Skip to content

Commit cf2ce6b

Browse files
cary-ilmcary-ilm
authored
Merge branch 'main' into dependabot/github_actions/github/codeql-action-4.35.4
2 parents 6edc491 + 13fd621 commit cf2ce6b

30 files changed

Lines changed: 2061 additions & 371 deletions

‎.readthedocs.yml‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -11,7 +11,8 @@ version: 2
1111
build:
1212
os: "ubuntu-22.04"
1313
tools:
14-
python: "3.9"
14+
# urllib3>=2.7 (website/requirements.txt) requires Python >=3.10
15+
python: "3.11"
1516

1617
sphinx:
1718
configuration: website/conf.py

‎CHANGES.md‎

Lines changed: 139 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,7 @@
33

44
# OpenEXR Release Notes
55

6+
* [Version 3.4.11](#version-3411-april-29-2026) April 29, 2026
67
* [Version 3.4.10](#version-3410-april-17-2026) April 17, 2026
78
* [Version 3.4.9](#version-349-april--3-2026) April 3, 2026
89
* [Version 3.4.8](#version-348-march-26-2026) March 26, 2026
@@ -14,6 +15,7 @@
1415
* [Version 3.4.2](#version-342-october-15-2025) October 15, 2025
1516
* [Version 3.4.1](#version-341-october-8-2025) October 8, 2025
1617
* [Version 3.4.0](#version-340-september-5-2025) September 5, 2025
18+
* [Version 3.3.11](#version-3311-april-29-2026) April 29, 2026
1719
* [Version 3.3.10](#version-339-april-17-2026) April 17, 2026
1820
* [Version 3.3.9](#version-339-april--4-2026) April 4, 2026
1921
* [Version 3.3.8](#version-338-march-1-2026) March 1, 2026
@@ -25,6 +27,7 @@
2527
* [Version 3.3.2](#version-332-november-11-2024) November 11, 2024
2628
* [Version 3.3.1](#version-331-october-8-2024) October 8, 2024
2729
* [Version 3.3.0](#version-330-september-30-2024) September 30, 2024
30+
* [Version 3.2.9](#version-329-april-29-2026) April 29, 2026
2831
* [Version 3.2.8](#version-328-april-17-2026) April 17, 2026
2932
* [Version 3.2.7](#version-327-april-3-2026) April 3, 2026
3033
* [Version 3.2.6](#version-326-march-1-2026) March 1, 2026
@@ -100,6 +103,68 @@
100103
* [Version 1.0.1](#version-101)
101104
* [Version 1.0](#version-10)
102105

