OpenEXR CompositeDeepScanLine integer-overflow leads to heap OOB write

OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry. In CompositeDeepScanLine::readPixels, per-pixel totals are accumulated in vector<unsigned int> total_sizes for attacker-controlled large counts across many parts, total_sizes[ptr] wraps modulo 2^32. overall_sample_count is then derived from wrapped totals and used in samples[channel].resize(overall_sample_count). Decode pointer setup/consumption proceeds with true sample counts, and write operations in core unpack (generic_unpack_deep_pointers) overrun the undersized composite sample buffer. This vulnerability is fixed in v3.2.6, v3.3.8, and v3.4.6.

N/A

跨界内存写

OpenEXR 缓冲区错误漏洞

OpenEXR是Academy Software Foundation开源的一种高动态范围图像（HDR）文件格式的开放标准。 OpenEXR 3.2.6之前版本、3.3.8之前版本和3.4.6之前版本存在缓冲区错误漏洞，该漏洞源于向量total_sizes中每像素总计值在攻击者控制的大计数下发生环绕，导致样本缓冲区大小计算错误，可能造成缓冲区溢出。

N/A

N/A