From cb5e4b2632f24b1c6692b239bf6f9dbbbf686c65 Mon Sep 17 00:00:00 2001 From: Cary Phillips Date: Thu, 9 Jul 2026 13:26:59 -0700 Subject: [PATCH] Fix missing INT_MAX cap on deep scanline sample_count_table_size ddata[1] (packed_size) and ddata[2] (unpacked_size) both had '< 0 || > INT_MAX' guards, but ddata[0] (sample_count_table_size) only had '< 0'. A value > INT_MAX stored in the uint64_t field then gets truncated to size_t on ILP32, causing an undersized allocation followed by a heap overflow when exr_read_deep_chunk writes the full 64-bit byte count into it. Addresses https://github.com/AcademySoftwareFoundation/openexr/security/advisories/GHSA-m5cq-cx25-qw53 Co-Authored-By: Claude Sonnet 4.6 Signed-off-by: Cary Phillips --- src/lib/OpenEXRCore/chunk.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/lib/OpenEXRCore/chunk.c b/src/lib/OpenEXRCore/chunk.c index b4f79a498..c6a26868f 100644 --- a/src/lib/OpenEXRCore/chunk.c +++ b/src/lib/OpenEXRCore/chunk.c @@ -1006,7 +1006,7 @@ exr_read_scanline_chunk_info ( if (rv != EXR_ERR_SUCCESS) { return rv; } priv_to_native64 (ddata, 3); - if (ddata[0] < 0) + if (ddata[0] < 0 || ddata[0] > (int64_t) INT_MAX) { return ctxt->print_error ( ctxt,