Skip to content

GHSA-994f-rr2m-9r7x on CTRL-OS 26.05

Aliases: GHSA-994f-rr2m-9r7x

Packages: openexr

Status: Plausible

Advisory Information

Summary

A crafted deep EXR file can trigger a heap-buffer-overflow in the OpenEXR Python binding. OpenEXR.File(path) defaults to RGB/RGBA channel coalescing (separate_channels=False), but PyOpenEXR.cpp does not enforce that all coalesced RGB(A) channels have the same pixel type. A public deep scanline EXR with B=HALF, G=FLOAT, R=FLOAT, and at least two deep samples causes the wrapper to allocate a half-sized NumPy RGB sample array and then register FLOAT deep slices into it. Decoding writes past the allocated Python heap buffer.

This is reproducible on OpenEXR v3.4.13 and upstream main. ASAN reports a heap-buffer-overflow WRITE of size 4; non-sanitized original builds crash with a slightly larger variant.

Details

This issue is reached by opening a standalone attacker-controlled .exr through the public Python API (OpenEXR.File(path)), so it is a product-input vulnerability rather than an internal API/caller-precondition issue.

Broken invariant:

If PyOpenEXR coalesces R, G, B, or A channels into one Python RGB/RGBA channel, all grouped file channels must have the same PixelType, or the allocated coalesced sample buffer and each registered DeepSlice must be sized independently.

In v3.4.13, sources/openexr-3.4.13/src/wrappers/python/PyOpenEXR.cpp:196-223 classifies channels by name and, with the default separate_channels=false, groups RGB(A) channels into a single Python channel before calling readDeepPixels() for deep inputs.

Inside readDeepPixels(), the first channel encountered for a coalesced RGB group creates the PyChannel and fixes its storage type:

  • PyOpenEXR.cpp:539-553: C._type = c.channel().type; C._nrgba = nrgba;
  • PyOpenEXR.cpp:561-595: each actual file channel still receives a DeepSlice(c.channel().type, ...), and sampleStride is computed from the actual channel type multiplied by nrgba.

setDeepSliceData() then allocates the Python/NumPy deep sample arrays only once using C._type:

  • PyOpenEXR.cpp:364-410: PyChannel::createDeepPixelArrays() creates a NumPy array with shape (sampleCount, C._nrgba) and element type derived from C._type.
  • PyOpenEXR.cpp:414-490: slice pointers for each real channel are placed inside that one coalesced allocation.

The PoC uses a lexicographically ordered channel list where B is first and has type HALF, while G and R are FLOAT. For two samples, PyOpenEXR allocates a half array of 2 * 3 * 2 = 12 bytes for RGB, but it registers the G and R deep slices as FLOAT channels with sampleStride = 4 * 3 = 12. When OpenEXRCore unpacks the second float sample, it performs a 4-byte store past the half-sized allocation at sources/openexr-3.4.13/src/lib/OpenEXRCore/unpack.c:1425.

Upstream main still has the same reachable pattern: allocation at sources/openexr-main/src/wrappers/python/PyOpenEXR.cpp:588-625, deep slice setup at :638-670, read at :718-836, and the same OpenEXRCore store at sources/openexr-main/src/lib/OpenEXRCore/unpack.c:1425.

PoC package contents

poc.zip is intentionally minimal. It contains only the PoC EXRs, replay/build scripts, the small Python harness, the generator source, and full selected validation logs:

poc.zip

poc_materials/reproduce.sh
poc_materials/build_pyopenexr_variants.sh
poc_materials/repro_read.py
poc_materials/gen_deep_mixed_rgb.cpp
poc_materials/CMakeLists.generator.txt
poc_materials/deep_mixed_rgb_bhalf_gfloat_rfloat_1x1_2samp.exr
poc_materials/deep_mixed_rgb_bhalf_gfloat_rfloat_1x1_4samp.exr
poc_materials/logs/repro_v3413_asan_2samp.err
poc_materials/logs/repro_v3413_asan_2samp.out
poc_materials/logs/repro_v3413_asan_2samp.rc
poc_materials/logs/repro_v3413_ubsan_2samp.err
poc_materials/logs/repro_v3413_ubsan_2samp.out
poc_materials/logs/repro_v3413_ubsan_2samp.rc
poc_materials/logs/repro_v3413_original_4samp.err
poc_materials/logs/repro_v3413_original_4samp.out
poc_materials/logs/repro_v3413_original_4samp.rc
poc_materials/logs/repro_main_asan_2samp.err
poc_materials/logs/repro_main_asan_2samp.out
poc_materials/logs/repro_main_asan_2samp.rc
poc_materials/logs/repro_main_original_4samp.err
poc_materials/logs/repro_main_original_4samp.out
poc_materials/logs/repro_main_original_4samp.rc
poc_materials/logs/v3413_msan_blocked.err
poc_materials/logs/v3413_msan_blocked.rc

Reproduction

From the repository root after building the Python variants:

REPORT='report/37. OpenEXR v3.4.13 PyOpenEXR deep mixed RGB heap buffer overflow'
$REPORT/poc_materials/build_pyopenexr_variants.sh
$REPORT/poc_materials/reproduce.sh

Expected key results:

v3.4.13 ASAN 2-sample PoC -> rc=134, AddressSanitizer heap-buffer-overflow, WRITE of size 4, OpenEXRCore/unpack.c:1425
v3.4.13 UBSAN 2-sample PoC -> rc=134, runtime error at OpenEXRCore/unpack.c:1425
v3.4.13 original 4-sample PoC -> rc=134, double free or corruption
upstream main ASAN 2-sample PoC -> rc=134, AddressSanitizer heap-buffer-overflow, WRITE of size 4, OpenEXRCore/unpack.c:1425
upstream main original 4-sample PoC -> rc=134, double free or corruption

Impact

This is a heap-buffer-overflow / memory corruption issue in the OpenEXR Python binding. Any application or pipeline that uses the OpenEXR Python package to open untrusted deep EXR files with the default OpenEXR.File(path) behavior can be crashed, and the out-of-bounds write occurs in a Python/NumPy heap allocation with attacker-controlled channel layout and sample count.

A robust fix should reject RGB/RGBA coalescing for mixed per-channel pixel types, or allocate/register deep slices per actual file channel type instead of assuming a single PyChannel::_type for the entire coalesced group.

