CVE-2021-45942 (published 2022-01-01T01:15Z)

OpenEXR 3.1.x before 3.1.4 has a heap-based buffer overflow in Imf_3_1::LineCompositeTask::execute (called from IlmThread_3_1::NullThreadPoolProvider::addTask and IlmThread_3_1::ThreadPool::addGlobalTask). NOTE: db217f2 may be inapplicable.

Severity: MEDIUM
CVSS v2 base score: 4.3 (AV:N/AC:M/Au:N/C:N/I:N/A:P)
CVSS v3 base score: 5.5, MEDIUM (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: CWE-787
cwe_name: Out-of-bounds Write
description: The product writes data past the end, or before the beginning, of the intended buffer.
extended_description: 
            
            
             
			 
         
         

Fix information:
repo_url: https://github.com/AcademySoftwareFoundation/openexr
commit_details: repo_url: https://github.com/AcademySoftwareFoundation/openexr
author: peterhillman
author_date: 2021-11-19 09:00:21+13:00
msg: DeepScanlineInputFile now uses chunk size test from DeepTiledInputFile (#1205)

Signed-off-by: Peter Hillman <peterh@wetafx.co.nz>
repository: repo_url: https://github.com/AcademySoftwareFoundation/openexr
repo_name: AcademySoftwareFoundation/openexr
description: The OpenEXR project provides the specification and reference implementation of the EXR file format, the professional-grade image storage format of the motion picture industry.
repo_language: C
owner: AcademySoftwareFoundation
file_changes: filename: ImfDeepScanLineInputFile.cpp
change_type: ModificationType.MODIFY
diff: @@ -1961,14 +1961,20 @@ readSampleCountForLineBlock(InputStreamMutex* streamData,
     // @TODO refactor the compressor code to ensure full 64-bit support.
     //
 
-    int compressorMaxDataSize = std::numeric_limits<int>::max();
-    if (sampleCountTableDataSize > uint64_t(compressorMaxDataSize))
+    uint64_t compressorMaxDataSize = static_cast<uint64_t>(std::numeric_limits<int>::max());
+    if (packedDataSize         > compressorMaxDataSize ||
+        unpackedDataSize > compressorMaxDataSize ||
+        sampleCountTableDataSize        > compressorMaxDataSize)
     {
-        THROW (IEX_NAMESPACE::ArgExc, "This version of the library does not "
-              << "support the allocation of data with size  > "
-              << compressorMaxDataSize
-              << " file table size    :" << sampleCountTableDataSize << ".\n");
+        THROW (IEX_NAMESPACE::ArgExc, "This version of the library does not"
+            << "support the allocation of data with size  > "
+            << compressorMaxDataSize
+            << " file table size    :" << sampleCountTableDataSize
+            << " file unpacked size :" << unpackedDataSize
+            << " file packed size   :" << packedDataSize << ".\n");
     }
+
+
     streamData->is->read(data->sampleCountTableBuffer, static_cast<int>(sampleCountTableDataSize));
     
     const char* readPtr;

programming_language: C++
repo_url: https://github.com/AcademySoftwareFoundation/openexr
commit_details: repo_url: https://github.com/AcademySoftwareFoundation/openexr
author: peterhillman
author_date: 2021-12-03 10:06:35+13:00
msg: enforce xSampling/ySampling==1 in CompositeDeepScanLine (#1209)

Signed-off-by: Peter Hillman <peterh@wetafx.co.nz>
repository: repo_url: https://github.com/AcademySoftwareFoundation/openexr
repo_name: AcademySoftwareFoundation/openexr
description: The OpenEXR project provides the specification and reference implementation of the EXR file format, the professional-grade image storage format of the motion picture industry.
repo_language: C
owner: AcademySoftwareFoundation
file_changes: filename: ImfCompositeDeepScanLine.cpp
change_type: ModificationType.MODIFY
diff: @@ -238,6 +238,20 @@ CompositeDeepScanLine::setFrameBuffer(const FrameBuffer& fr)
     
     for(FrameBuffer::ConstIterator q=fr.begin();q!=fr.end();q++)
     {
+
+        //
+        // Frame buffer must have xSampling and ySampling set to 1
+        // (Sampling in FrameBuffers must match sampling in file,
+        //  and Header::sanityCheck enforces sampling in deep files is 1)
+        //
+
+        if(q.slice().xSampling!=1 || q.slice().ySampling!=1)
+        {
+             THROW (IEX_NAMESPACE::ArgExc, "X and/or y subsampling factors "
+				"of \"" << q.name() << "\" channel in framebuffer "
+				"are not 1");
+        }
+
         string name(q.name());
         if(name=="ZBack")
         {

programming_language: C++