GHSA-mw28-66qc-c883 on CTRL-OS 26.05

Aliases: GHSA-mw28-66qc-c883

Packages: openexr

Status: Plausible

Advisory Information

Summary

A crafted deep scanline EXR can make the PyOpenEXR wrapper reuse a scalar deep sample array allocated for a literal channel name (left) as the destination for coalesced prefixed RGB channels (left.R, left.G, left.B). The deep reader then registers DeepSlices with sampleStride = sizeof(half) * 3 into arrays allocated with scalar shape (sampleCount), not RGB shape (sampleCount, 3). Opening the file through the default public Python API, OpenEXR.File(path), triggers a heap out-of-bounds write during normal deep sample decode.

This reproduces on OpenEXR v3.4.13 and the local current main build. Original builds abort with heap corruption; ASAN reports heap-buffer-overflow, WRITE of size 2, at src/lib/OpenEXRCore/unpack.c:1359. The control file with only left.R/G/B opens cleanly.

Details

Affected and reproduced builds

target    build   case    rc  classification
v3.4.13   original    control 0   clean
v3.4.13   original    poc 134 original heap corruption abort
v3.4.13   asan    control 0   clean
v3.4.13   asan    poc 134 ASAN heap-buffer-overflow WRITE
v3.4.13   ubsan   control 0   clean
v3.4.13   ubsan   poc 134 original heap corruption abort
v3.4.13   msan    control 1   MSAN import failure (__msan_retval_tls)
v3.4.13   msan    poc 1   MSAN import failure (__msan_retval_tls)
main  original    control 0   clean
main  original    poc 134 original heap corruption abort
main  asan    control 0   clean
main  asan    poc 134 ASAN heap-buffer-overflow WRITE
main  ubsan   control 0   clean
main  ubsan   poc 134 original heap corruption abort

Root cause

Broken invariant:

A PyOpenEXR channel key must not be reused for a coalesced RGB/RGBA group unless the existing PyChannel was allocated with the same RGB/RGBA lane count and compatible element type that every registered Slice or DeepSlice will use.

The PoC declares these deep channel names, all HALF:

left
left.B
left.G
left.R

Because ChannelList iteration is sorted, the literal left channel is processed before left.B, left.G, and left.R.

In v3.4.13:

src/wrappers/python/PyOpenEXR.cpp:957-1004 maps prefixed left.R/G/B to Python key left and returns nrgba = 3.
PyOpenEXR.cpp:529-553 creates channels["left"] for the literal left channel first, with C._nrgba = 0.
PyOpenEXR.cpp:556-583 later processes left.B/G/R, reuses the existing channels["left"], and multiplies each registered DeepSlice sampleStride by local nrgba = 3.
PyOpenEXR.cpp:364-410 allocates scalar deep sample arrays because the reused PyChannel still has _nrgba = 0.
PyOpenEXR.cpp:414-490 points the deep slice data pointers into that scalar allocation.
PyOpenEXR.cpp:599-613 calls DeepScanLineInputPart::readPixels(). OpenEXRCore then writes deep samples using the oversized stride; ASAN reports the sink at src/lib/OpenEXRCore/unpack.c:1359.

The same pattern remains present in the local current main tree:

src/wrappers/python/PyOpenEXR.cpp:753-778: first channel creates/reuses the Python key and fixes _nrgba.
src/wrappers/python/PyOpenEXR.cpp:785-807: DeepSlice sampleStride is multiplied by local nrgba.
src/wrappers/python/PyOpenEXR.cpp:650-714: deep sample arrays and slice pointers are set from the reused PyChannel.
src/lib/OpenEXRCore/unpack.c:1359: ASAN-confirmed write sink.

PoC

PoC package contents

poc.zip contains only the files needed to reproduce and verify this report:

poc.zip

reproduce.sh
poc_materials/reproduce.sh
poc_materials/poc/deep_prefixed_literal_left_rgb_half_1x1_16samp.exr
poc_materials/poc/deep_prefixed_rgb_half_1x1_16samp_control.exr
poc_materials/src/repro_read.py
poc_materials/src/gen_deep_prefixed_literal_collision.cpp
poc_materials/logs/final_reproduction_matrix.tsv
poc_materials/logs/final_run.out
poc_materials/logs/final_run.err
poc_materials/logs/final_v3.4.13_original_poc.out
poc_materials/logs/final_v3.4.13_original_poc.err
poc_materials/logs/final_v3.4.13_asan_control.out
poc_materials/logs/final_v3.4.13_asan_control.err
poc_materials/logs/final_v3.4.13_asan_poc.out
poc_materials/logs/final_v3.4.13_asan_poc.err
poc_materials/logs/final_v3.4.13_ubsan_poc.out
poc_materials/logs/final_v3.4.13_ubsan_poc.err
poc_materials/logs/final_main_original_poc.out
poc_materials/logs/final_main_original_poc.err
poc_materials/logs/final_main_asan_control.out
poc_materials/logs/final_main_asan_control.err
poc_materials/logs/final_main_asan_poc.out
poc_materials/logs/final_main_asan_poc.err
poc_materials/logs/final_main_ubsan_poc.out
poc_materials/logs/final_main_ubsan_poc.err

Reproduction

From the report directory inside this workspace:

bash reproduce.sh

From an extracted poc.zip, point OPENEXR_ROOT at a workspace containing the v3.4.13 and main Python builds:

OPENEXR_ROOT=/home/br0nzu/openexr/v3.4.13 ./reproduce.sh

Expected final line:

PASS: deep prefixed literal/RGB key-collision heap OOB reproduced on v3.4.13 and main original+ASAN; controls clean. MSAN Python extension import is blocked on this host.

The PoC files are intentionally small:

deep_prefixed_literal_left_rgb_half_1x1_16samp.exr: crashing deep scanline file. One pixel, sixteen deep samples, channels left, left.B, left.G, left.R, all HALF.
deep_prefixed_rgb_half_1x1_16samp_control.exr: clean control with only left.B/G/R.
repro_read.py: opens the file with OpenEXR.File(path) and reads channels().

Impact

This is a heap-buffer-overflow / memory-corruption issue in the OpenEXR Python binding. Applications, services, and asset pipelines that accept untrusted deep EXR files and open them with default OpenEXR.File(path) behavior can be crashed by a crafted file. The overwrite occurs in a NumPy allocation selected by the wrapper's decoded deep sample destination layout, with attacker-controlled channel names and sample count.

It shows sanitizer-confirmed heap out-of-bounds writes and non-sanitized heap corruption aborts in both OpenEXR v3.4.13 and the local current main build.

A robust fix should reject literal channel keys that collide with coalesced RGB/RGBA group keys, or validate that any reused channel entry was allocated with the expected RGB/RGBA lane count and matching pixel type before installing Slice or DeepSlice entries.