Full output

v3.4.13 ASAN 2-sample stderr

=================================================================
==438108==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x502000016f7e at pc 0x7a26d42b62ac bp 0x7fff259e2f50 sp 0x7fff259e2f48
WRITE of size 4 at 0x502000016f7e thread T0
    #0 0x7a26d42b62ab in generic_unpack_deep_pointers /home/br0nzu/openexr/v3.4.13/sources/openexr-3.4.13/src/lib/OpenEXRCore/unpack.c:1425:37
    #1 0x7a26d42accaf in exr_decoding_run /home/br0nzu/openexr/v3.4.13/sources/openexr-3.4.13/src/lib/OpenEXRCore/decoding.c:664:18
    #2 0x7a26d46ac362 in Imf_3_4::(anonymous namespace)::ScanLineProcess::run_decode(_priv_exr_context_t const*, int, Imf_3_4::DeepFrameBuffer const*, int, int, std::vector<Imf_3_4::DeepSlice, std::allocator<Imf_3_4::DeepSlice>> const&) /home/br0nzu/openexr/v3.4.13/sources/openexr-3.4.13/src/lib/OpenEXR/ImfDeepScanLineInputFile.cpp:831:23
    #3 0x7a26d46a90e9 in Imf_3_4::DeepScanLineInputFile::Data::readData(Imf_3_4::DeepFrameBuffer const&, int, int, bool) /home/br0nzu/openexr/v3.4.13/sources/openexr-3.4.13/src/lib/OpenEXR/ImfDeepScanLineInputFile.cpp:568:20
    #4 0x7a26d48b7e2c in (anonymous namespace)::PyPart::readDeepPixels(Imf_3_4::MultiPartInputFile&, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>> const&, Imf_3_4::ChannelList const&, std::vector<unsigned long, std::allocator<unsigned long>> const&, std::set<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>, std::less<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>>, std::allocator<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>>> const&, Imath_3_1::Box<Imath_3_1::Vec2<int>> const&, bool) /home/br0nzu/openexr/v3.4.13/sources/openexr-3.4.13/src/wrappers/python/PyOpenEXR.cpp:612:18
    #5 0x7a26d48b7e2c in (anonymous namespace)::PyFile::PyFile(std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>> const&, bool, bool) /home/br0nzu/openexr/v3.4.13/sources/openexr-3.4.13/src/wrappers/python/PyOpenEXR.cpp:223:23
    #6 0x7a26d48b0450 in (anonymous namespace)::PyFile* pybind11::detail::initimpl::construct_or_initialize<(anonymous namespace)::PyFile, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>, bool, bool, 0>(std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>&&, bool&&, bool&&) /usr/include/pybind11/detail/init.h:76:16
    #7 0x7a26d48b0450 in void pybind11::detail::initimpl::constructor<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>, bool, bool>::execute<pybind11::class_<(anonymous namespace)::PyFile>, pybind11::arg, pybind11::arg_v, pybind11::arg_v, char [548], 0>(pybind11::class_<(anonymous namespace)::PyFile>&, pybind11::arg const&, pybind11::arg_v const&, pybind11::arg_v const&, char const (&) [548])::'lambda'(pybind11::detail::value_and_holder&, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>, bool, bool)::operator()(pybind11::detail::value_and_holder&, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>, bool, bool) const /usr/include/pybind11/detail/init.h:206:35
    #8 0x7a26d48b0450 in pybind11::class_<(anonymous namespace)::PyFile> pybind11::detail::argument_loader<pybind11::detail::value_and_holder&, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>, bool, bool>::call_impl<void, void pybind11::detail::initimpl::constructor<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>, bool, bool>::execute<pybind11::class_<(anonymous namespace)::PyFile>, pybind11::arg, pybind11::arg_v, pybind11::arg_v, char [548], 0>(pybind11::class_<(anonymous namespace)::PyFile>&, pybind11::arg const&, pybind11::arg_v const&, pybind11::arg_v const&, char const (&) [548])::'lambda'(pybind11::detail::value_and_holder&, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>, bool, bool)&, 0ul, 1ul, 2ul, 3ul, pybind11::detail::void_type>(void pybind11::detail::initimpl::constructor<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>, bool, bool>::execute<pybind11::class_<(anonymous namespace)::PyFile>, pybind11::arg, pybind11::arg_v, pybind11::arg_v, char [548], 0>(pybind11::class_<(anonymous namespace)::PyFile>&, pybind11::arg const&, pybind11::arg_v const&, pybind11::arg_v const&, char const (&) [548])::'lambda'(pybind11::detail::value_and_holder&, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>, bool, bool)&, std::integer_sequence<unsigned long, 0ul, 1ul, 2ul, 3ul>, pybind11::detail::void_type&&) && /usr/include/pybind11/detail/../cast.h:1480:16
    #9 0x7a26d48b0450 in std::enable_if<std::is_void<pybind11::class_<(anonymous namespace)::PyFile>>::value, pybind11::detail::void_type>::type pybind11::detail::argument_loader<pybind11::detail::value_and_holder&, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>, bool, bool>::call<void, pybind11::detail::void_type, void pybind11::detail::initimpl::constructor<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>, bool, bool>::execute<pybind11::class_<(anonymous namespace)::PyFile>, pybind11::arg, pybind11::arg_v, pybind11::arg_v, char [548], 0>(pybind11::class_<(anonymous namespace)::PyFile>&, pybind11::arg const&, pybind11::arg_v const&, pybind11::arg_v const&, char const (&) [548])::'lambda'(pybind11::detail::value_and_holder&, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>, bool, bool)&>(void pybind11::detail::initimpl::constructor<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>, bool, bool>::execute<pybind11::class_<(anonymous namespace)::PyFile>, pybind11::arg, pybind11::arg_v, pybind11::arg_v, char [548], 0>(pybind11::class_<(anonymous namespace)::PyFile>&, pybind11::arg const&, pybind11::arg_v const&, pybind11::arg_v const&, char const (&) [548])::'lambda'(pybind11::detail::value_and_holder&, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>, bool, bool)&) && /usr/include/pybind11/detail/../cast.h:1454:35
    #10 0x7a26d48b005d in void pybind11::cpp_function::initialize<void pybind11::detail::initimpl::constructor<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>, bool, bool>::execute<pybind11::class_<(anonymous namespace)::PyFile>, pybind11::arg, pybind11::arg_v, pybind11::arg_v, char [548], 0>(pybind11::class_<(anonymous namespace)::PyFile>&, pybind11::arg const&, pybind11::arg_v const&, pybind11::arg_v const&, char const (&) [548])::'lambda'(pybind11::detail::value_and_holder&, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>, bool, bool), void, pybind11::detail::value_and_holder&, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>, bool, bool, pybind11::name, pybind11::is_method, pybind11::sibling, pybind11::detail::is_new_style_constructor, pybind11::arg, pybind11::arg_v, pybind11::arg_v, char [548]>(pybind11::class_<(anonymous namespace)::PyFile>&&, void (*)(pybind11::detail::value_and_holder&, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>, bool, bool), pybind11::name const&, pybind11::is_method const&, pybind11::sibling const&, pybind11::detail::is_new_style_constructor const&, pybind11::arg const&, pybind11::arg_v const&, pybind11::arg_v const&, char const (&) [548])::'lambda'(pybind11::detail::function_call&)::operator()(pybind11::detail::function_call&) const /usr/include/pybind11/pybind11.h:254:56
    #11 0x7a26d48b005d in void pybind11::cpp_function::initialize<void pybind11::detail::initimpl::constructor<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>, bool, bool>::execute<pybind11::class_<(anonymous namespace)::PyFile>, pybind11::arg, pybind11::arg_v, pybind11::arg_v, char [548], 0>(pybind11::class_<(anonymous namespace)::PyFile>&, pybind11::arg const&, pybind11::arg_v const&, pybind11::arg_v const&, char const (&) [548])::'lambda'(pybind11::detail::value_and_holder&, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>, bool, bool), void, pybind11::detail::value_and_holder&, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>, bool, bool, pybind11::name, pybind11::is_method, pybind11::sibling, pybind11::detail::is_new_style_constructor, pybind11::arg, pybind11::arg_v, pybind11::arg_v, char [548]>(pybind11::class_<(anonymous namespace)::PyFile>&&, void (*)(pybind11::detail::value_and_holder&, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>, bool, bool), pybind11::name const&, pybind11::is_method const&, pybind11::sibling const&, pybind11::detail::is_new_style_constructor const&, pybind11::arg const&, pybind11::arg_v const&, pybind11::arg_v const&, char const (&) [548])::'lambda'(pybind11::detail::function_call&)::__invoke(pybind11::detail::function_call&) /usr/include/pybind11/pybind11.h:224:21
    #12 0x7a26d48f599e in pybind11::cpp_function::dispatcher(_object*, _object*, _object*) /usr/include/pybind11/pybind11.h:946:30
    #13 0x5821ee  (/usr/bin/python3.12+0x5821ee) (BuildId: 7aa38bef4bcd63064ecbd05a66f6120026526b74)
    #14 0x5492b4 in _PyObject_MakeTpCall (/usr/bin/python3.12+0x5492b4) (BuildId: 7aa38bef4bcd63064ecbd05a66f6120026526b74)
    #15 0x54cfc6  (/usr/bin/python3.12+0x54cfc6) (BuildId: 7aa38bef4bcd63064ecbd05a66f6120026526b74)
    #16 0x59e300  (/usr/bin/python3.12+0x59e300) (BuildId: 7aa38bef4bcd63064ecbd05a66f6120026526b74)
    #17 0x599c52  (/usr/bin/python3.12+0x599c52) (BuildId: 7aa38bef4bcd63064ecbd05a66f6120026526b74)
    #18 0x7a26d48e8357 in pybind11_meta_call /usr/include/pybind11/detail/class.h:187:22
    #19 0x5492b4 in _PyObject_MakeTpCall (/usr/bin/python3.12+0x5492b4) (BuildId: 7aa38bef4bcd63064ecbd05a66f6120026526b74)
    #20 0x5d7388 in _PyEval_EvalFrameDefault (/usr/bin/python3.12+0x5d7388) (BuildId: 7aa38bef4bcd63064ecbd05a66f6120026526b74)
    #21 0x5d58ba in PyEval_EvalCode (/usr/bin/python3.12+0x5d58ba) (BuildId: 7aa38bef4bcd63064ecbd05a66f6120026526b74)
    #22 0x608b51  (/usr/bin/python3.12+0x608b51) (BuildId: 7aa38bef4bcd63064ecbd05a66f6120026526b74)
    #23 0x6b5262  (/usr/bin/python3.12+0x6b5262) (BuildId: 7aa38bef4bcd63064ecbd05a66f6120026526b74)
    #24 0x6b4fc9 in _PyRun_SimpleFileObject (/usr/bin/python3.12+0x6b4fc9) (BuildId: 7aa38bef4bcd63064ecbd05a66f6120026526b74)
    #25 0x6b4dfe in _PyRun_AnyFileObject (/usr/bin/python3.12+0x6b4dfe) (BuildId: 7aa38bef4bcd63064ecbd05a66f6120026526b74)
    #26 0x6bce64 in Py_RunMain (/usr/bin/python3.12+0x6bce64) (BuildId: 7aa38bef4bcd63064ecbd05a66f6120026526b74)
    #27 0x6bc94c in Py_BytesMain (/usr/bin/python3.12+0x6bc94c) (BuildId: 7aa38bef4bcd63064ecbd05a66f6120026526b74)
    #28 0x7a26d782a1c9 in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16
    #29 0x7a26d782a28a in __libc_start_main csu/../csu/libc-start.c:360:3
    #30 0x657b04 in _start (/usr/bin/python3.12+0x657b04) (BuildId: 7aa38bef4bcd63064ecbd05a66f6120026526b74)

