Skip to content

Backport several OpenEXRCore security fixes #4030

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
musicinmybrain wants to merge 6 commits into from
Closed

Backport several OpenEXRCore security fixes #4030

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
4f03fb0
Fix comparison operator for buffer size check (#2307)
cgohlke Mar 18, 2026
0512b6c
Fix integer overflow in `srcbuffer` pointer arithmetic in `unpack_*` …
cary-ilm Mar 26, 2026
f5f7f32
Security: fix signed integer overflow in `undo_pxr24_impl()` (PXR24 d…
cary-ilm Mar 30, 2026
d578381
fix integer overflow in PIZ wavelet buffer arithmetic (#2328)
cary-ilm Mar 30, 2026
a764742
Fix signed integer overflow in `LossyDctDecoder_execute()` pointer ar…
cary-ilm Mar 30, 2026
219a087
Fix misaligned memory access in `LossyDctDecoder_execute` HALF→FLOAT …
cary-ilm Mar 31, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
21 changes: 15 additions & 6 deletions pxr/imaging/plugin/hioOpenEXR/OpenEXR/OpenEXRCore/internal_dwa_decoder.h
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -265,7 +265,7 @@ LossyDctDecoder_execute (
}

for (int comp = 1; comp < numComp; ++comp)
rowBlock[comp] = rowBlock[comp - 1] + numBlocksX * 64;
rowBlock[comp] = rowBlock[comp - 1] + (size_t) numBlocksX * 64;

//
// Pack DC components together by common plane, so we can get
Expand All @@ -275,7 +275,7 @@ LossyDctDecoder_execute (

currDcComp[0] = (uint16_t*) d->_packedDc;
for (int comp = 1; comp < numComp; ++comp)
currDcComp[comp] = currDcComp[comp - 1] + numBlocksX * numBlocksY;
currDcComp[comp] = currDcComp[comp - 1] + (size_t) numBlocksX * numBlocksY;

for (int blocky = 0; blocky < numBlocksY; ++blocky)
{
Expand Down Expand Up @@ -651,13 +651,22 @@ LossyDctDecoder_execute (
/* process in place in reverse to avoid temporary buffer */
for (int y = 0; y < d->_height; ++y)
{
float* floatXdrPtr = (float*) chanData[chan]->_rows[y];
uint16_t* halfXdr = (uint16_t*) floatXdrPtr;
uint8_t* rowBytes = chanData[chan]->_rows[y];

for (int x = d->_width - 1; x >= 0; --x)
{
floatXdrPtr[x] = one_from_native_float (
half_to_float (one_to_native16 (halfXdr[x])));
// TODO: make an unaligned_store32f that takes the float and
// packages up a one_from_native_float and calls memcpy
// instead of the two memcpy. We should look at the metrics
// for dwa and see if there's a performance difference to do
// so at some point. See:
// https://github.com/AcademySoftwareFoundation/openexr/pull/2324

uint16_t h = unaligned_load16 (rowBytes + x * sizeof (uint16_t));
float f = half_to_float (h);
uint32_t bits;
memcpy (&bits, &f, sizeof (bits));
unaligned_store32 (rowBytes + x * sizeof (float), bits);
}
}
}
Expand Down
39 changes: 23 additions & 16 deletions pxr/imaging/plugin/hioOpenEXR/OpenEXR/OpenEXRCore/internal_piz.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,6 +10,7 @@
#include "internal_huf.h"
#include "internal_xdr.h"

#include <limits.h>
#include <string.h>

/**************************************/
Expand Down Expand Up @@ -171,10 +172,11 @@ wdec16 (uint16_t l, uint16_t h, uint16_t* a, uint16_t* b)
static void
wav_2D_encode (uint16_t* in, int nx, int ox, int ny, int oy, uint16_t mx)
{
int w14 = (mx < (1 << 14)) ? 1 : 0;
int n = (nx > ny) ? ny : nx;
int p = 1; // == 1 << level
int p2 = 2; // == 1 << (level+1)
int w14 = (mx < (1 << 14)) ? 1 : 0;
int n = (nx > ny) ? ny : nx;
int p = 1; // == 1 << level
int p2 = 2; // == 1 << (level+1)
int64_t oy64 = oy;

