Skip to content

GHSA-gjf7-wjjw-xq56 on CTRL-OS 26.05

Aliases: GHSA-gjf7-wjjw-xq56

Packages: openexr

Status: Plausible

Advisory Information

OpenEXR v3.4.13 exrmultiview subsampled union heap OOB write

Summary

exrmultiview can write past a heap allocation when it combines two attacker-supplied, individually valid scanline EXR files whose union dataWindow is not aligned to one view's channel subsampling. The utility allocates sampled channel storage with a truncated union_width / xSampling, then reads the sampled input through a Slice based on the misaligned union window. ASAN reports a deterministic heap-buffer-overflow write on both OpenEXR v3.4.13 and upstream main.

This is not an API/caller-precondition-only issue. The trigger is normal public-tool processing: exrmultiview left A.exr right B.exr out.exr with crafted but valid EXR inputs. The PoC files are tiny and bounded; the observed bug is memory corruption, not memory exhaustion.

Affected and reproduced builds

Fresh local rerun result:

input_sha256
61586af45291004b9b4f759526e50e407f27420e8fac0e6293f43b66b9e1df75  /home/br0nzu/openexr/v3.4.13/report/33. OpenEXR v3.4.13 exrmultiview subsampled union heap OOB write/poc_artifacts/inputs/left_min1_xs1.exr
cf4d63afb064952cd59daeae677f57bdb7bdf9a2b067f4a942c126fa04eae4ee  /home/br0nzu/openexr/v3.4.13/report/33. OpenEXR v3.4.13 exrmultiview subsampled union heap OOB write/poc_artifacts/inputs/right_min2_xs2.exr

return_codes
v3_original rc=255
v3_asan rc=134
v3_ubsan rc=255
v3_msan rc=134
main_original rc=255
main_asan rc=134
main_ubsan rc=255
main_msan rc=134

expected
v3/main ASAN: rc 134 and AddressSanitizer heap-buffer-overflow at exrmultiview/makeMultiView.cpp:120 after Image.h allocation.
v3/main original and UBSAN: exit 255 with output-header sampling exception; the same readPixels path is silent without ASAN.
MSAN: may stop earlier on unrelated libstdc++/OpenEXR initialization or ImfMultiView string baseline noise; not used as the memory-corruption oracle.

main is still affected in this workspace:

  • main_asan rc=134 with AddressSanitizer: heap-buffer-overflow and WRITE of size 2.
  • The write occurs during makeMultiView() at sources/openexr-main/src/bin/exrmultiview/makeMultiView.cpp:120.
  • The allocation is the one-element sampled channel allocation in sources/openexr-main/src/bin/exrmultiview/Image.h:178.

Details

Root cause in v3.4.13:

  • src/bin/exrmultiview/makeMultiView.cpp:49-75 opens each input file and extends a combined Box2i d with every input dataWindow.
  • makeMultiView.cpp:77-82 stores that combined window in the internal Image and rebuilds the output channels.
  • makeMultiView.cpp:102-120 adds each input channel, inserts image.channel(...).slice() into the input FrameBuffer, and calls in.readPixels().
  • src/bin/exrmultiview/Image.h:171-176 allocates sampled channel storage as image().width() / _xSampling and image().height() / _ySampling, truncating instead of rejecting or rounding a union window that is not aligned to every sampled channel.
  • Image.h:153-166 creates a Slice with the combined union dataWindow and yStride = (w / _xSampling) * sizeof(T).
  • src/lib/OpenEXR/ImfFrameBuffer.cpp:72-88 computes the slice base from origin.x / xSampling and origin.y / ySampling.

Minimal public-input example:

  • left_min1_xs1.exr: channel R, sampling 1 1, dataWindow = (1,0)-(1,0).
  • right_min2_xs2.exr: channel R, sampling 2 1, dataWindow = (2,0)-(3,0).

Each file is valid alone: the right file's minimum x coordinate and width are multiples of 2. When combined, the union window is (1,0)-(3,0). The right view's output channel allocates floor(3 / 2) = 1 half element, but the Slice origin uses 1 / 2 = 0; reading file coordinate x=2 maps to sampled index 1, immediately past the one-element heap allocation.

Upstream main still reproduces the same issue. The refreshed local run reports main_asan rc=134 with the same heap-buffer-overflow shape at sources/openexr-main/src/bin/exrmultiview/makeMultiView.cpp:120 after allocation in Image.h:178.

PoC package contents

It contains only the public-input PoC, replay script, generator source, and selected latest full reproduction logs:

poc.zip

reproduce.sh
poc_artifacts/inputs/left_min1_xs1.exr
poc_artifacts/inputs/right_min2_xs2.exr
poc_artifacts/src/gen_exrmultiview_union.cpp
poc_artifacts/logs/summary.txt
poc_artifacts/logs/v3_asan.log
poc_artifacts/logs/main_asan.log
poc_artifacts/logs/v3_original.log
poc_artifacts/logs/main_original.log
poc_artifacts/logs/v3_ubsan.log
poc_artifacts/logs/main_ubsan.log

Reproduction

From an extracted poc.zip in this validation environment:

OPENEXR_ROOT=/home/br0nzu/openexr/v3.4.13 ./reproduce.sh

Manual public-tool reproduction:

A=poc_artifacts/inputs/left_min1_xs1.exr
B=poc_artifacts/inputs/right_min2_xs2.exr
ASAN_OPTIONS=abort_on_error=1:detect_leaks=0:symbolize=1   /home/br0nzu/openexr/v3.4.13/builds/asan/bin/exrmultiview   left "$A" right "$B" /tmp/exrmv_oob.exr

Expected result for ASAN builds: process aborts with AddressSanitizer: heap-buffer-overflow, WRITE of size 2, and makeMultiView() in the OpenEXR tool stack. Original and UBSAN builds exit later with the expected output-header exception about the misaligned right.R channel; ASAN proves that the heap write happens earlier during readPixels().