106+
## Version 3.4.11 (April 29, 2026)
107+
108+
Patch release that addresses the following security vulnerabilities:
109+
110+
* [CVE-2026-42217](https://www.cve.org/CVERecord?id=CVE-2026-42217)
111+
Shift exponent overflow in `readVariableLengthInteger()` (`ImfIDManifest.cpp`)
112+
* [CVE-2026-42216](https://www.cve.org/CVERecord?id=CVE-2026-42216)
113+
Out-of-bounds read in `IDManifest::init()` during prefix expansion
114+
* [CVE-2026-41142](https://www.cve.org/CVERecord?id=CVE-2026-41142)
115+
Integer overflow in `ImageChannel::resize` leads to heap OOB write via OpenEXRUtil public API
116+
117+
Also:
118+
119+
* OSS-fuzz [504280155](https://issues.oss-fuzz.com/issues/504280155)
120+
Heap-buffer-overflow in `DwaCompressor_uncompress`
121+
* OSS-fuzz [505062709](https://issues.oss-fuzz.com/issues/505062709)
122+
Null-dereference READ in `Imf_3_3::prefixFromLayerName`
123+
124+
Build fixes:
125+
126+
- Fix Windows ARM64EC build issues and correct SIMD ARM NEON path for ARM64/EC
127+
128+
Also, some minor documentation updates:
129+
130+
- GitHub Security Advisories are the preferred way of reporting
131+
vulnerabilities, not email.
132+
- Some clarification around handling of UFT-8 of file paths
133+
134+
### Merged Pull Requests
135+
136+
* [2383](https://github.com/AcademySoftwareFoundation/openexr/pull/2383)
137+
validate that the uncompressed sizes recorded in the dwa header are valid
138+
* [2382](https://github.com/AcademySoftwareFoundation/openexr/pull/2382)
139+
Fix Null-dereference READ in prefixFromLayerName
140+
* [2378](https://github.com/AcademySoftwareFoundation/openexr/pull/2378)
141+
Harden IDManifest parsing against illegal shift and string prefix OOB
142+
* [2377](https://github.com/AcademySoftwareFoundation/openexr/pull/2377)
143+
Fix OOB read when expanding IDManifest prefix-compressed strings
144+
* [2375](https://github.com/AcademySoftwareFoundation/openexr/pull/2375)
145+
Minor changes to website index page to make some sentences clearer. A…
146+
* [2368](https://github.com/AcademySoftwareFoundation/openexr/pull/2368)
147+
Add release notes and news for v3.4.10, v3.3.10, v3.2.8
148+
* [2367](https://github.com/AcademySoftwareFoundation/openexr/pull/2367)
149+
Fix int overflow in ImageChannel::resize pixel count
150+
* [2364](https://github.com/AcademySoftwareFoundation/openexr/pull/2364)
151+
Recommend GH Security Advisories for vulnerability reporting
152+
* [2361](https://github.com/AcademySoftwareFoundation/openexr/pull/2361)
153+
Add documentation and test for UTF-8 file paths
154+
* [2344](https://github.com/AcademySoftwareFoundation/openexr/pull/2344)
155+
Fix Windows ARM64EC build issues and correct SIMD ARM NEON path for ARM64/EC
156+
157+
### Merged Workflow Pull Requests
158+
159+
* [2370](https://github.com/AcademySoftwareFoundation/openexr/pull/2370)
160+
Bump msys2/setup-msys2 from 2.31.0 to 2.31.1
161+
* [2366](https://github.com/AcademySoftwareFoundation/openexr/pull/2366)
162+
Add workflow dispatch trigger to release-sign.yml
163+
* [2363](https://github.com/AcademySoftwareFoundation/openexr/pull/2363)
164+
Bump vmactions/freebsd-vm from 1.4.4 to 1.4.5
165+
* [2362](https://github.com/AcademySoftwareFoundation/openexr/pull/2362)
166+
Bump github/codeql-action from 4.35.1 to 4.35.2
167+
103168
## Version 3.4.10 (April 17, 2026)
104169

105170
Patch release that addresses the following security vulnerabilities:
@@ -255,40 +320,44 @@ Patch release bug/build fixes:
255320
* Fix build failure with glibc 2.43
256321
* Fix Windows symbol visibility warnings
257322

323+
Full changelog: [v3.4.6..v3.4.7](https://github.com/AcademySoftwareFoundation/openexr/compare/v3.4.6..v3.4.7)
324+
258325
This version addresses the following security vulnerabilities:
259326

260327
* [CVE-2026-34545](https://www.cve.org/CVERecord?id=CVE-2026-34545)
261328
integer overflow lead to OOB in HTJ2K decoder
262329

263-
### Merged Pull Requests:
264-
265-
* [2292](https://github.com/AcademySoftwareFoundation/openexr/pull/2292)
266-
Bump actions/download-artifact from 8.0.0 to 8.0.1
330+
### Merged Pull Requests
267331

268332
* [2291](https://github.com/AcademySoftwareFoundation/openexr/pull/2291)
269333
Fix integer overflow in htj2k decode with width > 32767
270334

271-
* [2289](https://github.com/AcademySoftwareFoundation/openexr/pull/2289)
272-
Bump scikit-build-core from 0.12.1 to 0.12.2
273-
274-
* [2288](https://github.com/AcademySoftwareFoundation/openexr/pull/2288)
275-
Bump jmertic/slack-release-notifier from 6fa159048d5313ff1177d248ad84beb627571670 to 35fad060af5559c24decdec0f701e6ba93566704
276-
277-
* [2287](https://github.com/AcademySoftwareFoundation/openexr/pull/2287)
278-
Bump pypa/cibuildwheel from 3.3 to 3.4
279-
280335
* [2283](https://github.com/AcademySoftwareFoundation/openexr/pull/2283)
281336
update SECURITY with CVE info for PR #2256
282337

283338
* [2282](https://github.com/AcademySoftwareFoundation/openexr/pull/2282)
284-
Remove website_preview_link workflow
339+
Remove `website_preview_link` workflow
285340

286341
* [2281](https://github.com/AcademySoftwareFoundation/openexr/pull/2281)
287342
Disable visibility attributes on Windows to fix msys2 -Wattributes warning
288343

289344
* [2262](https://github.com/AcademySoftwareFoundation/openexr/pull/2262)
290345
Fix build failure with glibc 2.43 due to C11 threads.h conflicts
291346