Full validation output

reproduce.sh stdout

target    build   case    rc  classification
v3.4.13   original    control 0   clean
v3.4.13   original    poc 134 original heap corruption abort
v3.4.13   asan    control 0   clean
v3.4.13   asan    poc 134 ASAN heap-buffer-overflow WRITE
v3.4.13   ubsan   control 0   clean
v3.4.13   ubsan   poc 134 original heap corruption abort
v3.4.13   msan    control 1   MSAN import failure (__msan_retval_tls)
v3.4.13   msan    poc 1   MSAN import failure (__msan_retval_tls)
main  original    control 0   clean
main  original    poc 134 original heap corruption abort
main  asan    control 0   clean
main  asan    poc 134 ASAN heap-buffer-overflow WRITE
main  ubsan   control 0   clean
main  ubsan   poc 134 original heap corruption abort
PASS: deep prefixed literal/RGB key-collision heap OOB reproduced on v3.4.13 and main original+ASAN; controls clean. MSAN Python extension import is blocked on this host.

reproduce.sh stderr

reproduce.sh: line 12: 204046 Aborted                 env "${envargs[@]}" timeout --preserve-status 20s python3 "$PY" "$file" > "$prefix.out" 2> "$prefix.err"
reproduce.sh: line 12: 204060 Aborted                 env "${envargs[@]}" timeout --preserve-status 20s python3 "$PY" "$file" > "$prefix.out" 2> "$prefix.err"
reproduce.sh: line 12: 204086 Aborted                 env "${envargs[@]}" timeout --preserve-status 20s python3 "$PY" "$file" > "$prefix.out" 2> "$prefix.err"
reproduce.sh: line 12: 204112 Aborted                 env "${envargs[@]}" timeout --preserve-status 20s python3 "$PY" "$file" > "$prefix.out" 2> "$prefix.err"
reproduce.sh: line 12: 204126 Aborted                 env "${envargs[@]}" timeout --preserve-status 20s python3 "$PY" "$file" > "$prefix.out" 2> "$prefix.err"
reproduce.sh: line 12: 204138 Aborted                 env "${envargs[@]}" timeout --preserve-status 20s python3 "$PY" "$file" > "$prefix.out" 2> "$prefix.err"

v3.4.13 original PoC stdout

v3.4.13 original PoC stderr

malloc(): invalid size (unsorted)
timeout: the monitored command dumped core

v3.4.13 ASAN control stdout

keys ['left']
left shape (1, 1) dtype object
value [[30.    -1.686 -1.686]
 [31.    -1.686 -1.686]
 [32.    -1.686 -1.686]
 [33.    -1.686 -1.686]
 [34.    -1.686 -1.686]
 [35.    -1.686 -1.686]
 [36.    -1.686 -1.686]
 [37.    -1.686 -1.686]
 [38.    -1.686 -1.686]
 [39.    -1.686 -1.686]
 [40.    -1.686 -1.686]
 [41.    -1.686 -1.686]
 [42.    -1.686 -1.686]
 [43.    -1.686 -1.686]
 [44.    -1.686 -1.686]
 [45.    -1.686 -1.686]]
sep_keys ['left.B', 'left.G', 'left.R']