Impact

An attacker who can supply multiple EXR files to an automated exrmultiview workflow can trigger a heap out-of-bounds write before the tool rejects the output header. The demonstrated primitive is a small overwrite adjacent to sampled channel storage. In ASAN builds it is a reliable crash; in non-instrumented builds it is silent heap corruption followed by a later exception. Impact is at least availability loss for render/asset pipelines that process untrusted EXR sets, and memory corruption may have higher impact depending on allocator layout and surrounding process context.

Full output

reproduce.sh stdout

reproduce_stdout.log

input_sha256
61586af45291004b9b4f759526e50e407f27420e8fac0e6293f43b66b9e1df75  /home/br0nzu/openexr/v3.4.13/report/33. OpenEXR v3.4.13 exrmultiview subsampled union heap OOB write/poc_artifacts/inputs/left_min1_xs1.exr
cf4d63afb064952cd59daeae677f57bdb7bdf9a2b067f4a942c126fa04eae4ee  /home/br0nzu/openexr/v3.4.13/report/33. OpenEXR v3.4.13 exrmultiview subsampled union heap OOB write/poc_artifacts/inputs/right_min2_xs2.exr

return_codes
v3_original rc=255
v3_asan rc=134
v3_ubsan rc=255
v3_msan rc=134
main_original rc=255
main_asan rc=134
main_ubsan rc=255
main_msan rc=134

expected
v3/main ASAN: rc 134 and AddressSanitizer heap-buffer-overflow at exrmultiview/makeMultiView.cpp:120 after Image.h allocation.
v3/main original and UBSAN: exit 255 with output-header sampling exception; the same readPixels path is silent without ASAN.
MSAN: may stop earlier on unrelated libstdc++/OpenEXR initialization or ImfMultiView string baseline noise; not used as the memory-corruption oracle.

reproduce.sh stderr

reproduce_stderr.log

/home/br0nzu/openexr/v3.4.13/report/33. OpenEXR v3.4.13 exrmultiview subsampled union heap OOB write/reproduce.sh: line 30: 15850 Aborted                 env ASAN_OPTIONS=abort_on_error=1:detect_leaks=0:symbolize=1 timeout 20s "$bin" left "$A" right "$B" "$out" > "$LOGDIR/${label}.log" 2>&1
/home/br0nzu/openexr/v3.4.13/report/33. OpenEXR v3.4.13 exrmultiview subsampled union heap OOB write/reproduce.sh: line 30: 15859 Aborted                 env MSAN_OPTIONS=halt_on_error=1:abort_on_error=1:symbolize=1 timeout 20s "$bin" left "$A" right "$B" "$out" > "$LOGDIR/${label}.log" 2>&1
/home/br0nzu/openexr/v3.4.13/report/33. OpenEXR v3.4.13 exrmultiview subsampled union heap OOB write/reproduce.sh: line 30: 15879 Aborted                 env ASAN_OPTIONS=abort_on_error=1:detect_leaks=0:symbolize=1 timeout 20s "$bin" left "$A" right "$B" "$out" > "$LOGDIR/${label}.log" 2>&1
/home/br0nzu/openexr/v3.4.13/report/33. OpenEXR v3.4.13 exrmultiview subsampled union heap OOB write/reproduce.sh: line 30: 15886 Aborted                 env MSAN_OPTIONS=halt_on_error=1:abort_on_error=1:symbolize=1 timeout 20s "$bin" left "$A" right "$B" "$out" > "$LOGDIR/${label}.log" 2>&1

reproduction summary

reproduce_rerun/summary.txt

input_sha256
61586af45291004b9b4f759526e50e407f27420e8fac0e6293f43b66b9e1df75  /home/br0nzu/openexr/v3.4.13/report/33. OpenEXR v3.4.13 exrmultiview subsampled union heap OOB write/poc_artifacts/inputs/left_min1_xs1.exr
cf4d63afb064952cd59daeae677f57bdb7bdf9a2b067f4a942c126fa04eae4ee  /home/br0nzu/openexr/v3.4.13/report/33. OpenEXR v3.4.13 exrmultiview subsampled union heap OOB write/poc_artifacts/inputs/right_min2_xs2.exr

return_codes
v3_original rc=255
v3_asan rc=134
v3_ubsan rc=255
v3_msan rc=134
main_original rc=255
main_asan rc=134
main_ubsan rc=255
main_msan rc=134

expected
v3/main ASAN: rc 134 and AddressSanitizer heap-buffer-overflow at exrmultiview/makeMultiView.cpp:120 after Image.h allocation.
v3/main original and UBSAN: exit 255 with output-header sampling exception; the same readPixels path is silent without ASAN.
MSAN: may stop earlier on unrelated libstdc++/OpenEXR initialization or ImfMultiView string baseline noise; not used as the memory-corruption oracle.