347+
### Merged Workflow Pull Requests
348+
349+
* [2292](https://github.com/AcademySoftwareFoundation/openexr/pull/2292)
350+
Bump actions/download-artifact from 8.0.0 to 8.0.1
351+
352+
* [2289](https://github.com/AcademySoftwareFoundation/openexr/pull/2289)
353+
Bump scikit-build-core from 0.12.1 to 0.12.2
354+
355+
* [2288](https://github.com/AcademySoftwareFoundation/openexr/pull/2288)
356+
Bump jmertic/slack-release-notifier from 6fa159048d5313ff1177d248ad84beb627571670 to 35fad060af5559c24decdec0f701e6ba93566704
357+
358+
* [2287](https://github.com/AcademySoftwareFoundation/openexr/pull/2287)
359+
Bump pypa/cibuildwheel from 3.3 to 3.4
360+
292361
## Version 3.4.6 (March 1, 2026)
293362

294363
Patch release with several bug fixes, enhancements, and build improvements.
@@ -867,6 +936,34 @@ Fetch master branch of libdeflate on main
867936
* [1852](https://github.com/AcademySoftwareFoundation/openexr/pull/1852)
868937
Add an option to use TBB as the global provider
869938

939+
## Version 3.3.11 (April 29, 2026)
940+
941+
Patch release for 3.3 that addresses the following security
942+
vulnerabilities:
943+
944+
* [CVE-2026-42217](https://www.cve.org/CVERecord?id=CVE-2026-42217)
945+
Shift exponent overflow in `readVariableLengthInteger()` (`ImfIDManifest.cpp`)
946+
* [CVE-2026-42216](https://www.cve.org/CVERecord?id=CVE-2026-42216)
947+
Out-of-bounds read in `IDManifest::init()` during prefix expansion
948+
* [CVE-2026-41142](https://www.cve.org/CVERecord?id=CVE-2026-41142)
949+
Integer overflow in `ImageChannel::resize` leads to heap OOB write via OpenEXRUtil public API
950+
951+
Also:
952+
953+
* OSS-fuzz [504280155](https://issues.oss-fuzz.com/issues/504280155)
954+
Heap-buffer-overflow in `DwaCompressor_uncompress`
955+
956+
### Merged Pull Requests
957+
958+
* [2383](https://github.com/AcademySoftwareFoundation/openexr/pull/2383)
959+
validate that the uncompressed sizes recorded in the dwa header are valid
960+
* [2378](https://github.com/AcademySoftwareFoundation/openexr/pull/2378)
961+
Harden IDManifest parsing against illegal shift and string prefix OOB
962+
* [2377](https://github.com/AcademySoftwareFoundation/openexr/pull/2377)
963+
Fix OOB read when expanding IDManifest prefix-compressed strings
964+
* [2367](https://github.com/AcademySoftwareFoundation/openexr/pull/2367)
965+
Fix int overflow in ImageChannel::resize pixel count
966+
870967
## Version 3.3.10 (April 17, 2026)
871968

872969
Patch release that addresses the following security vulnerabilities:
@@ -1564,6 +1661,34 @@ Fix macOS arm64 build
15641661
Propagate dwa core 3 1
15651662
* [1418](https://github.com/AcademySoftwareFoundation/openexr/pull/1418)
15661663

1664+
## Version 3.2.9 (April 29, 2026)
1665+
1666+
Patch release for 3.2 that addresses the following security
1667+
vulnerabilities:
1668+
1669+
* [CVE-2026-42217](https://www.cve.org/CVERecord?id=CVE-2026-42217)
1670+
Shift exponent overflow in `readVariableLengthInteger()` (`ImfIDManifest.cpp`)
1671+
* [CVE-2026-42216](https://www.cve.org/CVERecord?id=CVE-2026-42216)
1672+
Out-of-bounds read in `IDManifest::init()` during prefix expansion
1673+
* [CVE-2026-41142](https://www.cve.org/CVERecord?id=CVE-2026-41142)
1674+
Integer overflow in `ImageChannel::resize` leads to heap OOB write via OpenEXRUtil public API
1675+
1676+
Also:
1677+
1678+
* OSS-fuzz [504280155](https://issues.oss-fuzz.com/issues/504280155)
1679+
Heap-buffer-overflow in `DwaCompressor_uncompress`
1680+
1681+
### Merged Pull Requests
1682+
1683+
* [2383](https://github.com/AcademySoftwareFoundation/openexr/pull/2383)
1684+
validate that the uncompressed sizes recorded in the dwa header are valid
1685+
* [2378](https://github.com/AcademySoftwareFoundation/openexr/pull/2378)
1686+
Harden IDManifest parsing against illegal shift and string prefix OOB
1687+
* [2377](https://github.com/AcademySoftwareFoundation/openexr/pull/2377)
1688+
Fix OOB read when expanding IDManifest prefix-compressed strings
1689+
* [2367](https://github.com/AcademySoftwareFoundation/openexr/pull/2367)
1690+
Fix int overflow in ImageChannel::resize pixel count
1691+
15671692
## Version 3.2.8 (April 17, 2026)
15681693