v3.4.13 ASAN control stderr

v3.4.13 ASAN PoC stdout

v3.4.13 ASAN PoC stderr

=================================================================
==204061==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x50300005a784 at pc 0x770ed08b66b0 bp 0x7fffe94a37f0 sp 0x7fffe94a37e0
WRITE of size 2 at 0x50300005a784 thread T0
    #0 0x770ed08b66af in generic_unpack_deep_pointers /home/br0nzu/openexr/v3.4.13/sources/openexr-3.4.13/src/lib/OpenEXRCore/unpack.c:1359
    #1 0x770ed08accaf in exr_decoding_run /home/br0nzu/openexr/v3.4.13/sources/openexr-3.4.13/src/lib/OpenEXRCore/decoding.c:664
    #2 0x770ed0cac362 in Imf_3_4::(anonymous namespace)::ScanLineProcess::run_decode(_priv_exr_context_t const*, int, Imf_3_4::DeepFrameBuffer const*, int, int, std::vector<Imf_3_4::DeepSlice, std::allocator<Imf_3_4::DeepSlice> > const&) /home/br0nzu/openexr/v3.4.13/sources/openexr-3.4.13/src/lib/OpenEXR/ImfDeepScanLineInputFile.cpp:831
    #3 0x770ed0ca90e9 in Imf_3_4::DeepScanLineInputFile::Data::readData(Imf_3_4::DeepFrameBuffer const&, int, int, bool) /home/br0nzu/openexr/v3.4.13/sources/openexr-3.4.13/src/lib/OpenEXR/ImfDeepScanLineInputFile.cpp:568
    #4 0x770ed0eb7e2c in (anonymous namespace)::PyPart::readDeepPixels(Imf_3_4::MultiPartInputFile&, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&, Imf_3_4::ChannelList const&, std::vector<unsigned long, std::allocator<unsigned long> > const&, std::set<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >, std::less<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > >, std::allocator<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > > > const&, Imath_3_1::Box<Imath_3_1::Vec2<int> > const&, bool) /home/br0nzu/openexr/v3.4.13/sources/openexr-3.4.13/src/wrappers/python/PyOpenEXR.cpp:612
    #5 0x770ed0eb7e2c in (anonymous namespace)::PyFile::PyFile(std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&, bool, bool) /home/br0nzu/openexr/v3.4.13/sources/openexr-3.4.13/src/wrappers/python/PyOpenEXR.cpp:223
    #6 0x770ed0eb0450 in _ZN8pybind116detail8initimpl23construct_or_initializeIN12_GLOBAL__N_16PyFileEJNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEEEbbETnNSt9enable_ifIXsr3std16is_constructibleIT_DpT0_EE5valueEiE4typeELi0EEEPSC_DpOSD_ /usr/include/pybind11/detail/init.h:76
    #7 0x770ed0eb0450 in _ZZN8pybind116detail8initimpl11constructorIJNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEEEbbEE7executeINS_6class_IN12_GLOBAL__N_16PyFileEJEEEJNS_3argENS_5arg_vESG_A548_cETnNSt9enable_ifIXntsrT_9has_aliasEiE4typeELi0EEEvRSJ_DpRKT0_ENKUlRNS0_16value_and_holderES8_bbE_clESS_S8_bb /usr/include/pybind11/detail/init.h:206
    #8 0x770ed0eb0450 in _ZNO8pybind116detail15argument_loaderIJRNS0_16value_and_holderENSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEEEbbEE9call_implIvRZNS0_8initimpl11constructorIJS9_bbEE7executeINS_6class_IN12_GLOBAL__N_16PyFileEJEEEJNS_3argENS_5arg_vESL_A548_cETnNSt9enable_ifIXntsrT_9has_aliasEiE4typeELi0EEEvRSO_DpRKT0_EUlS3_S9_bbE_JLm0ELm1ELm2ELm3EENS0_9void_typeEEESO_OT0_St16integer_sequenceImJXspT1_EEEOT2_ /usr/include/pybind11/detail/../cast.h:1480
    #9 0x770ed0eb0450 in _ZNO8pybind116detail15argument_loaderIJRNS0_16value_and_holderENSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEEEbbEE4callIvNS0_9void_typeERZNS0_8initimpl11constructorIJS9_bbEE7executeINS_6class_IN12_GLOBAL__N_16PyFileEJEEEJNS_3argENS_5arg_vESM_A548_cETnNSt9enable_ifIXntsrT_9has_aliasEiE4typeELi0EEEvRSP_DpRKT0_EUlS3_S9_bbE_EENSO_IXsr3std7is_voidISP_EE5valueESC_E4typeEOT1_ /usr/include/pybind11/detail/../cast.h:1454
    #10 0x770ed0eb005d in _ZZN8pybind1112cpp_function10initializeIZNS_6detail8initimpl11constructorIJNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEEEbbEE7executeINS_6class_IN12_GLOBAL__N_16PyFileEJEEEJNS_3argENS_5arg_vESI_A548_cETnNSt9enable_ifIXntsrT_9has_aliasEiE4typeELi0EEEvRSL_DpRKT0_EUlRNS2_16value_and_holderESA_bbE_vJSU_SA_bbEJNS_4nameENS_9is_methodENS_7siblingENS2_24is_new_style_constructorESH_SI_SI_SJ_EEEvOSL_PFT0_DpT1_EDpRKT2_ENKUlRNS2_13function_callEE_clES1B_ /usr/include/pybind11/pybind11.h:254
    #11 0x770ed0eb005d in _ZZN8pybind1112cpp_function10initializeIZNS_6detail8initimpl11constructorIJNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEEEbbEE7executeINS_6class_IN12_GLOBAL__N_16PyFileEJEEEJNS_3argENS_5arg_vESI_A548_cETnNSt9enable_ifIXntsrT_9has_aliasEiE4typeELi0EEEvRSL_DpRKT0_EUlRNS2_16value_and_holderESA_bbE_vJSU_SA_bbEJNS_4nameENS_9is_methodENS_7siblingENS2_24is_new_style_constructorESH_SI_SI_SJ_EEEvOSL_PFT0_DpT1_EDpRKT2_ENUlRNS2_13function_callEE_8__invokeES1B_ /usr/include/pybind11/pybind11.h:224
    #12 0x770ed0ef599e in pybind11::cpp_function::dispatcher(_object*, _object*, _object*) /usr/include/pybind11/pybind11.h:946
    #13 0x5821ee  (/usr/bin/python3.12+0x5821ee) (BuildId: 7aa38bef4bcd63064ecbd05a66f6120026526b74)
    #14 0x5492b4 in _PyObject_MakeTpCall (/usr/bin/python3.12+0x5492b4) (BuildId: 7aa38bef4bcd63064ecbd05a66f6120026526b74)
    #15 0x54cfc6  (/usr/bin/python3.12+0x54cfc6) (BuildId: 7aa38bef4bcd63064ecbd05a66f6120026526b74)
    #16 0x59e300  (/usr/bin/python3.12+0x59e300) (BuildId: 7aa38bef4bcd63064ecbd05a66f6120026526b74)
    #17 0x599c52  (/usr/bin/python3.12+0x599c52) (BuildId: 7aa38bef4bcd63064ecbd05a66f6120026526b74)
    #18 0x770ed0ee8357 in pybind11_meta_call /usr/include/pybind11/detail/class.h:187
    #19 0x5492b4 in _PyObject_MakeTpCall (/usr/bin/python3.12+0x5492b4) (BuildId: 7aa38bef4bcd63064ecbd05a66f6120026526b74)
    #20 0x5d7388 in _PyEval_EvalFrameDefault (/usr/bin/python3.12+0x5d7388) (BuildId: 7aa38bef4bcd63064ecbd05a66f6120026526b74)
    #21 0x5d58ba in PyEval_EvalCode (/usr/bin/python3.12+0x5d58ba) (BuildId: 7aa38bef4bcd63064ecbd05a66f6120026526b74)
    #22 0x608b51  (/usr/bin/python3.12+0x608b51) (BuildId: 7aa38bef4bcd63064ecbd05a66f6120026526b74)
    #23 0x6b5262  (/usr/bin/python3.12+0x6b5262) (BuildId: 7aa38bef4bcd63064ecbd05a66f6120026526b74)
    #24 0x6b4fc9 in _PyRun_SimpleFileObject (/usr/bin/python3.12+0x6b4fc9) (BuildId: 7aa38bef4bcd63064ecbd05a66f6120026526b74)
    #25 0x6b4dfe in _PyRun_AnyFileObject (/usr/bin/python3.12+0x6b4dfe) (BuildId: 7aa38bef4bcd63064ecbd05a66f6120026526b74)
    #26 0x6bce64 in Py_RunMain (/usr/bin/python3.12+0x6bce64) (BuildId: 7aa38bef4bcd63064ecbd05a66f6120026526b74)
    #27 0x6bc94c in Py_BytesMain (/usr/bin/python3.12+0x6bc94c) (BuildId: 7aa38bef4bcd63064ecbd05a66f6120026526b74)
    #28 0x770ed382a1c9 in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58
    #29 0x770ed382a28a in __libc_start_main_impl ../csu/libc-start.c:360
    #30 0x657b04 in _start (/usr/bin/python3.12+0x657b04) (BuildId: 7aa38bef4bcd63064ecbd05a66f6120026526b74)

