GitHub Security Advisory: GHSA-p8xc-w3q4-h64x
Package: OpenEXR (PIP)
Severity: HIGH (CVSS 5.0)
CWE: CWE-190: Integer Overflow or Wraparound, CWE-787: Out-of-bounds Write
Vulnerable versions: >= 3.3.0, < 3.3.9
Patched in: 3.3.9

Summary: OpenEXR: DWA Lossy Decoder Heap Out-of-Bounds Write

Details:
## Summary

The DWA lossy decoder constructs temporary per-component block pointers using signed 32-bit arithmetic. For a large enough width, the calculation overflows and later decoder stores operate on a wrapped pointer outside the allocated `rowBlock` backing store.

This bug is reachable from the public decoder path and can be reproduced through the shipped `exrcheck` tool with a crafted scanline DWAA file. The confirmed dynamic symptom is a write-side crash in the lossy DCT execution path.

Tested on commit: 7820b7e1b93405ba1d551c43a945018226b75bc5

## Root Cause and Data Flow

The vulnerable pointer construction lives in `src/lib/OpenEXRCore/internal_dwa_decoder.h`:

```c
for (int comp = 1; comp < numComp; ++comp)
    rowBlock[comp] = rowBlock[comp - 1] + numBlocksX * 64;
```

The expression `numBlocksX * 64` is computed as signed `int`. Once `numBlocksX` is large enough, the multiplication wraps, and `rowBlock[comp]` points backward rather than forward into the temporary decode buffer.

Later, `LossyDctDecoder_execute()` uses those derived pointers for real loads and stores during the block shuffle and reconstruction process. At that point the decoder is no longer operating within the bounds of the allocation created for `rowBlockHandle`.

The public control flow is the standard one:

```c
InputFile / ScanLineInputFile public read
  -> exr_decoding_run(...)
     -> exr_uncompress_chunk(...)
        -> internal_exr_undo_dwaa(...)
           -> DwaCompressor_uncompress(...)
              -> LossyDctDecoder_execute(...)
```

UBSan gives a clean root-cause diagnosis on the overflowing multiply, while ASAN shows the later memory error in the write-side decode path.

## Reproduction

[dwa_scanline_exrcheck.zip](https://github.com/user-attachments/files/26318786/dwa_scanline_exrcheck.zip)

Build with `exrcheck` with ASAN and run:

```
❯ ./build-asan/bin/exrcheck /tmp/dwa_scanline_exrcheck.exr
 file /tmp/dwa_scanline_exrcheck.exr /home/pop/sec/openexr/src/lib/OpenEXRCore/internal_dwa_decoder.h:331:58: runtime error: signed integer overflow: 33554432 * 64 cannot be represented in type 'int'
AddressSanitizer:DEADLYSIGNAL
=================================================================
==1684058==ERROR: AddressSanitizer: SEGV on unknown address 0x758f8e5f0800 (pc 0x75979e850336 bp 0x7ffe8f1d3420 sp 0x7ffe8f1d30f0 T0)
==1684058==The signal is caused by a WRITE memory access.
    #0 0x75979e850336 in LossyDctDecoder_execute /home/pop/sec/openexr/src/lib/OpenEXRCore/internal_dwa_decoder.h:524
    #1 0x75979e879592 in DwaCompressor_uncompress /home/pop/sec/openexr/src/lib/OpenEXRCore/internal_dwa_compressor.h:1210
    #2 0x75979e879592 in internal_exr_undo_dwaa /home/pop/sec/openexr/src/lib/OpenEXRCore/internal_dwa.c:231
    #3 0x75979e95f878 in exr_uncompress_chunk /home/pop/sec/openexr/src/lib/OpenEXRCore/compression.c:542
    #4 0x75979e9659a8 in exr_decoding_run /home/pop/sec/openexr/src/lib/OpenEXRCore/decoding.c:580
    #5 0x7597a0271add in run_de