0x502000016f7e is located 2 bytes after 12-byte region [0x502000016f70,0x502000016f7c)
allocated by thread T0 here:
    #0 0x7a26d7cf87a3 in malloc (/usr/lib/llvm-18/lib/clang/18/lib/linux/libclang_rt.asan-x86_64.so+0xf87a3) (BuildId: bf9e3747052c46cd49f7974555b1700dce30b8c0)
    #1 0x7a26d3ccc65a  (/usr/lib/python3/dist-packages/numpy/core/_multiarray_umath.cpython-312-x86_64-linux-gnu.so+0xcc65a) (BuildId: 4e90c45f411fba3236c21490996071d3467336f7)
    #2 0x7a26d3ce4b02  (/usr/lib/python3/dist-packages/numpy/core/_multiarray_umath.cpython-312-x86_64-linux-gnu.so+0xe4b02) (BuildId: 4e90c45f411fba3236c21490996071d3467336f7)
    #3 0x7a26d3ce4ee1  (/usr/lib/python3/dist-packages/numpy/core/_multiarray_umath.cpython-312-x86_64-linux-gnu.so+0xe4ee1) (BuildId: 4e90c45f411fba3236c21490996071d3467336f7)
    #4 0x7a26d496e1d7 in pybind11::array::array(pybind11::dtype const&, pybind11::detail::any_container<long>, pybind11::detail::any_container<long>, void const*, pybind11::handle) /usr/include/pybind11/numpy.h:729:46
    #5 0x7a26d4981545 in pybind11::array::array<Imath_3_1::half>(pybind11::detail::any_container<long>, pybind11::detail::any_container<long>, Imath_3_1::half const*, pybind11::handle) /usr/include/pybind11/numpy.h:767:11
    #6 0x7a26d4983c76 in pybind11::array_t<Imath_3_1::half, 16>::array_t(pybind11::array_t<Imath_3_1::half, 16>::private_ctor, pybind11::detail::any_container<long>&&, pybind11::detail::any_container<long>&&, Imath_3_1::half const*, pybind11::handle) /usr/include/pybind11/numpy.h:1029:11
    #7 0x7a26d49834e7 in pybind11::array_t<Imath_3_1::half, 16>::array_t(pybind11::detail::any_container<long>, Imath_3_1::half const*, pybind11::handle) /usr/include/pybind11/numpy.h:1066:11
    #8 0x7a26d48be636 in (anonymous namespace)::PyChannel::createDeepPixelArrays(unsigned long, unsigned long, Imf_3_4::Array2D<unsigned int> const&) /home/br0nzu/openexr/v3.4.13/sources/openexr-3.4.13/src/wrappers/python/PyOpenEXR.cpp:401:42
    #9 0x7a26d48be636 in (anonymous namespace)::PyPart::setDeepSliceData(Imf_3_4::ChannelList const&, unsigned long, unsigned long, std::map<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>, std::unique_ptr<Imf_3_4::Array2D<void*>, std::default_delete<Imf_3_4::Array2D<void*>>>, std::less<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>>, std::allocator<std::pair<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>> const, std::unique_ptr<Imf_3_4::Array2D<void*>, std::default_delete<Imf_3_4::Array2D<void*>>>>>>&, std::map<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>, (anonymous namespace)::PyChannel*, std::less<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>>, std::allocator<std::pair<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>> const, (anonymous namespace)::PyChannel*>>>&, Imf_3_4::Array2D<unsigned int> const&) /home/br0nzu/openexr/v3.4.13/sources/openexr-3.4.13/src/wrappers/python/PyOpenEXR.cpp:431:11
    #10 0x7a26d48b7dd0 in (anonymous namespace)::PyPart::readDeepPixels(Imf_3_4::MultiPartInputFile&, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>> const&, Imf_3_4::ChannelList const&, std::vector<unsigned long, std::allocator<unsigned long>> const&, std::set<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>, std::less<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>>, std::allocator<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>>> const&, Imath_3_1::Box<Imath_3_1::Vec2<int>> const&, bool) /home/br0nzu/openexr/v3.4.13/sources/openexr-3.4.13/src/wrappers/python/PyOpenEXR.cpp:608:9
    #11 0x7a26d48b7dd0 in (anonymous namespace)::PyFile::PyFile(std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>> const&, bool, bool) /home/br0nzu/openexr/v3.4.13/sources/openexr-3.4.13/src/wrappers/python/PyOpenEXR.cpp:223:23
    #12 0x7a26d48b0450 in (anonymous namespace)::PyFile* pybind11::detail::initimpl::construct_or_initialize<(anonymous namespace)::PyFile, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>, bool, bool, 0>(std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>&&, bool&&, bool&&) /usr/include/pybind11/detail/init.h:76:16
    #13 0x7a26d48b0450 in void pybind11::detail::initimpl::constructor<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>, bool, bool>::execute<pybind11::class_<(anonymous namespace)::PyFile>, pybind11::arg, pybind11::arg_v, pybind11::arg_v, char [548], 0>(pybind11::class_<(anonymous namespace)::PyFile>&, pybind11::arg const&, pybind11::arg_v const&, pybind11::arg_v const&, char const (&) [548])::'lambda'(pybind11::detail::value_and_holder&, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>, bool, bool)::operator()(pybind11::detail::value_and_holder&, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>, bool, bool) const /usr/include/pybind11/detail/init.h:206:35
    #14 0x7a26d48b0450 in pybind11::class_<(anonymous namespace)::PyFile> pybind11::detail::argument_loader<pybind11::detail::value_and_holder&, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>, bool, bool>::call_impl<void, void pybind11::detail::initimpl::constructor<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>, bool, bool>::execute<pybind11::class_<(anonymous namespace)::PyFile>, pybind11::arg, pybind11::arg_v, pybind11::arg_v, char [548], 0>(pybind11::class_<(anonymous namespace)::PyFile>&, pybind11::arg const&, pybind11::arg_v const&, pybind11::arg_v const&, char const (&) [548])::'lambda'(pybind11::detail::value_and_holder&, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>, bool, bool)&, 0ul, 1ul, 2ul, 3ul, pybind11::detail::void_type>(void pybind11::detail::initimpl::constructor<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>, bool, bool>::execute<pybind11::class_<(anonymous namespace)::PyFile>, pybind11::arg, pybind11::arg_v, pybind11::arg_v, char [548], 0>(pybind11::class_<(anonymous namespace)::PyFile>&, pybind11::arg const&, pybind11::arg_v const&, pybind11::arg_v const&, char const (&) [548])::'lambda'(pybind11::detail::value_and_holder&, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>, bool, bool)&, std::integer_sequence<unsigned long, 0ul, 1ul, 2ul, 3ul>, pybind11::detail::void_type&&) && /usr/include/pybind11/detail/../cast.h:1480:16