0x50300005a784 is located 4 bytes after 32-byte region [0x50300005a760,0x50300005a780)
allocated by thread T0 here:
    #0 0x770ed3cfd9c7 in malloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:69
    #1 0x770ecfecc65a  (/usr/lib/python3/dist-packages/numpy/core/_multiarray_umath.cpython-312-x86_64-linux-gnu.so+0xcc65a) (BuildId: 4e90c45f411fba3236c21490996071d3467336f7)
    #2 0x770ecfee4b02  (/usr/lib/python3/dist-packages/numpy/core/_multiarray_umath.cpython-312-x86_64-linux-gnu.so+0xe4b02) (BuildId: 4e90c45f411fba3236c21490996071d3467336f7)
    #3 0x770ecfee4ee1  (/usr/lib/python3/dist-packages/numpy/core/_multiarray_umath.cpython-312-x86_64-linux-gnu.so+0xe4ee1) (BuildId: 4e90c45f411fba3236c21490996071d3467336f7)
    #4 0x770ed0f6e1d7 in pybind11::array::array(pybind11::dtype const&, pybind11::detail::any_container<long>, pybind11::detail::any_container<long>, void const*, pybind11::handle) /usr/include/pybind11/numpy.h:729
    #5 0x770ed0f81545 in pybind11::array::array<Imath_3_1::half>(pybind11::detail::any_container<long>, pybind11::detail::any_container<long>, Imath_3_1::half const*, pybind11::handle) /usr/include/pybind11/numpy.h:767
    #6 0x770ed0f83c76 in pybind11::array_t<Imath_3_1::half, 16>::array_t(pybind11::array_t<Imath_3_1::half, 16>::private_ctor, pybind11::detail::any_container<long>&&, pybind11::detail::any_container<long>&&, Imath_3_1::half const*, pybind11::handle) /usr/include/pybind11/numpy.h:1029
    #7 0x770ed0f834e7 in pybind11::array_t<Imath_3_1::half, 16>::array_t(pybind11::detail::any_container<long>, Imath_3_1::half const*, pybind11::handle) /usr/include/pybind11/numpy.h:1066
    #8 0x770ed0ebe636 in (anonymous namespace)::PyChannel::createDeepPixelArrays(unsigned long, unsigned long, Imf_3_4::Array2D<unsigned int> const&) /home/br0nzu/openexr/v3.4.13/sources/openexr-3.4.13/src/wrappers/python/PyOpenEXR.cpp:401
    #9 0x770ed0ebe636 in (anonymous namespace)::PyPart::setDeepSliceData(Imf_3_4::ChannelList const&, unsigned long, unsigned long, std::map<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >, std::unique_ptr<Imf_3_4::Array2D<void*>, std::default_delete<Imf_3_4::Array2D<void*> > >, std::less<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > >, std::allocator<std::pair<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const, std::unique_ptr<Imf_3_4::Array2D<void*>, std::default_delete<Imf_3_4::Array2D<void*> > > > > >&, std::map<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >, (anonymous namespace)::PyChannel*, std::less<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > >, std::allocator<std::pair<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const, (anonymous namespace)::PyChannel*> > >&, Imf_3_4::Array2D<unsigned int> const&) /home/br0nzu/openexr/v3.4.13/sources/openexr-3.4.13/src/wrappers/python/PyOpenEXR.cpp:431
    #10 0x770ed0eb7dd0 in (anonymous namespace)::PyPart::readDeepPixels(Imf_3_4::MultiPartInputFile&, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&, Imf_3_4::ChannelList const&, std::vector<unsigned long, std::allocator<unsigned long> > const&, std::set<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >, std::less<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > >, std::allocator<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > > > const&, Imath_3_1::Box<Imath_3_1::Vec2<int> > const&, bool) /home/br0nzu/openexr/v3.4.13/sources/openexr-3.4.13/src/wrappers/python/PyOpenEXR.cpp:608
    #11 0x770ed0eb7dd0 in (anonymous namespace)::PyFile::PyFile(std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&, bool, bool) /home/br0nzu/openexr/v3.4.13/sources/openexr-3.4.13/src/wrappers/python/PyOpenEXR.cpp:223
    #12 0x770ed0eb0450 in _ZN8pybind116detail8initimpl23construct_or_initializeIN12_GLOBAL__N_16PyFileEJNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEEEbbETnNSt9enable_ifIXsr3std16is_constructibleIT_DpT0_EE5valueEiE4typeELi0EEEPSC_DpOSD_ /usr/include/pybind11/detail/init.h:76
    #13 0x770ed0eb0450 in _ZZN8pybind116detail8initimpl11constructorIJNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEEEbbEE7executeINS_6class_IN12_GLOBAL__N_16PyFileEJEEEJNS_3argENS_5arg_vESG_A548_cETnNSt9enable_ifIXntsrT_9has_aliasEiE4typeELi0EEEvRSJ_DpRKT0_ENKUlRNS0_16value_and_holderES8_bbE_clESS_S8_bb /usr/include/pybind11/detail/init.h:206
    #14 0x770ed0eb0450 in _ZNO8pybind116detail15argument_loaderIJRNS0_16value_and_holderENSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEEEbbEE9call_implIvRZNS0_8initimpl11constructorIJS9_bbEE7executeINS_6class_IN12_GLOBAL__N_16PyFileEJEEEJNS_3argENS_5arg_vESL_A548_cETnNSt9enable_ifIXntsrT_9has_aliasEiE4typeELi0EEEvRSO_DpRKT0_EUlS3_S9_bbE_JLm0ELm1ELm2ELm3EENS0_9void_typeEEESO_OT0_St16integer_sequenceImJXspT1_EEEOT2_ /usr/include/pybind11/detail/../cast.h:1480
    #15 0x770ed0eb0450 in _ZNO8pybind116detail15argument_loaderIJRNS0_16value_and_holderENSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEEEbbEE4callIvNS0_9void_typeERZNS0_8initimpl11constructorIJS9_bbEE7executeINS_6class_IN12_GLOBAL__N_16PyFileEJEEEJNS_3argENS_5arg_vESM_A548_cETnNSt9enable_ifIXntsrT_9has_aliasEiE4typeELi0EEEvRSP_DpRKT0_EUlS3_S9_bbE_EENSO_IXsr3std7is_voidISP_EE5valueESC_E4typeEOT1_ /usr/include/pybind11/detail/../cast.h:1454
    #16 0x770ed0eb005d in _ZZN8pybind1112cpp_function10initializeIZNS_6detail8initimpl11constructorIJNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEEEbbEE7executeINS_6class_IN12_GLOBAL__N_16PyFileEJEEEJNS_3argENS_5arg_vESI_A548_cETnNSt9enable_ifIXntsrT_9has_aliasEiE4typeELi0EEEvRSL_DpRKT0_EUlRNS2_16value_and_holderESA_bbE_vJSU_SA_bbEJNS_4nameENS_9is_methodENS_7siblingENS2_24is_new_style_constructorESH_SI_SI_SJ_EEEvOSL_PFT0_DpT1_EDpRKT2_ENKUlRNS2_13function_callEE_clES1B_ /usr/include/pybind11/pybind11.h:254
    #17 0x770ed0eb005d in _ZZN8pybind1112cpp_function10initializeIZNS_6detail8initimpl11constructorIJNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEEEbbEE7executeINS_6class_IN12_GLOBAL__N_16PyFileEJEEEJNS_3argENS_5arg_vESI_A548_cETnNSt9enable_ifIXntsrT_9has_aliasEiE4typeELi0EEEvRSL_DpRKT0_EUlRNS2_16value_and_holderESA_bbE_vJSU_SA_bbEJNS_4nameENS_9is_methodENS_7siblingENS2_24is_new_style_constructorESH_SI_SI_SJ_EEEvOSL_PFT0_DpT1_EDpRKT2_ENUlRNS2_13function_callEE_8__invokeES1B_ /usr/include/pybind11/pybind11.h:224
    #18 0x770ed0ef599e in pybind11::cpp_function::dispatcher(_object*, _object*, _object*) /usr/include/pybind11/pybind11.h:946
    #19 0x5821ee  (/usr/bin/python3.12+0x5821ee) (BuildId: 7aa38bef4bcd63064ecbd05a66f6120026526b74)
    #20 0x5492b4 in _PyObject_MakeTpCall (/usr/bin/python3.12+0x5492b4) (BuildId: 7aa38bef4bcd63064ecbd05a66f6120026526b74)
    #21 0x54cfc6  (/usr/bin/python3.12+0x54cfc6) (BuildId: 7aa38bef4bcd63064ecbd05a66f6120026526b74)
    #22 0x59e300  (/usr/bin/python3.12+0x59e300) (BuildId: 7aa38bef4bcd63064ecbd05a66f6120026526b74)
    #23 0x599c52  (/usr/bin/python3.12+0x599c52) (BuildId: 7aa38bef4bcd63064ecbd05a66f6120026526b74)
    #24 0x770ed0ee8357 in pybind11_meta_call /usr/include/pybind11/detail/class.h:187
    #25 0x5492b4 in _PyObject_MakeTpCall (/usr/bin/python3.12+0x5492b4) (BuildId: 7aa38bef4bcd63064ecbd05a66f6120026526b74)
    #26 0x5d7388 in _PyEval_EvalFrameDefault (/usr/bin/python3.12+0x5d7388) (BuildId: 7aa38bef4bcd63064ecbd05a66f6120026526b74)
    #27 0x5d58ba in PyEval_EvalCode (/usr/bin/python3.12+0x5d58ba) (BuildId: 7aa38bef4bcd63064ecbd05a66f6120026526b74)
    #28 0x608b51  (/usr/bin/python3.12+0x608b51) (BuildId: 7aa38bef4bcd63064ecbd05a66f6120026526b74)
    #29 0x6b5262  (/usr/bin/python3.12+0x6b5262) (BuildId: 7aa38bef4bcd63064ecbd05a66f6120026526b74)
    #30 0x6b4fc9 in _PyRun_SimpleFileObject (/usr/bin/python3.12+0x6b4fc9) (BuildId: 7aa38bef4bcd63064ecbd05a66f6120026526b74)
    #31 0x6b4dfe in _PyRun_AnyFileObject (/usr/bin/python3.12+0x6b4dfe) (BuildId: 7aa38bef4bcd63064ecbd05a66f6120026526b74)
    #32 0x6bce64 in Py_RunMain (/usr/bin/python3.12+0x6bce64) (BuildId: 7aa38bef4bcd63064ecbd05a66f6120026526b74)
    #33 0x6bc94c in Py_BytesMain (/usr/bin/python3.12+0x6bc94c) (BuildId: 7aa38bef4bcd63064ecbd05a66f6120026526b74)
    #34 0x770ed382a1c9 in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58
    #35 0x770ed382a28a in __libc_start_main_impl ../csu/libc-start.c:360