15691694
Patch release that addresses the following security vulnerabilities:

‎MODULE.bazel‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -9,6 +9,6 @@ module(
99
bazel_dep(name = "bazel_skylib", version = "1.9.0")
1010
bazel_dep(name = "imath", version = "3.2.2.bcr.1")
1111
bazel_dep(name = "libdeflate", version = "1.25")
12-
bazel_dep(name = "openjph", version = "0.26.3.bcr.1")
12+
bazel_dep(name = "openjph", version = "0.27.0")
1313
bazel_dep(name = "platforms", version = "1.1.0")
1414
bazel_dep(name = "rules_cc", version = "0.2.18")

‎SECURITY.md‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -20,6 +20,10 @@ rapidly and post patches within 14 days if possible.
2020

2121
| CVE | Affected Versions | Patched Versions |
2222
| --- | ----------------- | ---------------- |
23+
24+
| [CVE-2026-42217](https://www.cve.org/CVERecord?id=CVE-2026-42217) | 3.2.0–3.2.8, 3.3.0–3.3.10, 3.4.0–3.4.10 | 3.2.9, 3.3.11, 3.4.11 |
25+
| [CVE-2026-42216](https://www.cve.org/CVERecord?id=CVE-2026-42216) | 3.2.0–3.2.8, 3.3.0–3.3.10, 3.4.0–3.4.10 | 3.2.9, 3.3.11, 3.4.11 |
26+
| [CVE-2026-41142](https://www.cve.org/CVERecord?id=CVE-2026-41142) | 3.2.0–3.2.8, 3.3.0–3.3.10, 3.4.0–3.4.10 | 3.2.9, 3.3.11, 3.4.11 |
2327
| [CVE-2026-40250](https://www.cve.org/CVERecord?id=CVE-2026-40250) | 3.2.0–3.2.7, 3.3.0–3.3.9, 3.4.0–3.4.9 | 3.2.8, 3.3.10, 3.4.10 |
2428
| [CVE-2026-40244](https://www.cve.org/CVERecord?id=CVE-2026-40244) | 3.2.0–3.2.7, 3.3.0–3.3.9, 3.4.0–3.4.9 | 3.2.8, 3.3.10, 3.4.10 |
2529
| [CVE-2026-39886](https://www.cve.org/CVERecord?id=CVE-2026-39886) | 3.4.0–3.4.9 | 3.4.10 |

‎src/lib/OpenEXR/ImfCompression.cpp‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -180,13 +180,13 @@ static const CompressionDesc IdToDesc[] = {
180180
"htj2k256",
181181
"High-Throughput JPEG 2000 (256 lines)",
182182
256,
183-
true,
183+
false,
184184
false),
185185
CompressionDesc (
186186
"htj2k32",
187187
"High-Throughput JPEG 2000 (32 lines)",
188188
32,
189-
true,
189+
false,
190190
false),
191191
};
192192
// clang-format on

‎src/lib/OpenEXR/ImfDeepScanLineInputFile.cpp‎

Lines changed: 26 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -617,6 +617,21 @@ DeepScanLineInputFile::Data::readMemData (
617617
std::vector<DeepSlice> fills;
618618
ScanLineProcess proc;
619619

620+
if (countsOnly)
621+
{
622+
const Slice& scslice = fb.getSampleCountSlice ();
623+
if (!scslice.base)
624+
{
625+
throw IEX_NAMESPACE::ArgExc (
626+
"Invalid base pointer, please set a proper sample count slice.");
627+
}
628+
if (scslice.type != OPENEXR_IMF_INTERNAL_NAMESPACE::UINT)
629+
{
630+
throw IEX_NAMESPACE::ArgExc (
631+
"The type of sample count slice should be UINT.");
632+
}
633+
}
634+
620635
if (!countsOnly)
621636
prepFillList(fb, fills);
622637

@@ -986,6 +1001,17 @@ void ScanLineProcess::copy_sample_count (
9861001
{
9871002
const Slice& scslice = outfb->getSampleCountSlice ();
9881003