    #15 0x7a26d48b0450 in std::enable_if<std::is_void<pybind11::class_<(anonymous namespace)::PyFile>>::value, pybind11::detail::void_type>::type pybind11::detail::argument_loader<pybind11::detail::value_and_holder&, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>, bool, bool>::call<void, pybind11::detail::void_type, void pybind11::detail::initimpl::constructor<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>, bool, bool>::execute<pybind11::class_<(anonymous namespace)::PyFile>, pybind11::arg, pybind11::arg_v, pybind11::arg_v, char [548], 0>(pybind11::class_<(anonymous namespace)::PyFile>&, pybind11::arg const&, pybind11::arg_v const&, pybind11::arg_v const&, char const (&) [548])::'lambda'(pybind11::detail::value_and_holder&, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>, bool, bool)&>(void pybind11::detail::initimpl::constructor<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>, bool, bool>::execute<pybind11::class_<(anonymous namespace)::PyFile>, pybind11::arg, pybind11::arg_v, pybind11::arg_v, char [548], 0>(pybind11::class_<(anonymous namespace)::PyFile>&, pybind11::arg const&, pybind11::arg_v const&, pybind11::arg_v const&, char const (&) [548])::'lambda'(pybind11::detail::value_and_holder&, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>, bool, bool)&) && /usr/include/pybind11/detail/../cast.h:1454:35
    #16 0x7a26d48b005d in void pybind11::cpp_function::initialize<void pybind11::detail::initimpl::constructor<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>, bool, bool>::execute<pybind11::class_<(anonymous namespace)::PyFile>, pybind11::arg, pybind11::arg_v, pybind11::arg_v, char [548], 0>(pybind11::class_<(anonymous namespace)::PyFile>&, pybind11::arg const&, pybind11::arg_v const&, pybind11::arg_v const&, char const (&) [548])::'lambda'(pybind11::detail::value_and_holder&, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>, bool, bool), void, pybind11::detail::value_and_holder&, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>, bool, bool, pybind11::name, pybind11::is_method, pybind11::sibling, pybind11::detail::is_new_style_constructor, pybind11::arg, pybind11::arg_v, pybind11::arg_v, char [548]>(pybind11::class_<(anonymous namespace)::PyFile>&&, void (*)(pybind11::detail::value_and_holder&, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>, bool, bool), pybind11::name const&, pybind11::is_method const&, pybind11::sibling const&, pybind11::detail::is_new_style_constructor const&, pybind11::arg const&, pybind11::arg_v const&, pybind11::arg_v const&, char const (&) [548])::'lambda'(pybind11::detail::function_call&)::operator()(pybind11::detail::function_call&) const /usr/include/pybind11/pybind11.h:254:56
    #17 0x7a26d48b005d in void pybind11::cpp_function::initialize<void pybind11::detail::initimpl::constructor<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>, bool, bool>::execute<pybind11::class_<(anonymous namespace)::PyFile>, pybind11::arg, pybind11::arg_v, pybind11::arg_v, char [548], 0>(pybind11::class_<(anonymous namespace)::PyFile>&, pybind11::arg const&, pybind11::arg_v const&, pybind11::arg_v const&, char const (&) [548])::'lambda'(pybind11::detail::value_and_holder&, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>, bool, bool), void, pybind11::detail::value_and_holder&, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>, bool, bool, pybind11::name, pybind11::is_method, pybind11::sibling, pybind11::detail::is_new_style_constructor, pybind11::arg, pybind11::arg_v, pybind11::arg_v, char [548]>(pybind11::class_<(anonymous namespace)::PyFile>&&, void (*)(pybind11::detail::value_and_holder&, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>, bool, bool), pybind11::name const&, pybind11::is_method const&, pybind11::sibling const&, pybind11::detail::is_new_style_constructor const&, pybind11::arg const&, pybind11::arg_v const&, pybind11::arg_v const&, char const (&) [548])::'lambda'(pybind11::detail::function_call&)::__invoke(pybind11::detail::function_call&) /usr/include/pybind11/pybind11.h:224:21
    #18 0x7a26d48f599e in pybind11::cpp_function::dispatcher(_object*, _object*, _object*) /usr/include/pybind11/pybind11.h:946:30
    #19 0x5821ee  (/usr/bin/python3.12+0x5821ee) (BuildId: 7aa38bef4bcd63064ecbd05a66f6120026526b74)
    #20 0x5492b4 in _PyObject_MakeTpCall (/usr/bin/python3.12+0x5492b4) (BuildId: 7aa38bef4bcd63064ecbd05a66f6120026526b74)
    #21 0x54cfc6  (/usr/bin/python3.12+0x54cfc6) (BuildId: 7aa38bef4bcd63064ecbd05a66f6120026526b74)
    #22 0x59e300  (/usr/bin/python3.12+0x59e300) (BuildId: 7aa38bef4bcd63064ecbd05a66f6120026526b74)
    #23 0x599c52  (/usr/bin/python3.12+0x599c52) (BuildId: 7aa38bef4bcd63064ecbd05a66f6120026526b74)
    #24 0x7a26d48e8357 in pybind11_meta_call /usr/include/pybind11/detail/class.h:187:22
    #25 0x5492b4 in _PyObject_MakeTpCall (/usr/bin/python3.12+0x5492b4) (BuildId: 7aa38bef4bcd63064ecbd05a66f6120026526b74)
    #26 0x5d7388 in _PyEval_EvalFrameDefault (/usr/bin/python3.12+0x5d7388) (BuildId: 7aa38bef4bcd63064ecbd05a66f6120026526b74)
    #27 0x5d58ba in PyEval_EvalCode (/usr/bin/python3.12+0x5d58ba) (BuildId: 7aa38bef4bcd63064ecbd05a66f6120026526b74)
    #28 0x608b51  (/usr/bin/python3.12+0x608b51) (BuildId: 7aa38bef4bcd63064ecbd05a66f6120026526b74)
    #29 0x6b5262  (/usr/bin/python3.12+0x6b5262) (BuildId: 7aa38bef4bcd63064ecbd05a66f6120026526b74)
    #30 0x6b4fc9 in _PyRun_SimpleFileObject (/usr/bin/python3.12+0x6b4fc9) (BuildId: 7aa38bef4bcd63064ecbd05a66f6120026526b74)
    #31 0x6b4dfe in _PyRun_AnyFileObject (/usr/bin/python3.12+0x6b4dfe) (BuildId: 7aa38bef4bcd63064ecbd05a66f6120026526b74)
    #32 0x6bce64 in Py_RunMain (/usr/bin/python3.12+0x6bce64) (BuildId: 7aa38bef4bcd63064ecbd05a66f6120026526b74)
    #33 0x6bc94c in Py_BytesMain (/usr/bin/python3.12+0x6bc94c) (BuildId: 7aa38bef4bcd63064ecbd05a66f6120026526b74)
    #34 0x7a26d782a1c9 in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16
    #35 0x7a26d782a28a in __libc_start_main csu/../csu/libc-start.c:360:3