SUMMARY: AddressSanitizer: heap-buffer-overflow /home/br0nzu/openexr/v3.4.13/sources/openexr-3.4.13/src/lib/OpenEXRCore/unpack.c:1359 in generic_unpack_deep_pointers
Shadow bytes around the buggy address:
  0x50300005a500: fd fa fa fa fd fd fd fa fa fa fd fd fd fa fa fa
  0x50300005a580: 00 00 00 fa fa fa 00 00 00 fa fa fa 00 00 00 fa
  0x50300005a600: fa fa 00 00 00 fa fa fa 00 00 00 fa fa fa 00 00
  0x50300005a680: 00 fa fa fa 00 00 00 00 fa fa 00 00 00 fa fa fa
  0x50300005a700: 00 00 00 fa fa fa 00 00 00 fa fa fa 00 00 00 00
=>0x50300005a780:[fa]fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x50300005a800: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x50300005a880: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x50300005a900: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x50300005a980: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x50300005aa00: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
==204061==ABORTING
timeout: the monitored command dumped core

v3.4.13 UBSAN PoC stdout

v3.4.13 UBSAN PoC stderr

malloc(): invalid size (unsorted)
timeout: the monitored command dumped core

v3.4.13 MSAN import-failure control stdout

v3.4.13 MSAN import-failure control stderr

Traceback (most recent call last):
  File "/home/br0nzu/openexr/v3.4.13/report/56. Vuln_OpenEXR v3.4.13 PyOpenEXR deep prefixed literal RGB key collision heap buffer overflow/poc_materials/src/repro_read.py", line 3, in <module>
    import OpenEXR
ImportError: /home/br0nzu/openexr/v3.4.13/builds/python_msan/src/lib/OpenEXRCore/libOpenEXRCore-3_4.so.33: undefined symbol: __msan_retval_tls

v3.4.13 MSAN import-failure PoC stdout

v3.4.13 MSAN import-failure PoC stderr

Traceback (most recent call last):
  File "/home/br0nzu/openexr/v3.4.13/report/56. Vuln_OpenEXR v3.4.13 PyOpenEXR deep prefixed literal RGB key collision heap buffer overflow/poc_materials/src/repro_read.py", line 3, in <module>
    import OpenEXR
ImportError: /home/br0nzu/openexr/v3.4.13/builds/python_msan/src/lib/OpenEXRCore/libOpenEXRCore-3_4.so.33: undefined symbol: __msan_retval_tls

main original PoC stdout

main original PoC stderr

malloc(): corrupted top size
timeout: the monitored command dumped core

main ASAN control stdout

keys ['left']
left shape (1, 1) dtype object
value [[30.    -1.686 -1.686]
 [31.    -1.686 -1.686]
 [32.    -1.686 -1.686]
 [33.    -1.686 -1.686]
 [34.    -1.686 -1.686]
 [35.    -1.686 -1.686]
 [36.    -1.686 -1.686]
 [37.    -1.686 -1.686]
 [38.    -1.686 -1.686]
 [39.    -1.686 -1.686]
 [40.    -1.686 -1.686]
 [41.    -1.686 -1.686]
 [42.    -1.686 -1.686]
 [43.    -1.686 -1.686]
 [44.    -1.686 -1.686]
 [45.    -1.686 -1.686]]
sep_keys ['left.B', 'left.G', 'left.R']

