GitHub Security Advisory: GHSA-588r-cr5c-w6hf
Package: OpenEXR (PIP)
Severity: HIGH (CVSS 7.8)
CWE: CWE-125: Out-of-bounds Read, CWE-190: Integer Overflow or Wraparound, CWE-787: Out-of-bounds Write
Vulnerable versions: >= 3.4.0, < 3.4.9
Patched in: 3.4.9

Summary: OpenEXR has a signed 32-bit Overflow in PIZ Decoder Leads to OOB Read/Write

Details:
## Summary

`internal_exr_undo_piz()` advances the working wavelet pointer with signed 32-bit arithmetic:

```c
wavbuf += nx * ny * wcount;
```

Because `nx`, `ny`, and `wcount` are `int`, a crafted EXR file can make this product overflow and wrap. The next channel then decodes from an incorrect address. The wavelet decode path operates in place, so this yields both out-of-bounds reads and out-of-bounds writes.

Tested on commit 7820b7e1b93405ba1d551c43a945018226b75bc5

## Technical Details

The vulnerable decode path is:

1. `internal_exr_undo_piz()` sets `wavbuf = decode->scratch_buffer_1`.
2. For each channel, it calls `wav_2D_decode (wavbuf + j, ...)`.
3. It then advances `wavbuf` with `wavbuf += nx * ny * wcount`.

The overflow happens in step 3. Once `wavbuf` is wrapped, the next channel's wavelet decode runs on the wrong address.

In the 14-bit wavelet path, `wdec14_4()` first reads:

- `*px`
- `*p10`
- `*p01`
- `*p11`

and then writes back to the same locations:

- `*px  = ...`
- `*p01 = ...`
- `*p10 = ...`
- `*p11 = ...`

As a result, the bug is not just a crash-only invalid read. It is an out-of-bounds read/write condition.

## Reproduction

[piz_scanline_redzone.zip](https://github.com/user-attachments/files/26318946/piz_scanline_redzone.zip)

Build `exrcheck` with ASAN and run:

```
❯ ./build-asan/bin/exrcheck /tmp/piz_scanline_redzone.exr
 file /tmp/piz_scanline_redzone.exr /home/pop/sec/openexr/src/lib/OpenEXRCore/internal_piz.c:373:19: runtime error: signed integer overflow: 134217724 * 32 cannot be represented in type 'int'
=================================================================
==1711239==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x7bedc3934700 at pc 0x7bf1f100f498 bp 0x7ffe032d8f00 sp 0x7ffe032d8ef0
READ of size 2 at 0x7bedc3934700 thread T0
    #0 0x7bf1f100f497 in wdec14_4 /home/pop/sec/openexr/src/lib/OpenEXRCore/internal_piz.c:148
    #1 0x7bf1f100f497 in wav_2D_decode /home/pop/sec/openexr/src/lib/OpenEXRCore/internal_piz.c:403
    #2 0x7bf1f100f497 in internal_exr_undo_piz /home/pop/sec/openexr/src/lib/OpenEXRCore/internal_piz.c:727
    #3 0x7bf1f115b038 in exr_uncompress_chunk /home/pop/sec/openexr/src/lib/OpenEXRCore/compression.c:546
    #4 0x7bf1f1161168 in exr_decoding_run /home/pop/sec/openexr/src/lib/OpenEXRCore/decoding.c:580
    #5 0x7bf1f2a71add in run_decode /home/pop/sec/openexr/src/lib/OpenEXR/ImfScanLineInputFile.cpp:586
    #6 0x7bf1f2a83dc4 in Imf_4_0::ScanLineInputFile::Data::readPixels(Imf_4_0::FrameBuffer const&, int, int) /home/pop/sec/openexr/src/lib/OpenEXR/ImfScanLineInputFile.cpp:500
    #7 0x7bf1f28c6a81 in Imf_4_0::InputFile::Data::readPixels(int, int) /home/pop/sec/openexr/src/lib/OpenEXR/ImfInputFile.cpp:458
    #8 0x7bf1f3bfe2dc in readScanline<Imf_4_0::InputPart> /home/pop/sec/openexr/src/lib/OpenEXRUtil/ImfCheckFile.cpp:239
    #9 0x7bf1f3c05b04 in readMultiPart /home/pop/sec/openexr/src/lib/OpenEXRUtil/ImfCheckFile.cpp:905
    #10 0x7bf1f3c126fd in runChecks<char con