//
// Hierarchical loop on smaller dimension n
Expand All @@ -183,9 +185,9 @@ wav_2D_encode (uint16_t* in, int nx, int ox, int ny, int oy, uint16_t mx)
while (p2 <= n)
{
uint16_t* py = in;
uint16_t* ey = in + oy * (ny - p2);
int oy1 = oy * p;
int oy2 = oy * p2;
uint16_t* ey = in + oy64 * (ny - p2);
int64_t oy1 = oy64 * p;
int64_t oy2 = oy64 * p2;
int ox1 = ox * p;
int ox2 = ox * p2;
uint16_t i00, i01, i10, i11;
Expand Down Expand Up @@ -284,10 +286,11 @@ wav_2D_decode (
int oy, // i : y offset
uint16_t mx) // i : maximum in[x][y] value
{
int w14 = (mx < (1 << 14)) ? 1 : 0;
int n = (nx > ny) ? ny : nx;
int p = 1;
int p2;
int w14 = (mx < (1 << 14)) ? 1 : 0;
int n = (nx > ny) ? ny : nx;
int p = 1;
int p2;
int64_t oy64 = oy;

//
// Search max level
Expand All @@ -307,9 +310,9 @@ wav_2D_decode (
while (p >= 1)
{
uint16_t* py = in;
uint16_t* ey = in + oy * (ny - p2);
int oy1 = oy * p;
int oy2 = oy * p2;
uint16_t* ey = in + oy64 * (ny - p2);
int64_t oy1 = oy64 * p;
int64_t oy2 = oy64 * p2;
int ox1 = ox * p;
int ox2 = ox * p2;
uint16_t i00, i01, i10, i11;
Expand Down Expand Up @@ -502,11 +505,13 @@ internal_exr_apply_piz (exr_encode_pipeline_t* encode)
nx = curc->width;
ny = curc->height;
wcount = (int) (curc->bytes_per_element / 2);
if (wcount > 0 && nx > INT_MAX / wcount)
return EXR_ERR_CORRUPT_CHUNK;
for (int j = 0; j < wcount; ++j)
{
wav_2D_encode (wavbuf + j, nx, wcount, ny, wcount * nx, maxValue);
}
wavbuf += nx * ny * wcount;
wavbuf += (uint64_t) nx * ny * wcount;
}

nBytes = 0;
Expand Down Expand Up @@ -655,11 +660,13 @@ internal_exr_undo_piz (
nx = curc->width;
ny = curc->height;
wcount = (int) (curc->bytes_per_element / 2);
if (wcount > 0 && nx > INT_MAX / wcount)
return EXR_ERR_CORRUPT_CHUNK;
for (int j = 0; j < wcount; ++j)
{
wav_2D_decode (wavbuf + j, nx, wcount, ny, wcount * nx, maxValue);
}
wavbuf += nx * ny * wcount;
wavbuf += (uint64_t) nx * ny * wcount;
}

//
Expand Down
6 changes: 3 additions & 3 deletions pxr/imaging/plugin/hioOpenEXR/OpenEXR/OpenEXRCore/internal_pxr24.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -182,7 +182,7 @@ apply_pxr24_impl (exr_encode_pipeline_t* encode)
if (nOut + nBytes > encode->scratch_alloc_size_1)
return EXR_ERR_OUT_OF_MEMORY;
nOut += nBytes;
lastIn += w * 4;
lastIn += (uint64_t) w * 4;

ptr[0] = out;
out += w;
Expand Down Expand Up @@ -371,7 +371,7 @@ undo_pxr24_impl (
ptr[2] = lastIn;
lastIn += w;

if (nDec + (uint64_t) (w * 3) > outSize)
if (nDec + (uint64_t) w * 3 > outSize)
return EXR_ERR_CORRUPT_CHUNK;

for (int x = 0; x < w; ++x)
Expand All @@ -384,7 +384,7 @@ undo_pxr24_impl (
unaligned_store32 (dout, pixel);
++dout;
}
nDec += (uint64_t) (w * 3);
nDec += (uint64_t) w * 3;
break;
}
default: return EXR_ERR_INVALID_ARGUMENT;
Expand Down
2 changes: 1 addition & 1 deletion pxr/imaging/plugin/hioOpenEXR/OpenEXR/OpenEXRCore/internal_zip.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -367,7 +367,7 @@ apply_zip_impl (exr_encode_pipeline_t* encode)

if (rv == EXR_ERR_SUCCESS)
{
if (compbufsz > encode->packed_bytes)
if (compbufsz >= encode->packed_bytes)
{
memcpy (
encode->compressed_buffer,
Expand Down
38 changes: 19 additions & 19 deletions pxr/imaging/plugin/hioOpenEXR/OpenEXR/OpenEXRCore/unpack.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -229,7 +229,7 @@ unpack_16bit_3chan_interleave (exr_decode_pipeline_t* decode)
in1 = in0 + w;
in2 = in1 + w;