main ASAN control stderr

main ASAN PoC stdout

main ASAN PoC stderr

=================================================================
==204127==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x50300005dc04 at pc 0x7b3c5bab66b0 bp 0x7ffd8e5055d0 sp 0x7ffd8e5055c0
WRITE of size 2 at 0x50300005dc04 thread T0
    #0 0x7b3c5bab66af in generic_unpack_deep_pointers /home/br0nzu/openexr/v3.4.13/sources/openexr-main/src/lib/OpenEXRCore/unpack.c:1359
    #1 0x7b3c5baaccaf in exr_decoding_run /home/br0nzu/openexr/v3.4.13/sources/openexr-main/src/lib/OpenEXRCore/decoding.c:664
    #2 0x7b3c5beac242 in Imf_4_0::(anonymous namespace)::ScanLineProcess::run_decode(_priv_exr_context_t const*, int, Imf_4_0::DeepFrameBuffer const*, int, int, std::vector<Imf_4_0::DeepSlice, std::allocator<Imf_4_0::DeepSlice> > const&) /home/br0nzu/openexr/v3.4.13/sources/openexr-main/src/lib/OpenEXR/ImfDeepScanLineInputFile.cpp:831
    #3 0x7b3c5bea9009 in Imf_4_0::DeepScanLineInputFile::Data::readData(Imf_4_0::DeepFrameBuffer const&, int, int, bool) /home/br0nzu/openexr/v3.4.13/sources/openexr-main/src/lib/OpenEXR/ImfDeepScanLineInputFile.cpp:568
    #4 0x7b3c5c27c2b4 in (anonymous namespace)::PyPart::readDeepPixels(Imf_4_0::MultiPartInputFile&, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&, Imf_4_0::ChannelList const&, std::vector<unsigned long, std::allocator<unsigned long> > const&, std::set<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >, std::less<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > >, std::allocator<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > > > const&, Imath_3_1::Box<Imath_3_1::Vec2<int> > const&, bool) /home/br0nzu/openexr/v3.4.13/sources/openexr-main/src/wrappers/python/PyOpenEXR.cpp:836
    #5 0x7b3c5c27c2b4 in (anonymous namespace)::PyFile::readPartsFromOpenInput(bool) /home/br0nzu/openexr/v3.4.13/sources/openexr-main/src/wrappers/python/PyOpenEXR.cpp:447
    #6 0x7b3c5c274916 in (anonymous namespace)::PyFile::PyFile(std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&, bool, bool, int) /home/br0nzu/openexr/v3.4.13/sources/openexr-main/src/wrappers/python/PyOpenEXR.cpp:362
    #7 0x7b3c5c274916 in _ZN8pybind116detail8initimpl23construct_or_initializeIN12_GLOBAL__N_16PyFileEJNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEEEbbiETnNSt9enable_ifIXsr3std16is_constructibleIT_DpT0_EE5valueEiE4typeELi0EEEPSC_DpOSD_ /usr/include/pybind11/detail/init.h:76
    #8 0x7b3c5c274916 in _ZZN8pybind116detail8initimpl11constructorIJNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEEEbbiEE7executeINS_6class_IN12_GLOBAL__N_16PyFileEJEEEJNS_3argENS_5arg_vESG_SG_A641_cETnNSt9enable_ifIXntsrT_9has_aliasEiE4typeELi0EEEvRSJ_DpRKT0_ENKUlRNS0_16value_and_holderES8_bbiE_clESS_S8_bbi /usr/include/pybind11/detail/init.h:206
    #9 0x7b3c5c274916 in _ZNO8pybind116detail15argument_loaderIJRNS0_16value_and_holderENSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEEEbbiEE9call_implIvRZNS0_8initimpl11constructorIJS9_bbiEE7executeINS_6class_IN12_GLOBAL__N_16PyFileEJEEEJNS_3argENS_5arg_vESL_SL_A641_cETnNSt9enable_ifIXntsrT_9has_aliasEiE4typeELi0EEEvRSO_DpRKT0_EUlS3_S9_bbiE_JLm0ELm1ELm2ELm3ELm4EENS0_9void_typeEEESO_OT0_St16integer_sequenceImJXspT1_EEEOT2_ /usr/include/pybind11/detail/../cast.h:1480
    #10 0x7b3c5c274916 in _ZNO8pybind116detail15argument_loaderIJRNS0_16value_and_holderENSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEEEbbiEE4callIvNS0_9void_typeERZNS0_8initimpl11constructorIJS9_bbiEE7executeINS_6class_IN12_GLOBAL__N_16PyFileEJEEEJNS_3argENS_5arg_vESM_SM_A641_cETnNSt9enable_ifIXntsrT_9has_aliasEiE4typeELi0EEEvRSP_DpRKT0_EUlS3_S9_bbiE_EENSO_IXsr3std7is_voidISP_EE5valueESC_E4typeEOT1_ /usr/include/pybind11/detail/../cast.h:1454
    #11 0x7b3c5c274296 in _ZZN8pybind1112cpp_function10initializeIZNS_6detail8initimpl11constructorIJNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEEEbbiEE7executeINS_6class_IN12_GLOBAL__N_16PyFileEJEEEJNS_3argENS_5arg_vESI_SI_A641_cETnNSt9enable_ifIXntsrT_9has_aliasEiE4typeELi0EEEvRSL_DpRKT0_EUlRNS2_16value_and_holderESA_bbiE_vJSU_SA_bbiEJNS_4nameENS_9is_methodENS_7siblingENS2_24is_new_style_constructorESH_SI_SI_SI_SJ_EEEvOSL_PFT0_DpT1_EDpRKT2_ENKUlRNS2_13function_callEE_clES1B_ /usr/include/pybind11/pybind11.h:254
    #12 0x7b3c5c274296 in _ZZN8pybind1112cpp_function10initializeIZNS_6detail8initimpl11constructorIJNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEEEbbiEE7executeINS_6class_IN12_GLOBAL__N_16PyFileEJEEEJNS_3argENS_5arg_vESI_SI_A641_cETnNSt9enable_ifIXntsrT_9has_aliasEiE4typeELi0EEEvRSL_DpRKT0_EUlRNS2_16value_and_holderESA_bbiE_vJSU_SA_bbiEJNS_4nameENS_9is_methodENS_7siblingENS2_24is_new_style_constructorESH_SI_SI_SI_SJ_EEEvOSL_PFT0_DpT1_EDpRKT2_ENUlRNS2_13function_callEE_8__invokeES1B_ /usr/include/pybind11/pybind11.h:224
    #13 0x7b3c5c2c572e in pybind11::cpp_function::dispatcher(_object*, _object*, _object*) /usr/include/pybind11/pybind11.h:946
    #14 0x5821ee  (/usr/bin/python3.12+0x5821ee) (BuildId: 7aa38bef4bcd63064ecbd05a66f6120026526b74)
    #15 0x5492b4 in _PyObject_MakeTpCall (/usr/bin/python3.12+0x5492b4) (BuildId: 7aa38bef4bcd63064ecbd05a66f6120026526b74)
    #16 0x54cfc6  (/usr/bin/python3.12+0x54cfc6) (BuildId: 7aa38bef4bcd63064ecbd05a66f6120026526b74)
    #17 0x59e300  (/usr/bin/python3.12+0x59e300) (BuildId: 7aa38bef4bcd63064ecbd05a66f6120026526b74)
    #18 0x599c52  (/usr/bin/python3.12+0x599c52) (BuildId: 7aa38bef4bcd63064ecbd05a66f6120026526b74)
    #19 0x7b3c5c2b80e7 in pybind11_meta_call /usr/include/pybind11/detail/class.h:187
    #20 0x5492b4 in _PyObject_MakeTpCall (/usr/bin/python3.12+0x5492b4) (BuildId: 7aa38bef4bcd63064ecbd05a66f6120026526b74)
    #21 0x5d7388 in _PyEval_EvalFrameDefault (/usr/bin/python3.12+0x5d7388) (BuildId: 7aa38bef4bcd63064ecbd05a66f6120026526b74)
    #22 0x5d58ba in PyEval_EvalCode (/usr/bin/python3.12+0x5d58ba) (BuildId: 7aa38bef4bcd63064ecbd05a66f6120026526b74)
    #23 0x608b51  (/usr/bin/python3.12+0x608b51) (BuildId: 7aa38bef4bcd63064ecbd05a66f6120026526b74)
    #24 0x6b5262  (/usr/bin/python3.12+0x6b5262) (BuildId: 7aa38bef4bcd63064ecbd05a66f6120026526b74)
    #25 0x6b4fc9 in _PyRun_SimpleFileObject (/usr/bin/python3.12+0x6b4fc9) (BuildId: 7aa38bef4bcd63064ecbd05a66f6120026526b74)
    #26 0x6b4dfe in _PyRun_AnyFileObject (/usr/bin/python3.12+0x6b4dfe) (BuildId: 7aa38bef4bcd63064ecbd05a66f6120026526b74)
    #27 0x6bce64 in Py_RunMain (/usr/bin/python3.12+0x6bce64) (BuildId: 7aa38bef4bcd63064ecbd05a66f6120026526b74)
    #28 0x6bc94c in Py_BytesMain (/usr/bin/python3.12+0x6bc94c) (BuildId: 7aa38bef4bcd63064ecbd05a66f6120026526b74)
    #29 0x7b3c5ec2a1c9 in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58
    #30 0x7b3c5ec2a28a in __libc_start_main_impl ../csu/libc-start.c:360
    #31 0x657b04 in _start (/usr/bin/python3.12+0x657b04) (BuildId: 7aa38bef4bcd63064ecbd05a66f6120026526b74)