v3.4.13 ASAN stderr/stdout

reproduce_rerun/v3_asan.log

=================================================================
==15851==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x502000000ed2 at pc 0x622641fb95f2 bp 0x7fff3c7dcd80 sp 0x7fff3c7dc548
WRITE of size 2 at 0x502000000ed2 thread T0
    #0 0x622641fb95f1 in pread64 (/home/br0nzu/openexr/v3.4.13/builds/asan/bin/exrmultiview+0x915f1) (BuildId: 9544bd117f4dc2dc889154093333b3c592884691)
    #1 0x6226421a37db in default_read_func /home/br0nzu/openexr/v3.4.13/sources/openexr-3.4.13/src/lib/OpenEXRCore/internal_posix_file_impl.h:177:14
    #2 0x62264219ffbe in dispatch_read /home/br0nzu/openexr/v3.4.13/sources/openexr-3.4.13/src/lib/OpenEXRCore/context.c:51:16
    #3 0x622642220823 in read_uncompressed_direct /home/br0nzu/openexr/v3.4.13/sources/openexr-3.4.13/src/lib/OpenEXRCore/decoding.c:131:18
    #4 0x6226422212b3 in exr_decoding_run /home/br0nzu/openexr/v3.4.13/sources/openexr-3.4.13/src/lib/OpenEXRCore/decoding.c:567:10
    #5 0x6226420dff56 in Imf_3_4::(anonymous namespace)::ScanLineProcess::run_decode(_priv_exr_context_t const*, int, Imf_3_4::FrameBuffer const*, int, int, std::vector<Imf_3_4::Slice, std::allocator<Imf_3_4::Slice>> const&) /home/br0nzu/openexr/v3.4.13/sources/openexr-3.4.13/src/lib/OpenEXR/ImfScanLineInputFile.cpp:586:23
    #6 0x6226420ddcec in Imf_3_4::ScanLineInputFile::Data::readPixels(Imf_3_4::FrameBuffer const&, int, int) /home/br0nzu/openexr/v3.4.13/sources/openexr-3.4.13/src/lib/OpenEXR/ImfScanLineInputFile.cpp:500:21
    #7 0x622642096b89 in Imf_3_4::InputFile::Data::readPixels(int, int) /home/br0nzu/openexr/v3.4.13/sources/openexr-3.4.13/src/lib/OpenEXR/ImfInputFile.cpp:458:20
    #8 0x62264207e073 in makeMultiView(std::vector<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>, std::allocator<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>>> const&, std::vector<char const*, std::allocator<char const*>> const&, char const*, Imf_3_4::Compression, bool) /home/br0nzu/openexr/v3.4.13/sources/openexr-3.4.13/src/bin/exrmultiview/makeMultiView.cpp:120:12
    #9 0x62264207b00c in main /home/br0nzu/openexr/v3.4.13/sources/openexr-3.4.13/src/bin/exrmultiview/main.cpp:206:9
    #10 0x73a9bb02a1c9 in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16
    #11 0x73a9bb02a28a in __libc_start_main csu/../csu/libc-start.c:360:3
    #12 0x622641f9b4e4 in _start (/home/br0nzu/openexr/v3.4.13/builds/asan/bin/exrmultiview+0x734e4) (BuildId: 9544bd117f4dc2dc889154093333b3c592884691)

0x502000000ed2 is located 0 bytes after 2-byte region [0x502000000ed0,0x502000000ed2)
allocated by thread T0 here:
    #0 0x622642074a71 in operator new[](unsigned long) (/home/br0nzu/openexr/v3.4.13/builds/asan/bin/exrmultiview+0x14ca71) (BuildId: 9544bd117f4dc2dc889154093333b3c592884691)
    #1 0x622642079381 in Imf_3_4::Array2D<Imath_3_2::half>::resizeEraseUnsafe(long, long) /home/br0nzu/openexr/v3.4.13/sources/openexr-3.4.13/src/lib/OpenEXR/ImfArray.h:229:14
    #2 0x622642079381 in TypedImageChannel<Imath_3_2::half>::resize() /home/br0nzu/openexr/v3.4.13/sources/openexr-3.4.13/src/bin/exrmultiview/Image.h:176:13
    #3 0x622642077702 in TypedImageChannel<Imath_3_2::half>::TypedImageChannel(Image&, int, int) /home/br0nzu/openexr/v3.4.13/sources/openexr-3.4.13/src/bin/exrmultiview/Image.h:123:5
    #4 0x622642077379 in Image::addChannel(std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>> const&, Imf_3_4::Channel const&) /home/br0nzu/openexr/v3.4.13/sources/openexr-3.4.13/src/bin/exrmultiview/Image.cpp:64:21
    #5 0x62264207de0d in makeMultiView(std::vector<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>, std::allocator<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>>> const&, std::vector<char const*, std::allocator<char const*>> const&, char const*, Imf_3_4::Compression, bool) /home/br0nzu/openexr/v3.4.13/sources/openexr-3.4.13/src/bin/exrmultiview/makeMultiView.cpp:110:19
    #6 0x62264207b00c in main /home/br0nzu/openexr/v3.4.13/sources/openexr-3.4.13/src/bin/exrmultiview/main.cpp:206:9
    #7 0x73a9bb02a1c9 in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16
    #8 0x73a9bb02a28a in __libc_start_main csu/../csu/libc-start.c:360:3
    #9 0x622641f9b4e4 in _start (/home/br0nzu/openexr/v3.4.13/builds/asan/bin/exrmultiview+0x734e4) (BuildId: 9544bd117f4dc2dc889154093333b3c592884691)

