File openexr-CVE-2021-3475.patch of Package openexr.18966

Overview Repositories Revisions Requests Users Attributes Meta

File openexr-CVE-2021-3475.patch of Package openexr.18966

Index: openexr-2.2.1/IlmImf/ImfTiledInputFile.cpp
===================================================================
--- openexr-2.2.1.orig/IlmImf/ImfTiledInputFile.cpp	2021-03-31 16:46:33.459586875 +0200
+++ openexr-2.2.1/IlmImf/ImfTiledInputFile.cpp	2021-03-31 16:46:33.471586946 +0200
@@ -976,6 +976,16 @@ TiledInputFile::initialize ()
     _data->tileBufferSize = _data->maxBytesPerTileLine * _data->tileDesc.ySize;
 
     //
+    // OpenEXR has a limit of INT_MAX compressed bytes per tile
+    // disallow uncompressed tile sizes above INT_MAX too to guarantee file is written
+    //
+    if( _data->tileBufferSize > INT_MAX )
+    {
+        throw IEX_NAMESPACE::ArgExc ("Tile size too large for OpenEXR format");
+    }
+
+
+    //
     // Create all the TileBuffers and allocate their internal buffers
     //
 
Index: openexr-2.2.1/IlmImf/ImfTiledMisc.cpp
===================================================================
--- openexr-2.2.1.orig/IlmImf/ImfTiledMisc.cpp	2021-03-31 16:46:33.471586946 +0200
+++ openexr-2.2.1/IlmImf/ImfTiledMisc.cpp	2021-03-31 16:49:37.220675276 +0200
@@ -301,7 +301,9 @@ calculateNumTiles (int *numTiles,
 {
     for (int i = 0; i < numLevels; i++)
     {
-	numTiles[i] = (levelSize (min, max, i, rmode) + size - 1) / size;
+	// use 64 bits to avoid int overflow if size is large.
+	Int64 l = levelSize (min, max, i, rmode);
+	numTiles[i] = (l + size - 1) / size;
     }
 }
 
Index: openexr-2.2.1/IlmImf/ImfTiledOutputFile.cpp
===================================================================
--- openexr-2.2.1.orig/IlmImf/ImfTiledOutputFile.cpp	2017-11-18 00:00:24.000000000 +0100
+++ openexr-2.2.1/IlmImf/ImfTiledOutputFile.cpp	2021-03-31 16:46:33.471586946 +0200
@@ -1022,6 +1022,17 @@ TiledOutputFile::initialize (const Heade
 
     _data->tileBufferSize = _data->maxBytesPerTileLine * _data->tileDesc.ySize;
      
+        //
+    // OpenEXR has a limit of INT_MAX compressed bytes per tile
+    // disallow uncompressed tile sizes above INT_MAX too to guarantee file is written
+    //
+    if( _data->tileBufferSize > INT_MAX )
+    {
+        throw IEX_NAMESPACE::ArgExc ("Tile size too large for OpenEXR format");
+    }
+
+
+
     //
     // Create all the TileBuffers and allocate their internal buffers
     //

Places

File openexr-CVE-2021-3475.patch of Package openexr.18966

Places