0x50300005dc04 is located 4 bytes after 32-byte region [0x50300005dbe0,0x50300005dc00)
allocated by thread T0 here:
    #0 0x7b3c5f0fd9c7 in malloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:69
    #1 0x7b3c5b0cc65a  (/usr/lib/python3/dist-packages/numpy/core/_multiarray_umath.cpython-312-x86_64-linux-gnu.so+0xcc65a) (BuildId: 4e90c45f411fba3236c21490996071d3467336f7)
    #2 0x7b3c5b0e4b02  (/usr/lib/python3/dist-packages/numpy/core/_multiarray_umath.cpython-312-x86_64-linux-gnu.so+0xe4b02) (BuildId: 4e90c45f411fba3236c21490996071d3467336f7)
    #3 0x7b3c5b0e4ee1  (/usr/lib/python3/dist-packages/numpy/core/_multiarray_umath.cpython-312-x86_64-linux-gnu.so+0xe4ee1) (BuildId: 4e90c45f411fba3236c21490996071d3467336f7)
    #4 0x7b3c5c345247 in pybind11::array::array(pybind11::dtype const&, pybind11::detail::any_container<long>, pybind11::detail::any_container<long>, void const*, pybind11::handle) /usr/include/pybind11/numpy.h:729
    #5 0x7b3c5c3713f5 in pybind11::array::array<Imath_3_1::half>(pybind11::detail::any_container<long>, pybind11::detail::any_container<long>, Imath_3_1::half const*, pybind11::handle) /usr/include/pybind11/numpy.h:767
    #6 0x7b3c5c373b26 in pybind11::array_t<Imath_3_1::half, 16>::array_t(pybind11::array_t<Imath_3_1::half, 16>::private_ctor, pybind11::detail::any_container<long>&&, pybind11::detail::any_container<long>&&, Imath_3_1::half const*, pybind11::handle) /usr/include/pybind11/numpy.h:1029
    #7 0x7b3c5c373397 in pybind11::array_t<Imath_3_1::half, 16>::array_t(pybind11::detail::any_container<long>, Imath_3_1::half const*, pybind11::handle) /usr/include/pybind11/numpy.h:1066
    #8 0x7b3c5c282966 in (anonymous namespace)::PyChannel::createDeepPixelArrays(unsigned long, unsigned long, Imf_4_0::Array2D<unsigned int> const&) /home/br0nzu/openexr/v3.4.13/sources/openexr-main/src/wrappers/python/PyOpenEXR.cpp:625
    #9 0x7b3c5c282966 in (anonymous namespace)::PyPart::setDeepSliceData(Imf_4_0::ChannelList const&, unsigned long, unsigned long, std::map<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >, std::unique_ptr<Imf_4_0::Array2D<void*>, std::default_delete<Imf_4_0::Array2D<void*> > >, std::less<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > >, std::allocator<std::pair<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const, std::unique_ptr<Imf_4_0::Array2D<void*>, std::default_delete<Imf_4_0::Array2D<void*> > > > > >&, std::map<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >, (anonymous namespace)::PyChannel*, std::less<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > >, std::allocator<std::pair<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const, (anonymous namespace)::PyChannel*> > >&, Imf_4_0::Array2D<unsigned int> const&) /home/br0nzu/openexr/v3.4.13/sources/openexr-main/src/wrappers/python/PyOpenEXR.cpp:655
    #10 0x7b3c5c27c258 in (anonymous namespace)::PyPart::readDeepPixels(Imf_4_0::MultiPartInputFile&, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&, Imf_4_0::ChannelList const&, std::vector<unsigned long, std::allocator<unsigned long> > const&, std::set<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >, std::less<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > >, std::allocator<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > > > const&, Imath_3_1::Box<Imath_3_1::Vec2<int> > const&, bool) /home/br0nzu/openexr/v3.4.13/sources/openexr-main/src/wrappers/python/PyOpenEXR.cpp:832
    #11 0x7b3c5c27c258 in (anonymous namespace)::PyFile::readPartsFromOpenInput(bool) /home/br0nzu/openexr/v3.4.13/sources/openexr-main/src/wrappers/python/PyOpenEXR.cpp:447
    #12 0x7b3c5c274916 in (anonymous namespace)::PyFile::PyFile(std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&, bool, bool, int) /home/br0nzu/openexr/v3.4.13/sources/openexr-main/src/wrappers/python/PyOpenEXR.cpp:362
    #13 0x7b3c5c274916 in _ZN8pybind116detail8initimpl23construct_or_initializeIN12_GLOBAL__N_16PyFileEJNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEEEbbiETnNSt9enable_ifIXsr3std16is_constructibleIT_DpT0_EE5valueEiE4typeELi0EEEPSC_DpOSD_ /usr/include/pybind11/detail/init.h:76
    #14 0x7b3c5c274916 in _ZZN8pybind116detail8initimpl11constructorIJNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEEEbbiEE7executeINS_6class_IN12_GLOBAL__N_16PyFileEJEEEJNS_3argENS_5arg_vESG_SG_A641_cETnNSt9enable_ifIXntsrT_9has_aliasEiE4typeELi0EEEvRSJ_DpRKT0_ENKUlRNS0_16value_and_holderES8_bbiE_clESS_S8_bbi /usr/include/pybind11/detail/init.h:206
    #15 0x7b3c5c274916 in _ZNO8pybind116detail15argument_loaderIJRNS0_16value_and_holderENSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEEEbbiEE9call_implIvRZNS0_8initimpl11constructorIJS9_bbiEE7executeINS_6class_IN12_GLOBAL__N_16PyFileEJEEEJNS_3argENS_5arg_vESL_SL_A641_cETnNSt9enable_ifIXntsrT_9has_aliasEiE4typeELi0EEEvRSO_DpRKT0_EUlS3_S9_bbiE_JLm0ELm1ELm2ELm3ELm4EENS0_9void_typeEEESO_OT0_St16integer_sequenceImJXspT1_EEEOT2_ /usr/include/pybind11/detail/../cast.h:1480
    #16 0x7b3c5c274916 in _ZNO8pybind116detail15argument_loaderIJRNS0_16value_and_holderENSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEEEbbiEE4callIvNS0_9void_typeERZNS0_8initimpl11constructorIJS9_bbiEE7executeINS_6class_IN12_GLOBAL__N_16PyFileEJEEEJNS_3argENS_5arg_vESM_SM_A641_cETnNSt9enable_ifIXntsrT_9has_aliasEiE4typeELi0EEEvRSP_DpRKT0_EUlS3_S9_bbiE_EENSO_IXsr3std7is_voidISP_EE5valueESC_E4typeEOT1_ /usr/include/pybind11/detail/../cast.h:1454
    #17 0x7b3c5c274296 in _ZZN8pybind1112cpp_function10initializeIZNS_6detail8initimpl11constructorIJNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEEEbbiEE7executeINS_6class_IN12_GLOBAL__N_16PyFileEJEEEJNS_3argENS_5arg_vESI_SI_A641_cETnNSt9enable_ifIXntsrT_9has_aliasEiE4typeELi0EEEvRSL_DpRKT0_EUlRNS2_16value_and_holderESA_bbiE_vJSU_SA_bbiEJNS_4nameENS_9is_methodENS_7siblingENS2_24is_new_style_constructorESH_SI_SI_SI_SJ_EEEvOSL_PFT0_DpT1_EDpRKT2_ENKUlRNS2_13function_callEE_clES1B_ /usr/include/pybind11/pybind11.h:254
    #18 0x7b3c5c274296 in _ZZN8pybind1112cpp_function10initializeIZNS_6detail8initimpl11constructorIJNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEEEbbiEE7executeINS_6class_IN12_GLOBAL__N_16PyFileEJEEEJNS_3argENS_5arg_vESI_SI_A641_cETnNSt9enable_ifIXntsrT_9has_aliasEiE4typeELi0EEEvRSL_DpRKT0_EUlRNS2_16value_and_holderESA_bbiE_vJSU_SA_bbiEJNS_4nameENS_9is_methodENS_7siblingENS2_24is_new_style_constructorESH_SI_SI_SI_SJ_EEEvOSL_PFT0_DpT1_EDpRKT2_ENUlRNS2_13function_callEE_8__invokeES1B_ /usr/include/pybind11/pybind11.h:224
    #19 0x7b3c5c2c572e in pybind11::cpp_function::dispatcher(_object*, _object*, _object*) /usr/include/pybind11/pybind11.h:946
    #20 0x5821ee  (/usr/bin/python3.12+0x5821ee) (BuildId: 7aa38bef4bcd63064ecbd05a66f6120026526b74)
    #21 0x5492b4 in _PyObject_MakeTpCall (/usr/bin/python3.12+0x5492b4) (BuildId: 7aa38bef4bcd63064ecbd05a66f6120026526b74)
    #22 0x54cfc6  (/usr/bin/python3.12+0x54cfc6) (BuildId: 7aa38bef4bcd63064ecbd05a66f6120026526b74)
    #23 0x59e300  (/usr/bin/python3.12+0x59e300) (BuildId: 7aa38bef4bcd63064ecbd05a66f6120026526b74)
    #24 0x599c52  (/usr/bin/python3.12+0x599c52) (BuildId: 7aa38bef4bcd63064ecbd05a66f6120026526b74)
    #25 0x7b3c5c2b80e7 in pybind11_meta_call /usr/include/pybind11/detail/class.h:187
    #26 0x5492b4 in _PyObject_MakeTpCall (/usr/bin/python3.12+0x5492b4) (BuildId: 7aa38bef4bcd63064ecbd05a66f6120026526b74)
    #27 0x5d7388 in _PyEval_EvalFrameDefault (/usr/bin/python3.12+0x5d7388) (BuildId: 7aa38bef4bcd63064ecbd05a66f6120026526b74)
    #28 0x5d58ba in PyEval_EvalCode (/usr/bin/python3.12+0x5d58ba) (BuildId: 7aa38bef4bcd63064ecbd05a66f6120026526b74)
    #29 0x608b51  (/usr/bin/python3.12+0x608b51) (BuildId: 7aa38bef4bcd63064ecbd05a66f6120026526b74)
    #30 0x6b5262  (/usr/bin/python3.12+0x6b5262) (BuildId: 7aa38bef4bcd63064ecbd05a66f6120026526b74)
    #31 0x6b4fc9 in _PyRun_SimpleFileObject (/usr/bin/python3.12+0x6b4fc9) (BuildId: 7aa38bef4bcd63064ecbd05a66f6120026526b74)
    #32 0x6b4dfe in _PyRun_AnyFileObject (/usr/bin/python3.12+0x6b4dfe) (BuildId: 7aa38bef4bcd63064ecbd05a66f6120026526b74)
    #33 0x6bce64 in Py_RunMain (/usr/bin/python3.12+0x6bce64) (BuildId: 7aa38bef4bcd63064ecbd05a66f6120026526b74)
    #34 0x6bc94c in Py_BytesMain (/usr/bin/python3.12+0x6bc94c) (BuildId: 7aa38bef4bcd63064ecbd05a66f6120026526b74)
    #35 0x7b3c5ec2a1c9 in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58
    #36 0x7b3c5ec2a28a in __libc_start_main_impl ../csu/libc-start.c:360