SUMMARY: AddressSanitizer: heap-buffer-overflow (/home/br0nzu/openexr/v3.4.13/builds/asan/bin/exrmultiview+0x915f1) (BuildId: 9544bd117f4dc2dc889154093333b3c592884691) in pread64
Shadow bytes around the buggy address:
  0x502000000c00: fa fa fd fd fa fa fd fd fa fa fd fd fa fa fd fd
  0x502000000c80: fa fa fd fd fa fa fd fa fa fa fd fd fa fa fd fd
  0x502000000d00: fa fa fd fd fa fa fd fd fa fa fd fd fa fa 00 00
  0x502000000d80: fa fa 00 00 fa fa 00 00 fa fa 00 00 fa fa 00 00
  0x502000000e00: fa fa 00 00 fa fa 00 00 fa fa 00 00 fa fa 00 00
=>0x502000000e80: fa fa 00 00 fa fa fd fa fa fa[02]fa fa fa 00 fa
  0x502000000f00: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x502000000f80: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x502000001000: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x502000001080: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x502000001100: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
==15851==ABORTING
timeout: the monitored command dumped core

upstream main ASAN stderr/stdout

reproduce_rerun/main_asan.log

=================================================================
==15880==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x502000000ed2 at pc 0x5f85646ae5e2 bp 0x7fffd0958820 sp 0x7fffd0957fe8
WRITE of size 2 at 0x502000000ed2 thread T0
    #0 0x5f85646ae5e1 in pread64 (/home/br0nzu/openexr/v3.4.13/builds/main_asan/bin/exrmultiview+0x915e1) (BuildId: 3b693c4684cb02cac269a3b79c611293629c7482)
    #1 0x5f856489c19b in default_read_func /home/br0nzu/openexr/v3.4.13/sources/openexr-main/src/lib/OpenEXRCore/internal_posix_file_impl.h:177:14
    #2 0x5f856489897e in dispatch_read /home/br0nzu/openexr/v3.4.13/sources/openexr-main/src/lib/OpenEXRCore/context.c:51:16
    #3 0x5f85649191e3 in read_uncompressed_direct /home/br0nzu/openexr/v3.4.13/sources/openexr-main/src/lib/OpenEXRCore/decoding.c:131:18
    #4 0x5f8564919c73 in exr_decoding_run /home/br0nzu/openexr/v3.4.13/sources/openexr-main/src/lib/OpenEXRCore/decoding.c:567:10
    #5 0x5f85647d4df6 in Imf_4_0::(anonymous namespace)::ScanLineProcess::run_decode(_priv_exr_context_t const*, int, Imf_4_0::FrameBuffer const*, int, int, std::vector<Imf_4_0::Slice, std::allocator<Imf_4_0::Slice>> const&) /home/br0nzu/openexr/v3.4.13/sources/openexr-main/src/lib/OpenEXR/ImfScanLineInputFile.cpp:586:23
    #6 0x5f85647d2bbc in Imf_4_0::ScanLineInputFile::Data::readPixels(Imf_4_0::FrameBuffer const&, int, int) /home/br0nzu/openexr/v3.4.13/sources/openexr-main/src/lib/OpenEXR/ImfScanLineInputFile.cpp:500:21
    #7 0x5f856478baf9 in Imf_4_0::InputFile::Data::readPixels(int, int) /home/br0nzu/openexr/v3.4.13/sources/openexr-main/src/lib/OpenEXR/ImfInputFile.cpp:458:20
    #8 0x5f8564773063 in makeMultiView(std::vector<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>, std::allocator<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>>> const&, std::vector<char const*, std::allocator<char const*>> const&, char const*, Imf_4_0::Compression, bool) /home/br0nzu/openexr/v3.4.13/sources/openexr-main/src/bin/exrmultiview/makeMultiView.cpp:120:12
    #9 0x5f856476fffc in main /home/br0nzu/openexr/v3.4.13/sources/openexr-main/src/bin/exrmultiview/main.cpp:206:9
    #10 0x735e6e42a1c9 in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16
    #11 0x735e6e42a28a in __libc_start_main csu/../csu/libc-start.c:360:3
    #12 0x5f85646904d4 in _start (/home/br0nzu/openexr/v3.4.13/builds/main_asan/bin/exrmultiview+0x734d4) (BuildId: 3b693c4684cb02cac269a3b79c611293629c7482)

