CVE-2021-45942: Out-of-bounds Write (CWE-787)
value: OpenEXR 3.1.x before 3.1.4 has a heap-based buffer overflow in Imf_3_1::LineCompositeTask::execute (called from IlmThread_3_1::NullThreadPoolProvider::addTask and IlmThread_3_1::ThreadPool::addGlobalTask). NOTE: db217f2 may be inapplicable.
CWE description: The product writes data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 5.5
Published: 2022-01-01T01:15Z
Repository: https://github.com/AcademySoftwareFoundation/openexr
Language: C++
Files changed: src/lib/OpenEXR/ImfDeepScanLineInputFile.cpp
Commit date: 2021-11-18 12:00:21 -0800
Commit message: DeepScanlineInputFile now uses chunk size test from DeepTiledInputFile (#1205)

Signed-off-by: Peter Hillman <peterh@wetafx.co.nz>
Diff: diff --git a/src/lib/OpenEXR/ImfDeepScanLineInputFile.cpp b/src/lib/OpenEXR/ImfDeepScanLineInputFile.cpp
index 0acbed04b..364a1f04b 100644
--- a/src/lib/OpenEXR/ImfDeepScanLineInputFile.cpp
+++ b/src/lib/OpenEXR/ImfDeepScanLineInputFile.cpp
@@ -1959,18 +1959,24 @@ readSampleCountForLineBlock(InputStreamMutex* streamData,
     // insists that we validate that the data size does not exceed the data
     // type max limit.
     // @TODO refactor the compressor code to ensure full 64-bit support.
     //
 
-    int compressorMaxDataSize = std::numeric_limits<int>::max();
-    if (sampleCountTableDataSize > uint64_t(compressorMaxDataSize))
+    uint64_t compressorMaxDataSize = static_cast<uint64_t>(std::numeric_limits<int>::max());
+    if (packedDataSize         > compressorMaxDataSize ||
+        unpackedDataSize > compressorMaxDataSize ||
+        sampleCountTableDataSize        > compressorMaxDataSize)
     {
-        THROW (IEX_NAMESPACE::ArgExc, "This version of the library does not "
-              << "support the allocation of data with size  > "
-              << compressorMaxDataSize
-              << " file table size    :" << sampleCountTableDataSize << ".\n");
+        THROW (IEX_NAMESPACE::ArgExc, "This version of the library does not"
+            << "support the allocation of data with size  > "
+            << compressorMaxDataSize
+            << " file table size    :" << sampleCountTableDataSize
+            << " file unpacked size :" << unpackedDataSize
+            << " file packed size   :" << packedDataSize << ".\n");
     }
+
+
     streamData->is->read(data->sampleCountTableBuffer, static_cast<int>(sampleCountTableDataSize));
     
     const char* readPtr;
 
     //

Vulnerable code:     int compressorMaxDataSize = std::numeric_limits<int>::max();
    if (sampleCountTableDataSize > uint64_t(compressorMaxDataSize))
        THROW (IEX_NAMESPACE::ArgExc, "This version of the library does not "
              << "support the allocation of data with size  > "
              << compressorMaxDataSize
              << " file table size    :" << sampleCountTableDataSize << ".\n");
Fixed code:     uint64_t compressorMaxDataSize = static_cast<uint64_t>(std::numeric_limits<int>::max());
    if (packedDataSize         > compressorMaxDataSize ||
        unpackedDataSize > compressorMaxDataSize ||
        sampleCountTableDataSize        > compressorMaxDataSize)
        THROW (IEX_NAMESPACE::ArgExc, "This version of the library does not"
            << "support the allocation of data with size  > "
            << compressorMaxDataSize
            << " file table size    :" << sampleCountTableDataSize
            << " file unpacked size :" << unpackedDataSize
            << " file packed size   :" << packedDataSize << ".\n");