SUMMARY: AddressSanitizer: heap-buffer-overflow /home/br0nzu/openexr/v3.4.13/sources/openexr-3.4.13/src/lib/OpenEXRCore/unpack.c:1425:37 in generic_unpack_deep_pointers
Shadow bytes around the buggy address:
  0x502000016c80: fa fa fd fa fa fa fd fa fa fa 00 00 fa fa 01 fa
  0x502000016d00: fa fa fd fd fa fa fd fd fa fa 00 fa fa fa 00 fa
  0x502000016d80: fa fa 00 fa fa fa 00 fa fa fa 00 00 fa fa 00 00
  0x502000016e00: fa fa 00 00 fa fa 00 00 fa fa 00 00 fa fa 00 00
  0x502000016e80: fa fa 00 fa fa fa fd fa fa fa fd fa fa fa fd fa
=>0x502000016f00: fa fa fd fd fa fa fd fd fa fa fd fd fa fa 00[04]
  0x502000016f80: fa fa fd fd fa fa fd fd fa fa fd fd fa fa fd fd
  0x502000017000: fa fa fd fd fa fa fd fd fa fa 04 fa fa fa 00 fa
  0x502000017080: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x502000017100: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x502000017180: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
==438108==ABORTING
timeout: the monitored command dumped core