0x502000000ed2 is located 0 bytes after 2-byte region [0x502000000ed0,0x502000000ed2)
allocated by thread T0 here:
    #0 0x5f8564769a61 in operator new[](unsigned long) (/home/br0nzu/openexr/v3.4.13/builds/main_asan/bin/exrmultiview+0x14ca61) (BuildId: 3b693c4684cb02cac269a3b79c611293629c7482)
    #1 0x5f856476e371 in Imf_4_0::Array2D<Imath_3_2::half>::resizeEraseUnsafe(long, long) /home/br0nzu/openexr/v3.4.13/sources/openexr-main/src/lib/OpenEXR/ImfArray.h:229:14
    #2 0x5f856476e371 in TypedImageChannel<Imath_3_2::half>::resize() /home/br0nzu/openexr/v3.4.13/sources/openexr-main/src/bin/exrmultiview/Image.h:178:13
    #3 0x5f856476c6f2 in TypedImageChannel<Imath_3_2::half>::TypedImageChannel(Image&, int, int) /home/br0nzu/openexr/v3.4.13/sources/openexr-main/src/bin/exrmultiview/Image.h:125:5
    #4 0x5f856476c369 in Image::addChannel(std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>> const&, Imf_4_0::Channel const&) /home/br0nzu/openexr/v3.4.13/sources/openexr-main/src/bin/exrmultiview/Image.cpp:64:21
    #5 0x5f8564772dfd in makeMultiView(std::vector<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>, std::allocator<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>>> const&, std::vector<char const*, std::allocator<char const*>> const&, char const*, Imf_4_0::Compression, bool) /home/br0nzu/openexr/v3.4.13/sources/openexr-main/src/bin/exrmultiview/makeMultiView.cpp:110:19
    #6 0x5f856476fffc in main /home/br0nzu/openexr/v3.4.13/sources/openexr-main/src/bin/exrmultiview/main.cpp:206:9
    #7 0x735e6e42a1c9 in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16
    #8 0x735e6e42a28a in __libc_start_main csu/../csu/libc-start.c:360:3
    #9 0x5f85646904d4 in _start (/home/br0nzu/openexr/v3.4.13/builds/main_asan/bin/exrmultiview+0x734d4) (BuildId: 3b693c4684cb02cac269a3b79c611293629c7482)

SUMMARY: AddressSanitizer: heap-buffer-overflow (/home/br0nzu/openexr/v3.4.13/builds/main_asan/bin/exrmultiview+0x915e1) (BuildId: 3b693c4684cb02cac269a3b79c611293629c7482) in pread64
Shadow bytes around the buggy address:
  0x502000000c00: fa fa fd fd fa fa fd fd fa fa fd fd fa fa fd fd
  0x502000000c80: fa fa fd fd fa fa fd fa fa fa fd fd fa fa fd fd
  0x502000000d00: fa fa fd fd fa fa fd fd fa fa fd fd fa fa 00 00
  0x502000000d80: fa fa 00 00 fa fa 00 00 fa fa 00 00 fa fa 00 00
  0x502000000e00: fa fa 00 00 fa fa 00 00 fa fa 00 00 fa fa 00 00
=>0x502000000e80: fa fa 00 00 fa fa fd fa fa fa[02]fa fa fa 00 fa
  0x502000000f00: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x502000000f80: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x502000001000: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x502000001080: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x502000001100: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
==15880==ABORTING
timeout: the monitored command dumped core

v3.4.13 original stderr/stdout

reproduce_rerun/v3_original.log

/home/br0nzu/openexr/v3.4.13/builds/original/bin/exrmultiview: Cannot open image file "/home/br0nzu/openexr/v3.4.13/report/33. OpenEXR v3.4.13 exrmultiview subsampled union heap OOB write/reproduce_rerun/v3_original.out.exr". The minimum x coordinate of the image's data window is not a multiple of the x subsampling factor of the "right.R" channel.

upstream main original stderr/stdout

reproduce_rerun/main_original.log

/home/br0nzu/openexr/v3.4.13/builds/main_original/bin/exrmultiview: Cannot open image file "/home/br0nzu/openexr/v3.4.13/report/33. OpenEXR v3.4.13 exrmultiview subsampled union heap OOB write/reproduce_rerun/main_original.out.exr". The minimum x coordinate of the image's data window is not a multiple of the x subsampling factor of the "right.R" channel.

v3.4.13 UBSAN stderr/stdout

reproduce_rerun/v3_ubsan.log

/home/br0nzu/openexr/v3.4.13/builds/ubsan/bin/exrmultiview: Cannot open image file "/home/br0nzu/openexr/v3.4.13/report/33. OpenEXR v3.4.13 exrmultiview subsampled union heap OOB write/reproduce_rerun/v3_ubsan.out.exr". The minimum x coordinate of the image's data window is not a multiple of the x subsampling factor of the "right.R" channel.

upstream main UBSAN stderr/stdout

reproduce_rerun/main_ubsan.log

/home/br0nzu/openexr/v3.4.13/builds/main_ubsan/bin/exrmultiview: Cannot open image file "/home/br0nzu/openexr/v3.4.13/report/33. OpenEXR v3.4.13 exrmultiview subsampled union heap OOB write/reproduce_rerun/main_ubsan.out.exr". The minimum x coordinate of the image's data window is not a multiple of the x subsampling factor of the "right.R" channel.

