From f22723e5d322652bf4ec4dfa2b0068d89ebbca95 Mon Sep 17 00:00:00 2001 From: Cary Phillips Date: Wed, 13 May 2026 18:21:37 -0700 Subject: [PATCH] Fix leak in internal_exr_revert_add_part; test duplicate exr_add_part Free heap-allocated part storage after destroy when reverting a failed exr_add_part (skip embedded first_part). OpenEXRCoreTest: expect EXR_ERR_INVALID_ARGUMENT when adding a second part with the same name as an existing part. Addresses https://issues.oss-fuzz.com/issues/512314697 Co-authored-by: Cursor Signed-off-by: Cary Phillips --- src/lib/OpenEXRCore/internal_structs.c | 2 ++ src/test/OpenEXRCoreTest/write.cpp | 3 +++ 2 files changed, 5 insertions(+) diff --git a/src/lib/OpenEXRCore/internal_structs.c b/src/lib/OpenEXRCore/internal_structs.c index c342c1782a..029a9dfde6 100644 --- a/src/lib/OpenEXRCore/internal_structs.c +++ b/src/lib/OpenEXRCore/internal_structs.c @@ -264,6 +264,8 @@ internal_exr_revert_add_part ( *new_index = -1; internal_exr_destroy_part (ctxt, part); + if (part != &(ctxt->first_part)) ctxt->free_fn (part); + if (ncount == 0) { ctxt->num_parts = 0; diff --git a/src/test/OpenEXRCoreTest/write.cpp b/src/test/OpenEXRCoreTest/write.cpp index 0e438c70be..440efbc5be 100644 --- a/src/test/OpenEXRCoreTest/write.cpp +++ b/src/test/OpenEXRCoreTest/write.cpp @@ -88,6 +88,9 @@ testStartWriteScan (const std::string& tempdir) EXRCORE_TEST_RVAL ( exr_add_part (outf, "beauty", EXR_STORAGE_SCANLINE, &partidx)); EXRCORE_TEST (partidx == 0); + EXRCORE_TEST_RVAL_FAIL ( + EXR_ERR_INVALID_ARGUMENT, + exr_add_part (outf, "beauty", EXR_STORAGE_SCANLINE, &partidx)); EXRCORE_TEST_RVAL (exr_get_count (outf, &partidx)); EXRCORE_TEST (partidx == 1); partidx = 0;