v3.4.13 ASAN 2-sample stdout

v3.4.13 ASAN 2-sample rc

v3413_asan_2samp rc=134

v3.4.13 UBSAN 2-sample stderr

/home/br0nzu/openexr/v3.4.13/sources/openexr-3.4.13/src/lib/OpenEXRCore/unpack.c:1425:37: runtime error: store to misaligned address 0x0000054eafc2 for type 'uint32_t' (aka 'unsigned int'), which requires 4 byte alignment
0x0000054eafc2: note: pointer points here
 00 00  20 3b a0 6f 00 34 00 00  20 3b 00 38 b3 76 00 00  00 00 00 00 00 00 00 00  91 17 00 00 00 00
              ^ 
    #0 0x76b36e8d6444 in generic_unpack_deep_pointers /home/br0nzu/openexr/v3.4.13/sources/openexr-3.4.13/src/lib/OpenEXRCore/unpack.c:1425:37
    #1 0x76b36e8c9cd3 in exr_decoding_run /home/br0nzu/openexr/v3.4.13/sources/openexr-3.4.13/src/lib/OpenEXRCore/decoding.c:664:18
    #2 0x76b36ed9fee5 in Imf_3_4::(anonymous namespace)::ScanLineProcess::run_decode(_priv_exr_context_t const*, int, Imf_3_4::DeepFrameBuffer const*, int, int, std::vector<Imf_3_4::DeepSlice, std::allocator<Imf_3_4::DeepSlice>> const&) /home/br0nzu/openexr/v3.4.13/sources/openexr-3.4.13/src/lib/OpenEXR/ImfDeepScanLineInputFile.cpp:831:23
    #3 0x76b36ed9d763 in Imf_3_4::DeepScanLineInputFile::Data::readData(Imf_3_4::DeepFrameBuffer const&, int, int, bool) /home/br0nzu/openexr/v3.4.13/sources/openexr-3.4.13/src/lib/OpenEXR/ImfDeepScanLineInputFile.cpp:568:20
    #4 0x76b36f1b1337 in (anonymous namespace)::PyPart::readDeepPixels(Imf_3_4::MultiPartInputFile&, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>> const&, Imf_3_4::ChannelList const&, std::vector<unsigned long, std::allocator<unsigned long>> const&, std::set<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>, std::less<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>>, std::allocator<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>>> const&, Imath_3_1::Box<Imath_3_1::Vec2<int>> const&, bool) /home/br0nzu/openexr/v3.4.13/sources/openexr-3.4.13/src/wrappers/python/PyOpenEXR.cpp:612:18
    #5 0x76b36f1b1337 in (anonymous namespace)::PyFile::PyFile(std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>> const&, bool, bool) /home/br0nzu/openexr/v3.4.13/sources/openexr-3.4.13/src/wrappers/python/PyOpenEXR.cpp:223:23
    #6 0x76b36f1ae2da in (anonymous namespace)::PyFile* pybind11::detail::initimpl::construct_or_initialize<(anonymous namespace)::PyFile, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>, bool, bool, 0>(std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>&&, bool&&, bool&&) /usr/include/pybind11/detail/init.h:76:16
    #7 0x76b36f1ae2da in void pybind11::detail::initimpl::constructor<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>, bool, bool>::execute<pybind11::class_<(anonymous namespace)::PyFile>, pybind11::arg, pybind11::arg_v, pybind11::arg_v, char [548], 0>(pybind11::class_<(anonymous namespace)::PyFile>&, pybind11::arg const&, pybind11::arg_v const&, pybind11::arg_v const&, char const (&) [548])::'lambda'(pybind11::detail::value_and_holder&, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>, bool, bool)::operator()(pybind11::detail::value_and_holder&, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>, bool, bool) const /usr/include/pybind11/detail/init.h:206:35
    #8 0x76b36f1ae2da in pybind11::class_<(anonymous namespace)::PyFile> pybind11::detail::argument_loader<pybind11::detail::value_and_holder&, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>, bool, bool>::call_impl<void, void pybind11::detail::initimpl::constructor<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>, bool, bool>::execute<pybind11::class_<(anonymous namespace)::PyFile>, pybind11::arg, pybind11::arg_v, pybind11::arg_v, char [548], 0>(pybind11::class_<(anonymous namespace)::PyFile>&, pybind11::arg const&, pybind11::arg_v const&, pybind11::arg_v const&, char const (&) [548])::'lambda'(pybind11::detail::value_and_holder&, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>, bool, bool)&, 0ul, 1ul, 2ul, 3ul, pybind11::detail::void_type>(void pybind11::detail::initimpl::constructor<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>, bool, bool>::execute<pybind11::class_<(anonymous namespace)::PyFile>, pybind11::arg, pybind11::arg_v, pybind11::arg_v, char [548], 0>(pybind11::class_<(anonymous namespace)::PyFile>&, pybind11::arg const&, pybind11::arg_v const&, pybind11::arg_v const&, char const (&) [548])::'lambda'(pybind11::detail::value_and_holder&, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>, bool, bool)&, std::integer_sequence<unsigned long, 0ul, 1ul, 2ul, 3ul>, pybind11::detail::void_type&&) && /usr/include/pybind11/detail/../cast.h:1480:16
    #9 0x76b36f1ae2da in std::enable_if<std::is_void<pybind11::class_<(anonymous namespace)::PyFile>>::value, pybind11::detail::void_type>::type pybind11::detail::argument_loader<pybind11::detail::value_and_holder&, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>, bool, bool>::call<void, pybind11::detail::void_type, void pybind11::detail::initimpl::constructor<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>, bool, bool>::execute<pybind11::class_<(anonymous namespace)::PyFile>, pybind11::arg, pybind11::arg_v, pybind11::arg_v, char [548], 0>(pybind11::class_<(anonymous namespace)::PyFile>&, pybind11::arg const&, pybind11::arg_v const&, pybind11::arg_v const&, char const (&) [548])::'lambda'(pybind11::detail::value_and_holder&, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>, bool, bool)&>(void pybind11::detail::initimpl::constructor<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>, bool, bool>::execute<pybind11::class_<(anonymous namespace)::PyFile>, pybind11::arg, pybind11::arg_v, pybind11::arg_v, char [548], 0>(pybind11::class_<(anonymous namespace)::PyFile>&, pybind11::arg const&, pybind11::arg_v const&, pybind11::arg_v const&, char const (&) [548])::'lambda'(pybind11::detail::value_and_holder&, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>, bool, bool)&) && /usr/include/pybind11/detail/../cast.h:1454:35
    #10 0x76b36f1ae111 in void pybind11::cpp_function::initialize<void pybind11::detail::initimpl::constructor<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>, bool, bool>::execute<pybind11::class_<(anonymous namespace)::PyFile>, pybind11::arg, pybind11::arg_v, pybind11::arg_v, char [548], 0>(pybind11::class_<(anonymous namespace)::PyFile>&, pybind11::arg const&, pybind11::arg_v const&, pybind11::arg_v const&, char const (&) [548])::'lambda'(pybind11::detail::value_and_holder&, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>, bool, bool), void, pybind11::detail::value_and_holder&, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>, bool, bool, pybind11::name, pybind11::is_method, pybind11::sibling, pybind11::detail::is_new_style_constructor, pybind11::arg, pybind11::arg_v, pybind11::arg_v, char [548]>(pybind11::class_<(anonymous namespace)::PyFile>&&, void (*)(pybind11::detail::value_and_holder&, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>, bool, bool), pybind11::name const&, pybind11::is_method const&, pybind11::sibling const&, pybind11::detail::is_new_style_constructor const&, pybind11::arg const&, pybind11::arg_v const&, pybind11::arg_v const&, char const (&) [548])::'lambda'(pybind11::detail::function_call&)::operator()(pybind11::detail::function_call&) const /usr/include/pybind11/pybind11.h:254:56
    #11 0x76b36f1ae111 in void pybind11::cpp_function::initialize<void pybind11::detail::initimpl::constructor<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>, bool, bool>::execute<pybind11::class_<(anonymous namespace)::PyFile>, pybind11::arg, pybind11::arg_v, pybind11::arg_v, char [548], 0>(pybind11::class_<(anonymous namespace)::PyFile>&, pybind11::arg const&, pybind11::arg_v const&, pybind11::arg_v const&, char const (&) [548])::'lambda'(pybind11::detail::value_and_holder&, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>, bool, bool), void, pybind11::detail::value_and_holder&, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>, bool, bool, pybind11::name, pybind11::is_method, pybind11::sibling, pybind11::detail::is_new_style_constructor, pybind11::arg, pybind11::arg_v, pybind11::arg_v, char [548]>(pybind11::class_<(anonymous namespace)::PyFile>&&, void (*)(pybind11::detail::value_and_holder&, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>, bool, bool), pybind11::name const&, pybind11::is_method const&, pybind11::sibling const&, pybind11::detail::is_new_style_constructor const&, pybind11::arg const&, pybind11::arg_v const&, pybind11::arg_v const&, char const (&) [548])::'lambda'(pybind11::detail::function_call&)::__invoke(pybind11::detail::function_call&) /usr/include/pybind11/pybind11.h:224:21
    #12 0x76b36f1e35bc in pybind11::cpp_function::dispatcher(_object*, _object*, _object*) /usr/include/pybind11/pybind11.h:946:30
    #13 0x5821ee  (/usr/bin/python3.12+0x5821ee) (BuildId: 7aa38bef4bcd63064ecbd05a66f6120026526b74)
    #14 0x5492b4 in _PyObject_MakeTpCall (/usr/bin/python3.12+0x5492b4) (BuildId: 7aa38bef4bcd63064ecbd05a66f6120026526b74)
    #15 0x54cfc6  (/usr/bin/python3.12+0x54cfc6) (BuildId: 7aa38bef4bcd63064ecbd05a66f6120026526b74)
    #16 0x59e300  (/usr/bin/python3.12+0x59e300) (BuildId: 7aa38bef4bcd63064ecbd05a66f6120026526b74)
    #17 0x599c52  (/usr/bin/python3.12+0x599c52) (BuildId: 7aa38bef4bcd63064ecbd05a66f6120026526b74)
    #18 0x76b36f1d7fbe in pybind11_meta_call /usr/include/pybind11/detail/class.h:187:22
    #19 0x5492b4 in _PyObject_MakeTpCall (/usr/bin/python3.12+0x5492b4) (BuildId: 7aa38bef4bcd63064ecbd05a66f6120026526b74)
    #20 0x5d7388 in _PyEval_EvalFrameDefault (/usr/bin/python3.12+0x5d7388) (BuildId: 7aa38bef4bcd63064ecbd05a66f6120026526b74)
    #21 0x5d58ba in PyEval_EvalCode (/usr/bin/python3.12+0x5d58ba) (BuildId: 7aa38bef4bcd63064ecbd05a66f6120026526b74)
    #22 0x608b51  (/usr/bin/python3.12+0x608b51) (BuildId: 7aa38bef4bcd63064ecbd05a66f6120026526b74)
    #23 0x6b5262  (/usr/bin/python3.12+0x6b5262) (BuildId: 7aa38bef4bcd63064ecbd05a66f6120026526b74)
    #24 0x6b4fc9 in _PyRun_SimpleFileObject (/usr/bin/python3.12+0x6b4fc9) (BuildId: 7aa38bef4bcd63064ecbd05a66f6120026526b74)
    #25 0x6b4dfe in _PyRun_AnyFileObject (/usr/bin/python3.12+0x6b4dfe) (BuildId: 7aa38bef4bcd63064ecbd05a66f6120026526b74)
    #26 0x6bce64 in Py_RunMain (/usr/bin/python3.12+0x6bce64) (BuildId: 7aa38bef4bcd63064ecbd05a66f6120026526b74)
    #27 0x6bc94c in Py_BytesMain (/usr/bin/python3.12+0x6bc94c) (BuildId: 7aa38bef4bcd63064ecbd05a66f6120026526b74)
    #28 0x76b36f82a1c9 in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16
    #29 0x76b36f82a28a in __libc_start_main csu/../csu/libc-start.c:360:3
    #30 0x657b04 in _start (/usr/bin/python3.12+0x657b04) (BuildId: 7aa38bef4bcd63064ecbd05a66f6120026526b74)

SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior /home/br0nzu/openexr/v3.4.13/sources/openexr-3.4.13/src/lib/OpenEXRCore/unpack.c:1425:37 
timeout: the monitored command dumped core

v3.4.13 UBSAN 2-sample stdout

v3.4.13 UBSAN 2-sample rc

v3413_ubsan_2samp rc=134

v3.4.13 original 4-sample stderr

double free or corruption (out)
timeout: the monitored command dumped core

v3.4.13 original 4-sample stdout

v3.4.13 original 4-sample rc

v3413_original_4samp rc=134

main ASAN 2-sample stderr

=================================================================
==438218==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x502000018dde at pc 0x7524d5cb62ac bp 0x7ffca38ecc70 sp 0x7ffca38ecc68
WRITE of size 4 at 0x502000018dde thread T0
    #0 0x7524d5cb62ab in generic_unpack_deep_pointers /home/br0nzu/openexr/v3.4.13/sources/openexr-main/src/lib/OpenEXRCore/unpack.c:1425:37
    #1 0x7524d5caccaf in exr_decoding_run /home/br0nzu/openexr/v3.4.13/sources/openexr-main/src/lib/OpenEXRCore/decoding.c:664:18
    #2 0x7524d60ac242 in Imf_4_0::(anonymous namespace)::ScanLineProcess::run_decode(_priv_exr_context_t const*, int, Imf_4_0::DeepFrameBuffer const*, int, int, std::vector<Imf_4_0::DeepSlice, std::allocator<Imf_4_0::DeepSlice>> const&) /home/br0nzu/openexr/v3.4.13/sources/openexr-main/src/lib/OpenEXR/ImfDeepScanLineInputFile.cpp:831:23
    #3 0x7524d60a9009 in Imf_4_0::DeepScanLineInputFile::Data::readData(Imf_4_0::DeepFrameBuffer const&, int, int, bool) /home/br0nzu/openexr/v3.4.13/sources/openexr-main/src/lib/OpenEXR/ImfDeepScanLineInputFile.cpp:568:20
    #4 0x7524d647c2b4 in (anonymous namespace)::PyPart::readDeepPixels(Imf_4_0::MultiPartInputFile&, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>> const&, Imf_4_0::ChannelList const&, std::vector<unsigned long, std::allocator<unsigned long>> const&, std::set<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>, std::less<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>>, std::allocator<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>>> const&, Imath_3_1::Box<Imath_3_1::Vec2<int>> const&, bool) /home/br0nzu/openexr/v3.4.13/sources/openexr-main/src/wrappers/python/PyOpenEXR.cpp:836:18
    #5 0x7524d647c2b4 in (anonymous namespace)::PyFile::readPartsFromOpenInput(bool) /home/br0nzu/openexr/v3.4.13/sources/openexr-main/src/wrappers/python/PyOpenEXR.cpp:447:23
    #6 0x7524d6474916 in (anonymous namespace)::PyFile::PyFile(std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>> const&, bool, bool, int) /home/br0nzu/openexr/v3.4.13/sources/openexr-main/src/wrappers/python/PyOpenEXR.cpp:362:5
    #7 0x7524d6474916 in (anonymous namespace)::PyFile* pybind11::detail::initimpl::construct_or_initialize<(anonymous namespace)::PyFile, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>, bool, bool, int, 0>(std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>&&, bool&&, bool&&, int&&) /usr/include/pybind11/detail/init.h:76:16
    #8 0x7524d6474916 in void pybind11::detail::initimpl::constructor<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>, bool, bool, int>::execute<pybind11::class_<(anonymous namespace)::PyFile>, pybind11::arg, pybind11::arg_v, pybind11::arg_v, pybind11::arg_v, char [641], 0>(pybind11::class_<(anonymous namespace)::PyFile>&, pybind11::arg const&, pybind11::arg_v const&, pybind11::arg_v const&, pybind11::arg_v const&, char const (&) [641])::'lambda'(pybind11::detail::value_and_holder&, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>, bool, bool, int)::operator()(pybind11::detail::value_and_holder&, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>, bool, bool, int) const /usr/include/pybind11/detail/init.h:206:35
    #9 0x7524d6474916 in pybind11::class_<(anonymous namespace)::PyFile> pybind11::detail::argument_loader<pybind11::detail::value_and_holder&, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>, bool, bool, int>::call_impl<void, void pybind11::detail::initimpl::constructor<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>, bool, bool, int>::execute<pybind11::class_<(anonymous namespace)::PyFile>, pybind11::arg, pybind11::arg_v, pybind11::arg_v, pybind11::arg_v, char [641], 0>(pybind11::class_<(anonymous namespace)::PyFile>&, pybind11::arg const&, pybind11::arg_v const&, pybind11::arg_v const&, pybind11::arg_v const&, char const (&) [641])::'lambda'(pybind11::detail::value_and_holder&, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>, bool, bool, int)&, 0ul, 1ul, 2ul, 3ul, 4ul, pybind11::detail::void_type>(void pybind11::detail::initimpl::constructor<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>, bool, bool, int>::execute<pybind11::class_<(anonymous namespace)::PyFile>, pybind11::arg, pybind11::arg_v, pybind11::arg_v, pybind11::arg_v, char [641], 0>(pybind11::class_<(anonymous namespace)::PyFile>&, pybind11::arg const&, pybind11::arg_v const&, pybind11::arg_v const&, pybind11::arg_v const&, char const (&) [641])::'lambda'(pybind11::detail::value_and_holder&, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>, bool, bool, int)&, std::integer_sequence<unsigned long, 0ul, 1ul, 2ul, 3ul, 4ul>, pybind11::detail::void_type&&) && /usr/include/pybind11/detail/../cast.h:1480:16
    #10 0x7524d6474916 in std::enable_if<std::is_void<pybind11::class_<(anonymous namespace)::PyFile>>::value, pybind11::detail::void_type>::type pybind11::detail::argument_loader<pybind11::detail::value_and_holder&, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>, bool, bool, int>::call<void, pybind11::detail::void_type, void pybind11::detail::initimpl::constructor<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>, bool, bool, int>::execute<pybind11::class_<(anonymous namespace)::PyFile>, pybind11::arg, pybind11::arg_v, pybind11::arg_v, pybind11::arg_v, char [641], 0>(pybind11::class_<(anonymous namespace)::PyFile>&, pybind11::arg const&, pybind11::arg_v const&, pybind11::arg_v const&, pybind11::arg_v const&, char const (&) [641])::'lambda'(pybind11::detail::value_and_holder&, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>, bool, bool, int)&>(void pybind11::detail::initimpl::constructor<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>, bool, bool, int>::execute<pybind11::class_<(anonymous namespace)::PyFile>, pybind11::arg, pybind11::arg_v, pybind11::arg_v, pybind11::arg_v, char [641], 0>(pybind11::class_<(anonymous namespace)::PyFile>&, pybind11::arg const&, pybind11::arg_v const&, pybind11::arg_v const&, pybind11::arg_v const&, char const (&) [641])::'lambda'(pybind11::detail::value_and_holder&, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>, bool, bool, int)&) && /usr/include/pybind11/detail/../cast.h:1454:35
    #11 0x7524d6474296 in void pybind11::cpp_function::initialize<void pybind11::detail::initimpl::constructor<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>, bool, bool, int>::execute<pybind11::class_<(anonymous namespace)::PyFile>, pybind11::arg, pybind11::arg_v, pybind11::arg_v, pybind11::arg_v, char [641], 0>(pybind11::class_<(anonymous namespace)::PyFile>&, pybind11::arg const&, pybind11::arg_v const&, pybind11::arg_v const&, pybind11::arg_v const&, char const (&) [641])::'lambda'(pybind11::detail::value_and_holder&, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>, bool, bool, int), void, pybind11::detail::value_and_holder&, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>, bool, bool, int, pybind11::name, pybind11::is_method, pybind11::sibling, pybind11::detail::is_new_style_constructor, pybind11::arg, pybind11::arg_v, pybind11::arg_v, pybind11::arg_v, char [641]>(pybind11::class_<(anonymous namespace)::PyFile>&&, void (*)(pybind11::detail::value_and_holder&, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>, bool, bool, int), pybind11::name const&, pybind11::is_method const&, pybind11::sibling const&, pybind11::detail::is_new_style_constructor const&, pybind11::arg const&, pybind11::arg_v const&, pybind11::arg_v const&, pybind11::arg_v const&, char const (&) [641])::'lambda'(pybind11::detail::function_call&)::operator()(pybind11::detail::function_call&) const /usr/include/pybind11/pybind11.h:254:56
    #12 0x7524d6474296 in void pybind11::cpp_function::initialize<void pybind11::detail::initimpl::constructor<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>, bool, bool, int>::execute<pybind11::class_<(anonymous namespace)::PyFile>, pybind11::arg, pybind11::arg_v, pybind11::arg_v, pybind11::arg_v, char [641], 0>(pybind11::class_<(anonymous namespace)::PyFile>&, pybind11::arg const&, pybind11::arg_v const&, pybind11::arg_v const&, pybind11::arg_v const&, char const (&) [641])::'lambda'(pybind11::detail::value_and_holder&, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>, bool, bool, int), void, pybind11::detail::value_and_holder&, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>, bool, bool, int, pybind11::name, pybind11::is_method, pybind11::sibling, pybind11::detail::is_new_style_constructor, pybind11::arg, pybind11::arg_v, pybind11::arg_v, pybind11::arg_v, char [641]>(pybind11::class_<(anonymous namespace)::PyFile>&&, void (*)(pybind11::detail::value_and_holder&, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>, bool, bool, int), pybind11::name const&, pybind11::is_method const&, pybind11::sibling const&, pybind11::detail::is_new_style_constructor const&, pybind11::arg const&, pybind11::arg_v const&, pybind11::arg_v const&, pybind11::arg_v const&, char const (&) [641])::'lambda'(pybind11::detail::function_call&)::__invoke(pybind11::detail::function_call&) /usr/include/pybind11/pybind11.h:224:21
    #13 0x7524d64c572e in pybind11::cpp_function::dispatcher(_object*, _object*, _object*) /usr/include/pybind11/pybind11.h:946:30
    #14 0x5821ee  (/usr/bin/python3.12+0x5821ee) (BuildId: 7aa38bef4bcd63064ecbd05a66f6120026526b74)
    #15 0x5492b4 in _PyObject_MakeTpCall (/usr/bin/python3.12+0x5492b4) (BuildId: 7aa38bef4bcd63064ecbd05a66f6120026526b74)
    #16 0x54cfc6  (/usr/bin/python3.12+0x54cfc6) (BuildId: 7aa38bef4bcd63064ecbd05a66f6120026526b74)
    #17 0x59e300  (/usr/bin/python3.12+0x59e300) (BuildId: 7aa38bef4bcd63064ecbd05a66f6120026526b74)
    #18 0x599c52  (/usr/bin/python3.12+0x599c52) (BuildId: 7aa38bef4bcd63064ecbd05a66f6120026526b74)
    #19 0x7524d64b80e7 in pybind11_meta_call /usr/include/pybind11/detail/class.h:187:22
    #20 0x5492b4 in _PyObject_MakeTpCall (/usr/bin/python3.12+0x5492b4) (BuildId: 7aa38bef4bcd63064ecbd05a66f6120026526b74)
    #21 0x5d7388 in _PyEval_EvalFrameDefault (/usr/bin/python3.12+0x5d7388) (BuildId: 7aa38bef4bcd63064ecbd05a66f6120026526b74)
    #22 0x5d58ba in PyEval_EvalCode (/usr/bin/python3.12+0x5d58ba) (BuildId: 7aa38bef4bcd63064ecbd05a66f6120026526b74)
    #23 0x608b51  (/usr/bin/python3.12+0x608b51) (BuildId: 7aa38bef4bcd63064ecbd05a66f6120026526b74)
    #24 0x6b5262  (/usr/bin/python3.12+0x6b5262) (BuildId: 7aa38bef4bcd63064ecbd05a66f6120026526b74)
    #25 0x6b4fc9 in _PyRun_SimpleFileObject (/usr/bin/python3.12+0x6b4fc9) (BuildId: 7aa38bef4bcd63064ecbd05a66f6120026526b74)
    #26 0x6b4dfe in _PyRun_AnyFileObject (/usr/bin/python3.12+0x6b4dfe) (BuildId: 7aa38bef4bcd63064ecbd05a66f6120026526b74)
    #27 0x6bce64 in Py_RunMain (/usr/bin/python3.12+0x6bce64) (BuildId: 7aa38bef4bcd63064ecbd05a66f6120026526b74)
    #28 0x6bc94c in Py_BytesMain (/usr/bin/python3.12+0x6bc94c) (BuildId: 7aa38bef4bcd63064ecbd05a66f6120026526b74)
    #29 0x7524d942a1c9 in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16
    #30 0x7524d942a28a in __libc_start_main csu/../csu/libc-start.c:360:3
    #31 0x657b04 in _start (/usr/bin/python3.12+0x657b04) (BuildId: 7aa38bef4bcd63064ecbd05a66f6120026526b74)