v3.4.13 MSAN stderr/stdout

reproduce_rerun/v3_msan.log

Uninitialized bytes in memchr at offset 0 inside [0x7fffffffcfc8, 1)
==15860==WARNING: MemorySanitizer: use-of-uninitialized-value
    #0 0x7ffff7d6aa90 in std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>::find(char, unsigned long) const (/lib/x86_64-linux-gnu/libstdc++.so.6+0x16aa90) (BuildId: 753c6c8608b61d4e67be8f0c890e03e0aa046b8b)
    #1 0x555555682636 in Imf_3_4::(anonymous namespace)::parseString(std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>, char) /home/br0nzu/openexr/v3.4.13/sources/openexr-3.4.13/src/lib/OpenEXR/ImfMultiView.cpp:35:27
    #2 0x555555683a6f in Imf_3_4::insertViewName(std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>> const&, std::vector<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>, std::allocator<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>>> const&, int) /home/br0nzu/openexr/v3.4.13/sources/openexr-3.4.13/src/lib/OpenEXR/ImfMultiView.cpp:319:22
    #3 0x55555563cab2 in makeMultiView(std::vector<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>, std::allocator<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>>> const&, std::vector<char const*, std::allocator<char const*>> const&, char const*, Imf_3_4::Compression, bool) /home/br0nzu/openexr/v3.4.13/sources/openexr-3.4.13/src/bin/exrmultiview/makeMultiView.cpp:108:34
    #4 0x55555563af6b in main /home/br0nzu/openexr/v3.4.13/sources/openexr-3.4.13/src/bin/exrmultiview/main.cpp:206:9
    #5 0x7ffff782a1c9 in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16
    #6 0x7ffff782a28a in __libc_start_main csu/../csu/libc-start.c:360:3
    #7 0x55555559d504 in _start (/home/br0nzu/openexr/v3.4.13/builds/msan/bin/exrmultiview+0x49504) (BuildId: b1250f8d0f6799345dd07625d2d8db07d33ea31b)

  Uninitialized value was created by an allocation of 'agg.tmp' in the stack frame
    #0 0x555555683a1c in Imf_3_4::insertViewName(std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>> const&, std::vector<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>, std::allocator<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>>> const&, int) /home/br0nzu/openexr/v3.4.13/sources/openexr-3.4.13/src/lib/OpenEXR/ImfMultiView.cpp:314

SUMMARY: MemorySanitizer: use-of-uninitialized-value (/lib/x86_64-linux-gnu/libstdc++.so.6+0x16aa90) (BuildId: 753c6c8608b61d4e67be8f0c890e03e0aa046b8b) in std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>::find(char, unsigned long) const
Exiting
timeout: the monitored command dumped core

upstream main MSAN stderr/stdout

reproduce_rerun/main_msan.log

==15887==WARNING: MemorySanitizer: use-of-uninitialized-value
    #0 0x56b873941f37 in std::_Rb_tree<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>, std::pair<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>> const, Imf_4_0::Compression>, std::_Select1st<std::pair<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>> const, Imf_4_0::Compression>>, std::less<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>>, std::allocator<std::pair<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>> const, Imf_4_0::Compression>>>::_M_get_insert_unique_pos(std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>> const&) /usr/bin/../lib/gcc/x86_64-linux-gnu/13/../../../../include/c++/13/bits/stl_tree.h:2115:7
    #1 0x56b8739415e3 in std::_Rb_tree<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>, std::pair<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>> const, Imf_4_0::Compression>, std::_Select1st<std::pair<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>> const, Imf_4_0::Compression>>, std::less<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>>, std::allocator<std::pair<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>> const, Imf_4_0::Compression>>>::_M_get_insert_hint_unique_pos(std::_Rb_tree_const_iterator<std::pair<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>> const, Imf_4_0::Compression>>, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>> const&) /usr/bin/../lib/gcc/x86_64-linux-gnu/13/../../../../include/c++/13/bits/stl_tree.h:2224:13
    #2 0x56b8739415e3 in std::_Rb_tree_iterator<std::pair<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>> const, Imf_4_0::Compression>> std::_Rb_tree<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>, std::pair<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>> const, Imf_4_0::Compression>, std::_Select1st<std::pair<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>> const, Imf_4_0::Compression>>, std::less<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>>, std::allocator<std::pair<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>> const, Imf_4_0::Compression>>>::_M_insert_unique_<std::pair<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>> const, Imf_4_0::Compression> const&, std::_Rb_tree<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>, std::pair<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>> const, Imf_4_0::Compression>, std::_Select1st<std::pair<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>> const, Imf_4_0::Compression>>, std::less<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>>, std::allocator<std::pair<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>> const, Imf_4_0::Compression>>>::_Alloc_node>(std::_Rb_tree_const_iterator<std::pair<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>> const, Imf_4_0::Compression>>, std::pair<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>> const, Imf_4_0::Compression> const&, std::_Rb_tree<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>, std::pair<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>> const, Imf_4_0::Compression>, std::_Select1st<std::pair<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>> const, Imf_4_0::Compression>>, std::less<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>>, std::allocator<std::pair<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>> const, Imf_4_0::Compression>>>::_Alloc_node&) /usr/bin/../lib/gcc/x86_64-linux-gnu/13/../../../../include/c++/13/bits/stl_tree.h:2281:4
    #3 0x56b8739415e3 in std::enable_if<__same_value_type<std::pair<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>> const, Imf_4_0::Compression> const*>::value, void>::type std::_Rb_tree<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>, std::pair<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>> const, Imf_4_0::Compression>, std::_Select1st<std::pair<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>> const, Imf_4_0::Compression>>, std::less<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>>, std::allocator<std::pair<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>> const, Imf_4_0::Compression>>>::_M_insert_range_unique<std::pair<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>> const, Imf_4_0::Compression> const*>(std::pair<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>> const, Imf_4_0::Compression> const*, std::pair<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>> const, Imf_4_0::Compression> const*) /usr/bin/../lib/gcc/x86_64-linux-gnu/13/../../../../include/c++/13/bits/stl_tree.h:1104:6
    #4 0x56b8739415e3 in std::map<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>, Imf_4_0::Compression, std::less<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>>, std::allocator<std::pair<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>> const, Imf_4_0::Compression>>>::map(std::initializer_list<std::pair<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>> const, Imf_4_0::Compression>>, std::less<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>> const&, std::allocator<std::pair<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>> const, Imf_4_0::Compression>> const&) /usr/bin/../lib/gcc/x86_64-linux-gnu/13/../../../../include/c++/13/bits/stl_map.h:244:14
    #5 0x56b873893728 in __cxx_global_var_init.24 /home/br0nzu/openexr/v3.4.13/sources/openexr-main/src/lib/OpenEXR/ImfCompression.cpp:195:71
    #6 0x56b873893728 in _GLOBAL__sub_I_ImfCompression.cpp /home/br0nzu/openexr/v3.4.13/sources/openexr-main/src/lib/OpenEXR/ImfCompression.cpp
    #7 0x7b604d02a303 in call_init csu/../csu/libc-start.c:145:3
    #8 0x7b604d02a303 in __libc_start_main csu/../csu/libc-start.c:347:5
    #9 0x56b873895f04 in _start (/home/br0nzu/openexr/v3.4.13/builds/main_msan/bin/exrmultiview+0x49f04) (BuildId: f3afe2f32e811fffb61be78c7257c85b21dad8d6)