srcbuffer += w * 6; // 3 * sizeof(uint16_t), avoid type conversion
srcbuffer += (int64_t) w * 6; // 3 * sizeof(uint16_t), avoid type conversion
for (int x = 0; x < w; ++x)
{
out[0] = one_to_native16 (in0[x]);
Expand Down Expand Up @@ -269,7 +269,7 @@ unpack_16bit_3chan_interleave_rev (exr_decode_pipeline_t* decode)
in1 = in0 + w; // G
in2 = in1 + w; // R

srcbuffer += w * 6; // 3 * sizeof(uint16_t), avoid type conversion
srcbuffer += (int64_t) w * 6; // 3 * sizeof(uint16_t), avoid type conversion
for (int x = 0; x < w; ++x)
{
out[0] = one_to_native16 (in2[x]);
Expand Down Expand Up @@ -309,7 +309,7 @@ unpack_half_to_float_3chan_interleave (exr_decode_pipeline_t* decode)
in1 = in0 + w;
in2 = in1 + w;

srcbuffer += w * 6; // 3 * sizeof(uint16_t), avoid type conversion
srcbuffer += (int64_t) w * 6; // 3 * sizeof(uint16_t), avoid type conversion
for (int x = 0; x < w; ++x)
{
out[0] = half_to_float (one_to_native16 (in0[x]));
Expand Down Expand Up @@ -349,7 +349,7 @@ unpack_half_to_float_3chan_interleave_rev (exr_decode_pipeline_t* decode)
in1 = in0 + w;
in2 = in1 + w;

srcbuffer += w * 6; // 3 * sizeof(uint16_t), avoid type conversion
srcbuffer += (int64_t) w * 6; // 3 * sizeof(uint16_t), avoid type conversion
for (int x = 0; x < w; ++x)
{
out[0] = half_to_float (one_to_native16 (in2[x]));
Expand Down Expand Up @@ -390,7 +390,7 @@ unpack_16bit_3chan_planar (exr_decode_pipeline_t* decode)
in0 = (const uint16_t*) srcbuffer;
in1 = in0 + w;
in2 = in1 + w;
srcbuffer += w * 6; // 3 * sizeof(uint16_t), avoid type conversion
srcbuffer += (int64_t) w * 6; // 3 * sizeof(uint16_t), avoid type conversion
/* specialise to memcpy if we can */
#if EXR_HOST_IS_NOT_LITTLE_ENDIAN
for (int x = 0; x < w; ++x)
Expand Down Expand Up @@ -440,7 +440,7 @@ unpack_half_to_float_3chan_planar (exr_decode_pipeline_t* decode)
in0 = (const uint16_t*) srcbuffer;
in1 = in0 + w;
in2 = in1 + w;
srcbuffer += w * 6; // 3 * sizeof(uint16_t), avoid type conversion
srcbuffer += (int64_t) w * 6; // 3 * sizeof(uint16_t), avoid type conversion
/* specialise to memcpy if we can */
half_to_float_buffer ((float*) out0, in0, w);
half_to_float_buffer ((float*) out1, in1, w);
Expand Down Expand Up @@ -485,7 +485,7 @@ unpack_16bit_3chan (exr_decode_pipeline_t* decode)
in0 = (const uint16_t*) srcbuffer;
in1 = in0 + w;
in2 = in1 + w;
srcbuffer += w * 6; // 3 * sizeof(uint16_t), avoid type conversion
srcbuffer += (int64_t) w * 6; // 3 * sizeof(uint16_t), avoid type conversion
for (int x = 0; x < w; ++x)
*((uint16_t*) (out0 + x * inc0)) = one_to_native16 (in0[x]);
for (int x = 0; x < w; ++x)
Expand Down Expand Up @@ -539,7 +539,7 @@ unpack_16bit_4chan_interleave (exr_decode_pipeline_t* decode)
in2 = in1 + w;
in3 = in2 + w;

srcbuffer += w * 8; // 4 * sizeof(uint16_t), avoid type conversion
srcbuffer += (int64_t) w * 8; // 4 * sizeof(uint16_t), avoid type conversion
for (int x = 0; x < w; ++x)
{
combined.a = one_to_native16 (in0[x]);
Expand Down Expand Up @@ -592,7 +592,7 @@ unpack_16bit_4chan_interleave_rev (exr_decode_pipeline_t* decode)
in2 = in1 + w;
in3 = in2 + w;