1004+
if (!scslice.base)
1005+
{
1006+
throw IEX_NAMESPACE::ArgExc (
1007+
"Invalid base pointer, please set a proper sample count slice.");
1008+
}
1009+
if (scslice.type != OPENEXR_IMF_INTERNAL_NAMESPACE::UINT)
1010+
{
1011+
throw IEX_NAMESPACE::ArgExc (
1012+
"The type of sample count slice should be UINT.");
1013+
}
1014+
9891015
int end = cinfo.height - decoder.user_line_end_ignore;
9901016
int64_t xS = int64_t (scslice.xStride);
9911017
int64_t yS = int64_t (scslice.yStride);

‎src/lib/OpenEXR/ImfDeepTiledInputFile.cpp‎

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -279,6 +279,18 @@ DeepTiledInputFile::setFrameBuffer (const DeepFrameBuffer& frameBuffer)
279279
"subsampling factors.");
280280
}
281281

282+
const Slice& sampleCountSlice = frameBuffer.getSampleCountSlice ();
283+
if (!sampleCountSlice.base)
284+
{
285+
throw IEX_NAMESPACE::ArgExc (
286+
"Invalid base pointer, please set a proper sample count slice.");
287+
}
288+
if (sampleCountSlice.type != UINT)
289+
{
290+
throw IEX_NAMESPACE::ArgExc (
291+
"The type of sample count slice should be UINT.");
292+
}
293+
282294
_data->frameBuffer = frameBuffer;
283295
_data->frameBufferValid = true;
284296
}
@@ -1199,6 +1211,14 @@ void TileProcess::copy_sample_count (
11991211
if (s.xSampling != 1 || s.ySampling != 1)
12001212
throw IEX_NAMESPACE::ArgExc ("Tiled data should not have subsampling.");
12011213

1214+
if (s.base == nullptr)
1215+
throw IEX_NAMESPACE::ArgExc (
1216+
"Deep frame buffer is missing sample counts; call insertSampleCountSlice before reading.");
1217+
1218+
if (s.type != UINT)
1219+
throw IEX_NAMESPACE::ArgExc (
1220+
"The type of sample count slice should be UINT.");
1221+
12021222
int xOffset = s.xTileCoords ? 0 : t_absX;
12031223
int yOffset = s.yTileCoords ? 0 : t_absY;
12041224

‎src/lib/OpenEXR/ImfMisc.h‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -438,6 +438,7 @@ int getChunkOffsetTableSize (const Header& header);
438438
// Convert a UTF-8 filename to a wide string (for example for Windows APIs).
439439
//
440440

441+
OPENEXR_DEPRECATED ("To be removed in future releases.")
441442
IMF_EXPORT
442443
std::wstring WidenFilename (const char* filename);
443444

‎src/lib/OpenEXRCore/internal_ht.cpp‎

Lines changed: 14 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -204,12 +204,25 @@ ht_undo_impl (
204204

205205
ojph::ui32 image_height =
206206
siz.get_image_extent ().y - siz.get_image_offset ().y;
207+
ojph::ui32 image_width =
208+
siz.get_image_extent ().x - siz.get_image_offset ().x;
207209

208-
if (decode->chunk.width != siz.get_image_extent ().x - siz.get_image_offset ().x
210+
if (decode->chunk.width != image_width
209211
|| decode->chunk.height != image_height
210212
|| decode->channel_count != siz.get_num_components())
211213
return EXR_ERR_CORRUPT_CHUNK;
212214

215+
for (int cs_i = 0; cs_i < decode->channel_count; cs_i++)
216+
{
217+
int file_i = cs_to_file_ch[cs_i].file_index;
218+
219+
if (decode->channels[file_i].height != siz.get_recon_height (cs_i) ||
220+
decode->channels[file_i].width != siz.get_recon_width (cs_i) ||
221+
decode->channels[file_i].height != image_height / siz.get_downsampling (cs_i).y ||
222+
decode->channels[file_i].width != image_width / siz.get_downsampling (cs_i).x)
223+
return EXR_ERR_CORRUPT_CHUNK;
224+
}
225+
213226
int64_t bpl = 0;
214227
bool is_planar = false;
215228
for (int16_t c = 0; c < decode->channel_count; c++)
@@ -235,9 +248,6 @@ ht_undo_impl (
235248
for (int16_t c = 0; c < decode->channel_count; c++)
236249
{
237250
int file_c = cs_to_file_ch[c].file_index;
238-
assert (
239-
siz.get_recon_height (c) == decode->channels[file_c].height);
240-
assert (decode->channels[file_c].width == siz.get_recon_width (c));
241251

242252
if (decode->channels[file_c].height == 0) continue;
243253

0 commit comments

Comments
 (0)