File openexr-CVE-2020-15306.patch of Package openexr.17683
diff --git a/IlmImf/ImfDeepTiledOutputFile.cpp b/IlmImf/ImfDeepTiledOutputFile.cpp
index 9654e311..887c0329 100644
--- a/IlmImf/ImfDeepTiledOutputFile.cpp
+++ b/IlmImf/ImfDeepTiledOutputFile.cpp
@@ -1237,7 +1237,7 @@ DeepTiledOutputFile::initialize (const Header &header)
_data->numYTiles);
//ignore the existing value of chunkCount - correct it if it's wrong
- _data->header.setChunkCount(getChunkOffsetTableSize(_data->header,true));
+ _data->header.setChunkCount(getChunkOffsetTableSize(_data->header));
_data->maxSampleCountTableSize = _data->tileDesc.ySize *
_data->tileDesc.xSize *
diff --git a/IlmImf/ImfMisc.cpp b/IlmImf/ImfMisc.cpp
index d0b6fb26..7d69798e 100644
--- a/IlmImf/ImfMisc.cpp
+++ b/IlmImf/ImfMisc.cpp
@@ -1900,18 +1900,30 @@ int
getTiledChunkOffsetTableSize(const Header& header);
int
-getChunkOffsetTableSize(const Header& header,bool ignore_attribute)
+getChunkOffsetTableSize(const Header& header,bool)
{
- if(!ignore_attribute && header.hasChunkCount())
- {
- return header.chunkCount();
- }
-
+ //
+ // if there is a type in the header which indicates the part is not a currently supported type,
+ // use the chunkCount attribute
+ //
+
+
if(header.hasType() && !isSupportedType(header.type()))
{
- throw IEX_NAMESPACE::ArgExc ("unsupported header type to "
- "get chunk offset table size");
+ if(header.hasChunkCount())
+ {
+ return header.chunkCount();
+ }
+ else
+ {
+ throw IEX_NAMESPACE::ArgExc ("unsupported header type to "
+ "get chunk offset table size");
+ }
}
+
+ //
+ // part is a known type - ignore the header attribute and compute the chunk size from the header
+ //
if (isTiled(header.type()) == false)
return getScanlineChunkOffsetTableSize(header);
else
diff --git a/IlmImf/ImfMisc.h b/IlmImf/ImfMisc.h
index 4cb7607e..f1cf648a 100644
--- a/IlmImf/ImfMisc.h
+++ b/IlmImf/ImfMisc.h
@@ -464,13 +464,16 @@ bool usesLongNames (const Header &header);
//
-// compute size of chunk offset table - if ignore_attribute set to true
-// will compute from the image size and layout, rather than the attribute
-// The default behaviour is to read the attribute
+// compute size of chunk offset table - for existing types, computes
+// the chunk size from the image size, compression type, and tile description
+// (for tiled types). If the type is not supported, uses the chunkCount attribute
+// if present, or throws an exception otherwise
+// deprecated_attribute is no longer used by this function
+//
//
IMF_EXPORT
-int getChunkOffsetTableSize(const Header& header,bool ignore_attribute=false);
+int getChunkOffsetTableSize(const Header& header,bool deprecated_attribute=false);
OPENEXR_IMF_INTERNAL_NAMESPACE_HEADER_EXIT
diff --git a/IlmImf/ImfMultiPartInputFile.cpp b/IlmImf/ImfMultiPartInputFile.cpp
index 0c574fa8..42488c9d 100644
--- a/IlmImf/ImfMultiPartInputFile.cpp
+++ b/IlmImf/ImfMultiPartInputFile.cpp
@@ -738,7 +738,7 @@ MultiPartInputFile::Data::readChunkOffsetTables(bool reconstructChunkOffsetTable
for (size_t i = 0; i < parts.size(); i++)
{
- int chunkOffsetTableSize = getChunkOffsetTableSize(parts[i]->header,false);
+ int chunkOffsetTableSize = getChunkOffsetTableSize(parts[i]->header);
parts[i]->chunkOffsets.resize(chunkOffsetTableSize);
for (int j = 0; j < chunkOffsetTableSize; j++)
diff --git a/IlmImf/ImfMultiPartOutputFile.cpp b/IlmImf/ImfMultiPartOutputFile.cpp
index 89501c40..082efc27 100644
--- a/IlmImf/ImfMultiPartOutputFile.cpp
+++ b/IlmImf/ImfMultiPartOutputFile.cpp
@@ -151,7 +151,7 @@ MultiPartOutputFile::Data::do_header_sanity_checks(bool overrideSharedAttributes
if (isMultiPart)
{
// multipart files must contain a chunkCount attribute
- _headers[0].setChunkCount(getChunkOffsetTableSize(_headers[0],true));
+ _headers[0].setChunkCount(getChunkOffsetTableSize(_headers[0]));
for (size_t i = 1; i < parts; i++)
{
@@ -159,7 +159,7 @@ MultiPartOutputFile::Data::do_header_sanity_checks(bool overrideSharedAttributes
throw IEX_NAMESPACE::ArgExc ("Every header in a multipart file should have a type");
- _headers[i].setChunkCount(getChunkOffsetTableSize(_headers[i],true));
+ _headers[i].setChunkCount(getChunkOffsetTableSize(_headers[i]));
_headers[i].sanityCheck (_headers[i].hasTileDescription(), isMultiPart);
@@ -191,7 +191,7 @@ MultiPartOutputFile::Data::do_header_sanity_checks(bool overrideSharedAttributes
if (_headers[0].hasType() && isImage(_headers[0].type()) == false)
{
- _headers[0].setChunkCount(getChunkOffsetTableSize(_headers[0],true));
+ _headers[0].setChunkCount(getChunkOffsetTableSize(_headers[0]));
}
}
@@ -500,7 +500,7 @@ MultiPartOutputFile::Data::writeChunkTableOffsets (vector<OutputPartData*> &part
{
for (size_t i = 0; i < parts.size(); i++)
{
- int chunkTableSize = getChunkOffsetTableSize(parts[i]->header,false);
+ int chunkTableSize = getChunkOffsetTableSize(parts[i]->header);
Int64 pos = os->tellp();