  Uninitialized value was created by a heap allocation
    #0 0x56b87392ee70 in operator new(unsigned long) (/home/br0nzu/openexr/v3.4.13/builds/main_msan/bin/exrmultiview+0xe2e70) (BuildId: f3afe2f32e811fffb61be78c7257c85b21dad8d6)
    #1 0x56b873941c04 in std::__new_allocator<std::_Rb_tree_node<std::pair<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>> const, Imf_4_0::Compression>>>::allocate(unsigned long, void const*) /usr/bin/../lib/gcc/x86_64-linux-gnu/13/../../../../include/c++/13/bits/new_allocator.h:151:27
    #2 0x56b873941c04 in std::allocator_traits<std::allocator<std::_Rb_tree_node<std::pair<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>> const, Imf_4_0::Compression>>>>::allocate(std::allocator<std::_Rb_tree_node<std::pair<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>> const, Imf_4_0::Compression>>>&, unsigned long) /usr/bin/../lib/gcc/x86_64-linux-gnu/13/../../../../include/c++/13/bits/alloc_traits.h:482:20
    #3 0x56b873941c04 in std::_Rb_tree<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>, std::pair<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>> const, Imf_4_0::Compression>, std::_Select1st<std::pair<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>> const, Imf_4_0::Compression>>, std::less<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>>, std::allocator<std::pair<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>> const, Imf_4_0::Compression>>>::_M_get_node() /usr/bin/../lib/gcc/x86_64-linux-gnu/13/../../../../include/c++/13/bits/stl_tree.h:563:16
    #4 0x56b873941c04 in std::_Rb_tree_node<std::pair<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>> const, Imf_4_0::Compression>>* std::_Rb_tree<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>, std::pair<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>> const, Imf_4_0::Compression>, std::_Select1st<std::pair<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>> const, Imf_4_0::Compression>>, std::less<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>>, std::allocator<std::pair<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>> const, Imf_4_0::Compression>>>::_M_create_node<std::pair<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>> const, Imf_4_0::Compression> const&>(std::pair<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>> const, Imf_4_0::Compression> const&) /usr/bin/../lib/gcc/x86_64-linux-gnu/13/../../../../include/c++/13/bits/stl_tree.h:613:23
    #5 0x56b873941c04 in std::_Rb_tree_node<std::pair<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>> const, Imf_4_0::Compression>>* std::_Rb_tree<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>, std::pair<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>> const, Imf_4_0::Compression>, std::_Select1st<std::pair<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>> const, Imf_4_0::Compression>>, std::less<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>>, std::allocator<std::pair<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>> const, Imf_4_0::Compression>>>::_Alloc_node::operator()<std::pair<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>> const, Imf_4_0::Compression> const&>(std::pair<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>> const, Imf_4_0::Compression> const&) const /usr/bin/../lib/gcc/x86_64-linux-gnu/13/../../../../include/c++/13/bits/stl_tree.h:531:18
    #6 0x56b873941c04 in std::_Rb_tree_iterator<std::pair<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>> const, Imf_4_0::Compression>> std::_Rb_tree<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>, std::pair<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>> const, Imf_4_0::Compression>, std::_Select1st<std::pair<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>> const, Imf_4_0::Compression>>, std::less<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>>, std::allocator<std::pair<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>> const, Imf_4_0::Compression>>>::_M_insert_<std::pair<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>> const, Imf_4_0::Compression> const&, std::_Rb_tree<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>, std::pair<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>> const, Imf_4_0::Compression>, std::_Select1st<std::pair<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>> const, Imf_4_0::Compression>>, std::less<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>>, std::allocator<std::pair<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>> const, Imf_4_0::Compression>>>::_Alloc_node>(std::_Rb_tree_node_base*, std::_Rb_tree_node_base*, std::pair<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>> const, Imf_4_0::Compression> const&, std::_Rb_tree<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>, std::pair<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>> const, Imf_4_0::Compression>, std::_Select1st<std::pair<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>> const, Imf_4_0::Compression>>, std::less<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>>, std::allocator<std::pair<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>> const, Imf_4_0::Compression>>>::_Alloc_node&) /usr/bin/../lib/gcc/x86_64-linux-gnu/13/../../../../include/c++/13/bits/stl_tree.h:1831:19
