, but I did not use an LLM to backport it or to write this PR text.

---

Fix B44/B44A integer overflow: use uint64_t for row offset (#2312)

The B44 and B44A decoder and encoder use channel width (nx) and height (ny) in row pointer math. nx and ny are int; the scratch buffer is correctly sized with (uint64_t)ny * (uint64_t)nx * bytes_per_element, but row bases were computed as:

  row0 = (uint16_t*)scratch;
  row0 += y * nx;   // int * int -> signed overflow when y*nx > INT_MAX

For large nx (e.g. 268435456), y*nx overflows, so row0/row1/row2/row3 point before the scratch buffer.

Fix: compute the row offset in uint64_t before pointer arithmetic in both uncompress_b44_impl (decoder) and compress_b44_impl (encoder).

Analysis and solution with the help of Curor / Claude Opus 4.5

Fixes Issue(s)

N/A

Checklist

• I have created this PR based on the dev branch

• I have followed the coding conventions

• I have added unit tests that exercise this functionality (Reference:
  testing guidelines)

N/A; no new functionality

• I have verified that all unit tests pass with the proposed changes

N/A; it is hard for me to run these locally

• I have submitted a signed Contributor License Agreement (Reference:
  Contributor License Agreement instructions)

[sunyab]

Filed as internal issue #USD-12065

(This is an automated message. See here for more information.)