SUMMARY: AddressSanitizer: heap-buffer-overflow /home/br0nzu/openexr/v3.4.13/sources/openexr-main/src/lib/OpenEXRCore/unpack.c:1359 in generic_unpack_deep_pointers
Shadow bytes around the buggy address:
  0x50300005d980: fd fa fa fa fd fd fd fa fa fa fd fd fd fa fa fa
  0x50300005da00: 00 00 00 fa fa fa 00 00 00 fa fa fa 00 00 00 fa
  0x50300005da80: fa fa 00 00 00 fa fa fa 00 00 00 fa fa fa 00 00
  0x50300005db00: 00 fa fa fa 00 00 00 00 fa fa 00 00 00 fa fa fa
  0x50300005db80: 00 00 00 fa fa fa 00 00 00 fa fa fa 00 00 00 00
=>0x50300005dc00:[fa]fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x50300005dc80: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x50300005dd00: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x50300005dd80: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x50300005de00: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x50300005de80: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
==204127==ABORTING
timeout: the monitored command dumped core

main UBSAN PoC stdout

main UBSAN PoC stderr

malloc(): corrupted top size
timeout: the monitored command dumped core

Updates

2026-08-11 03:50 CEST

Metadata changes:

Status for package openexr: “Plausible”

2026-08-11 03:32 CEST

Metadata changes:

Status for package openexr: “New”