    #7 0x56b87394164d in std::_Rb_tree_iterator<std::pair<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>> const, Imf_4_0::Compression>> std::_Rb_tree<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>, std::pair<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>> const, Imf_4_0::Compression>, std::_Select1st<std::pair<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>> const, Imf_4_0::Compression>>, std::less<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>>, std::allocator<std::pair<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>> const, Imf_4_0::Compression>>>::_M_insert_unique_<std::pair<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>> const, Imf_4_0::Compression> const&, std::_Rb_tree<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>, std::pair<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>> const, Imf_4_0::Compression>, std::_Select1st<std::pair<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>> const, Imf_4_0::Compression>>, std::less<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>>, std::allocator<std::pair<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>> const, Imf_4_0::Compression>>>::_Alloc_node>(std::_Rb_tree_const_iterator<std::pair<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>> const, Imf_4_0::Compression>>, std::pair<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>> const, Imf_4_0::Compression> const&, std::_Rb_tree<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>, std::pair<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>> const, Imf_4_0::Compression>, std::_Select1st<std::pair<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>> const, Imf_4_0::Compression>>, std::less<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>>, std::allocator<std::pair<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>> const, Imf_4_0::Compression>>>::_Alloc_node&) /usr/bin/../lib/gcc/x86_64-linux-gnu/13/../../../../include/c++/13/bits/stl_tree.h:2284:9
    #8 0x56b87394164d in std::enable_if<__same_value_type<std::pair<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>> const, Imf_4_0::Compression> const*>::value, void>::type std::_Rb_tree<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>, std::pair<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>> const, Imf_4_0::Compression>, std::_Select1st<std::pair<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>> const, Imf_4_0::Compression>>, std::less<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>>, std::allocator<std::pair<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>> const, Imf_4_0::Compression>>>::_M_insert_range_unique<std::pair<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>> const, Imf_4_0::Compression> const*>(std::pair<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>> const, Imf_4_0::Compression> const*, std::pair<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>> const, Imf_4_0::Compression> const*) /usr/bin/../lib/gcc/x86_64-linux-gnu/13/../../../../include/c++/13/bits/stl_tree.h:1104:6
    #9 0x56b87394164d in std::map<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>, Imf_4_0::Compression, std::less<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>>, std::allocator<std::pair<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>> const, Imf_4_0::Compression>>>::map(std::initializer_list<std::pair<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>> const, Imf_4_0::Compression>>, std::less<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>> const&, std::allocator<std::pair<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>> const, Imf_4_0::Compression>> const&) /usr/bin/../lib/gcc/x86_64-linux-gnu/13/../../../../include/c++/13/bits/stl_map.h:244:14
    #10 0x56b873893728 in __cxx_global_var_init.24 /home/br0nzu/openexr/v3.4.13/sources/openexr-main/src/lib/OpenEXR/ImfCompression.cpp:195:71
    #11 0x56b873893728 in _GLOBAL__sub_I_ImfCompression.cpp /home/br0nzu/openexr/v3.4.13/sources/openexr-main/src/lib/OpenEXR/ImfCompression.cpp
    #12 0x7b604d02a303 in call_init csu/../csu/libc-start.c:145:3
    #13 0x7b604d02a303 in __libc_start_main csu/../csu/libc-start.c:347:5
    #14 0x56b873895f04 in _start (/home/br0nzu/openexr/v3.4.13/builds/main_msan/bin/exrmultiview+0x49f04) (BuildId: f3afe2f32e811fffb61be78c7257c85b21dad8d6)

SUMMARY: MemorySanitizer: use-of-uninitialized-value /home/br0nzu/openexr/v3.4.13/sources/openexr-main/src/lib/OpenEXR/ImfCompression.cpp:195:71 in __cxx_global_var_init.24
Exiting
timeout: the monitored command dumped core

Updates

2026-08-11 03:50 CEST

Metadata changes:

  • Status for package openexr: “Plausible”

2026-08-11 03:32 CEST

Metadata changes:

  • Status for package openexr: “New”