PyOpenEXR CVE-2025-68514 堆缓冲区溢出漏洞

PyOpenEXR deep prefixed literal RGB key collision heap buffer overflow 漏洞概述 漏洞ID: CVE-2025-68514 CVSS v3 base metrics: 5.5 / 10 描述: 一个精心设计的深度扫描EXR文件可以导致PyOpenEXR包装器重用为文字通道名称（如“left.R”）分配的标量深度扫描样本数组。深度阅读器随后注册带有 的通道，这与为标量通道（如“left.R”）分配的标量形状（sampleCount, 3）不匹配。使用默认公共Python API（ ）打开文件会触发正常深度样本解码期间的堆缓冲区溢出。 影响: 这是一个堆缓冲区溢出/内存损坏问题，在OpenEXR Python绑定中。应用程序、服务和资产管道可以接受未使用的深度EXR文件，并使用默认 行为打开它们。这可以通过精心设计的文件导致崩溃。该问题发生在 数组选择由包装器解码深度样本目标布局时，使用攻击者控制的通道名称和样本计数。它显示了在 和当前主构建中，与合并的RGB/RGBA组键碰撞的未初始化堆缓冲区写入和未 sanitization 深度计算。 影响范围 受影响版本: 3.3.0-3.3.12, 3.4.0-3.4.13 修补版本: 3.3.13, 3.4.14 修复方案 修复版本: 3.3.13, 3.4.14 POC代码 复现步骤 验证输出 ```bash reproduce.sh stdout target build case rc classification v3.4.13 original control 0 clean v3.4.13 original poc 134 original heap corruption abort v3.4.13 asan control 0 clean v3.4.13 asan poc 134 ASAN heap-buffer-overflow WRITE v3.4.13 ubsan control 0 clean v3.4.13 ubsan poc 134 original heap corruption abort v3.4.13 msan control 1 MSAN import failure (__msan_retval_tls) v3.4.13 msan poc 1 MSAN import failure (__msan_retval_tls) main original control 0 clean main original poc 134 original heap corruption abort main asan control 0 clean main asan poc 134 ASAN heap-buffer-overflow WRITE main ubsan control 0 clean main ubsan poc 134 original heap corruption abort PASS: deep prefixed literal/RGB key-collision heap OOB reproduced on v3.4.13 and main original+ASAN: controls clean. reproduce.sh stderr reproduce.sh: line 12: 284046 Aborted env "$(envarg[8])" timeout --preserve-status 20s python3 "$PY" reproduce.sh: line 12: 284069 Aborted env "$(envarg[8])" timeout --preserve-status 20s python3 "$PY" reproduce.sh: line 12: 284082 Aborted env "$(envarg[8])" timeout --preserve-status 20s python3 "$PY" reproduce.sh: line 12: 284112 Aborted env "$(envarg[8])" timeout --preserve-status 20s python3 "$PY" reproduce.sh: line 12: 284128 Aborted env "$(envarg[8])" timeout --preserve-status 20s python3 "$PY" reproduce.sh: line 12: 284139 Aborted env "$(envarg[8])" timeout --preserve-status 20s python3 "$PY" v3.4.13 original PoC stdout keys ['left'] left.R: left.R, left.R, all HALF. v3.4.13 original PoC stderr malloc(): invalid size (unsorted) timeout: the monitored command dumped core v3.4.13 ASAN control stdout keys ['left'] left.R: left.R, left.R, all HALF. v3.4.13 ASAN control stderr keys ['left'] left.R: left.R, left.R, all HALF. v3.4.13 ASAN PoC stdout keys ['left'] left.R: left.R, left.R, all HALF. v3.4.13 ASAN PoC stderr ==294061==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x60300005af84 at pc 0x777e09d86b00 bp 0x7fff... WRITE of size 2 at 0x60300005af84 thread T0 #0 0x777e09d86b00 in __asan_memcpy /home/brbzu/openexr/v3.4.13/sources/openexr-3.4.13/src/lib/OpenEXRCore/... #1 0x777e09d8ccaf in __ZN2PyImf16decodeScanLineImplEP16Imf_3_4::DecodeScanLineInputFile:Data:readDataAt(Imf_3_4::DecodeScanLineInputFile, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, i

目标达成感谢每一位支持者 — 我们达成了 100% 目标！

PyOpenEXR CVE-2025-68514 堆缓冲区溢出漏洞

同源更多文章

目标达成 感谢每一位支持者 — 我们达成了 100% 目标！

PyOpenEXR CVE-2025-68514 堆缓冲区溢出漏洞

同源更多文章

目标达成感谢每一位支持者 — 我们达成了 100% 目标！