srcbuffer += w * 8; // 4 * sizeof(uint16_t), avoid type conversion
srcbuffer += (int64_t) w * 8; // 4 * sizeof(uint16_t), avoid type conversion
for (int x = 0; x < w; ++x)
{
combined.a = one_to_native16 (in0[x]);
Expand Down Expand Up @@ -633,7 +633,7 @@ unpack_half_to_float_4chan_interleave (exr_decode_pipeline_t* decode)
in2 = in1 + w;
in3 = in2 + w;

srcbuffer += w * 8; // 4 * sizeof(uint16_t), avoid type conversion
srcbuffer += (int64_t) w * 8; // 4 * sizeof(uint16_t), avoid type conversion
for (int x = 0; x < w; ++x)
{
out[0] = half_to_float (one_to_native16 (in3[x]));
Expand Down Expand Up @@ -674,7 +674,7 @@ unpack_half_to_float_4chan_interleave_rev (exr_decode_pipeline_t* decode)
in2 = in1 + w;
in3 = in2 + w;

srcbuffer += w * 8; // 4 * sizeof(uint16_t), avoid type conversion
srcbuffer += (int64_t) w * 8; // 4 * sizeof(uint16_t), avoid type conversion
for (int x = 0; x < w; ++x)
{
out[0] = half_to_float (one_to_native16 (in0[x]));
Expand Down Expand Up @@ -719,7 +719,7 @@ unpack_16bit_4chan_planar (exr_decode_pipeline_t* decode)
in1 = in0 + w;
in2 = in1 + w;
in3 = in2 + w;
srcbuffer += w * 8; // 4 * sizeof(uint16_t), avoid type conversion
srcbuffer += (int64_t) w * 8; // 4 * sizeof(uint16_t), avoid type conversion
/* specialize to memcpy if we can */
#if EXR_HOST_IS_NOT_LITTLE_ENDIAN
for (int x = 0; x < w; ++x)
Expand Down Expand Up @@ -775,7 +775,7 @@ unpack_half_to_float_4chan_planar (exr_decode_pipeline_t* decode)
in1 = in0 + w;
in2 = in1 + w;
in3 = in2 + w;
srcbuffer += w * 8; // 4 * sizeof(uint16_t), avoid type conversion
srcbuffer += (int64_t) w * 8; // 4 * sizeof(uint16_t), avoid type conversion

half_to_float_buffer ((float*) out0, in0, w);
half_to_float_buffer ((float*) out1, in1, w);
Expand Down Expand Up @@ -825,7 +825,7 @@ unpack_16bit_4chan (exr_decode_pipeline_t* decode)
in1 = in0 + w;
in2 = in1 + w;
in3 = in2 + w;
srcbuffer += w * 8; // 4 * sizeof(uint16_t), avoid type conversion
srcbuffer += (int64_t) w * 8; // 4 * sizeof(uint16_t), avoid type conversion
for (int x = 0; x < w; ++x)
*((uint16_t*) (out0 + x * inc0)) = one_to_native16 (in0[x]);
for (int x = 0; x < w; ++x)
Expand Down Expand Up @@ -898,7 +898,7 @@ unpack_16bit (exr_decode_pipeline_t* decode)
}
}
#endif
srcbuffer += w * 2;
srcbuffer += (int64_t) w * 2;
}
}
return EXR_ERR_SUCCESS;
Expand Down Expand Up @@ -963,7 +963,7 @@ unpack_32bit (exr_decode_pipeline_t* decode)
}
}
#endif
srcbuffer += w * 4;
srcbuffer += (int64_t) w * 4;
}
}
return EXR_ERR_SUCCESS;
Expand Down Expand Up @@ -1118,7 +1118,7 @@ generic_unpack (exr_decode_pipeline_t* decode)
(uint64_t) decc->user_line_stride);
else
{
srcbuffer += w * bpc;
srcbuffer += (int64_t) w * bpc;
continue;
}
}
Expand All @@ -1128,12 +1128,12 @@ generic_unpack (exr_decode_pipeline_t* decode)
}
else
{
srcbuffer += w * bpc;
srcbuffer += (int64_t) w * bpc;
continue;
}

UNPACK_SAMPLES (w)
srcbuffer += w * bpc;
srcbuffer += (int64_t) w * bpc;
}
}
return EXR_ERR_SUCCESS;
Expand Down
Loading
⚡