0x502000018dde is located 2 bytes after 12-byte region [0x502000018dd0,0x502000018ddc)
allocated by thread T0 here:
    #0 0x7524d98f87a3 in malloc (/usr/lib/llvm-18/lib/clang/18/lib/linux/libclang_rt.asan-x86_64.so+0xf87a3) (BuildId: bf9e3747052c46cd49f7974555b1700dce30b8c0)
    #1 0x7524d56cc65a  (/usr/lib/python3/dist-packages/numpy/core/_multiarray_umath.cpython-312-x86_64-linux-gnu.so+0xcc65a) (BuildId: 4e90c45f411fba3236c21490996071d3467336f7)
    #2 0x7524d56e4b02  (/usr/lib/python3/dist-packages/numpy/core/_multiarray_umath.cpython-312-x86_64-linux-gnu.so+0xe4b02) (BuildId: 4e90c45f411fba3236c21490996071d3467336f7)
    #3 0x7524d56e4ee1  (/usr/lib/python3/dist-packages/numpy/core/_multiarray_umath.cpython-312-x86_64-linux-gnu.so+0xe4ee1) (BuildId: 4e90c45f411fba3236c21490996071d3467336f7)
    #4 0x7524d6545247 in pybind11::array::array(pybind11::dtype const&, pybind11::detail::any_container<long>, pybind11::detail::any_container<long>, void const*, pybind11::handle) /usr/include/pybind11/numpy.h:729:46
    #5 0x7524d65713f5 in pybind11::array::array<Imath_3_1::half>(pybind11::detail::any_container<long>, pybind11::detail::any_container<long>, Imath_3_1::half const*, pybind11::handle) /usr/include/pybind11/numpy.h:767:11
    #6 0x7524d6573b26 in pybind11::array_t<Imath_3_1::half, 16>::array_t(pybind11::array_t<Imath_3_1::half, 16>::private_ctor, pybind11::detail::any_container<long>&&, pybind11::detail::any_container<long>&&, Imath_3_1::half const*, pybind11::handle) /usr/include/pybind11/numpy.h:1029:11
    #7 0x7524d6573397 in pybind11::array_t<Imath_3_1::half, 16>::array_t(pybind11::detail::any_container<long>, Imath_3_1::half const*, pybind11::handle) /usr/include/pybind11/numpy.h:1066:11
    #8 0x7524d6482966 in (anonymous namespace)::PyChannel::createDeepPixelArrays(unsigned long, unsigned long, Imf_4_0::Array2D<unsigned int> const&) /home/br0nzu/openexr/v3.4.13/sources/openexr-main/src/wrappers/python/PyOpenEXR.cpp:625:42
    #9 0x7524d6482966 in (anonymous namespace)::PyPart::setDeepSliceData(Imf_4_0::ChannelList const&, unsigned long, unsigned long, std::map<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>, std::unique_ptr<Imf_4_0::Array2D<void*>, std::default_delete<Imf_4_0::Array2D<void*>>>, std::less<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>>, std::allocator<std::pair<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>> const, std::unique_ptr<Imf_4_0::Array2D<void*>, std::default_delete<Imf_4_0::Array2D<void*>>>>>>&, std::map<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>, (anonymous namespace)::PyChannel*, std::less<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>>, std::allocator<std::pair<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>> const, (anonymous namespace)::PyChannel*>>>&, Imf_4_0::Array2D<unsigned int> const&) /home/br0nzu/openexr/v3.4.13/sources/openexr-main/src/wrappers/python/PyOpenEXR.cpp:655:11
    #10 0x7524d647c258 in (anonymous namespace)::PyPart::readDeepPixels(Imf_4_0::MultiPartInputFile&, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>> const&, Imf_4_0::ChannelList const&, std::vector<unsigned long, std::allocator<unsigned long>> const&, std::set<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>, std::less<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>>, std::allocator<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>>> const&, Imath_3_1::Box<Imath_3_1::Vec2<int>> const&, bool) /home/br0nzu/openexr/v3.4.13/sources/openexr-main/src/wrappers/python/PyOpenEXR.cpp:832:9
    #11 0x7524d647c258 in (anonymous namespace)::PyFile::readPartsFromOpenInput(bool) /home/br0nzu/openexr/v3.4.13/sources/openexr-main/src/wrappers/python/PyOpenEXR.cpp:447:23
    #12 0x7524d6474916 in (anonymous namespace)::PyFile::PyFile(std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>> const&, bool, bool, int) /home/br0nzu/openexr/v3.4.13/sources/openexr-main/src/wrappers/python/PyOpenEXR.cpp:362:5
    #13 0x7524d6474916 in (anonymous namespace)::PyFile* pybind11::detail::initimpl::construct_or_initialize<(anonymous namespace)::PyFile, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>, bool, bool, int, 0>(std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>&&, bool&&, bool&&, int&&) /usr/include/pybind11/detail/init.h:76:16
    #14 0x7524d6474916 in void pybind11::detail::initimpl::constructor<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>, bool, bool, int>::execute<pybind11::class_<(anonymous namespace)::PyFile>, pybind11::arg, pybind11::arg_v, pybind11::arg_v, pybind11::arg_v, char [641], 0>(pybind11::class_<(anonymous namespace)::PyFile>&, pybind11::arg const&, pybind11::arg_v const&, pybind11::arg_v const&, pybind11::arg_v const&, char const (&) [641])::'lambda'(pybind11::detail::value_and_holder&, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>, bool, bool, int)::operator()(pybind11::detail::value_and_holder&, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>, bool, bool, int) const /usr/include/pybind11/detail/init.h:206:35
    #15 0x7524d6474916 in pybind11::class_<(anonymous namespace)::PyFile> pybind11::detail::argument_loader<pybind11::detail::value_and_holder&, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>, bool, bool, int>::call_impl<void, void pybind11::detail::initimpl::constructor<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>, bool, bool, int>::execute<pybind11::class_<(anonymous namespace)::PyFile>, pybind11::arg, pybind11::arg_v, pybind11::arg_v, pybind11::arg_v, char [641], 0>(pybind11::class_<(anonymous namespace)::PyFile>&, pybind11::arg const&, pybind11::arg_v const&, pybind11::arg_v const&, pybind11::arg_v const&, char const (&) [641])::'lambda'(pybind11::detail::value_and_holder&, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>, bool, bool, int)&, 0ul, 1ul, 2ul, 3ul, 4ul, pybind11::detail::void_type>(void pybind11::detail::initimpl::constructor<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>, bool, bool, int>::execute<pybind11::class_<(anonymous namespace)::PyFile>, pybind11::arg, pybind11::arg_v, pybind11::arg_v, pybind11::arg_v, char [641], 0>(pybind11::class_<(anonymous namespace)::PyFile>&, pybind11::arg const&, pybind11::arg_v const&, pybind11::arg_v const&, pybind11::arg_v const&, char const (&) [641])::'lambda'(pybind11::detail::value_and_holder&, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>, bool, bool, int)&, std::integer_sequence<unsigned long, 0ul, 1ul, 2ul, 3ul, 4ul>, pybind11::detail::void_type&&) && /usr/include/pybind11/detail/../cast.h:1480:16
    #16 0x7524d6474916 in std::enable_if<std::is_void<pybind11::class_<(anonymous namespace)::PyFile>>::value, pybind11::detail::void_type>::type pybind11::detail::argument_loader<pybind11::detail::value_and_holder&, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>, bool, bool, int>::call<void, pybind11::detail::void_type, void pybind11::detail::initimpl::constructor<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>, bool, bool, int>::execute<pybind11::class_<(anonymous namespace)::PyFile>, pybind11::arg, pybind11::arg_v, pybind11::arg_v, pybind11::arg_v, char [641], 0>(pybind11::class_<(anonymous namespace)::PyFile>&, pybind11::arg const&, pybind11::arg_v const&, pybind11::arg_v const&, pybind11::arg_v const&, char const (&) [641])::'lambda'(pybind11::detail::value_and_holder&, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>, bool, bool, int)&>(void pybind11::detail::initimpl::constructor<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>, bool, bool, int>::execute<pybind11::class_<(anonymous namespace)::PyFile>, pybind11::arg, pybind11::arg_v, pybind11::arg_v, pybind11::arg_v, char [641], 0>(pybind11::class_<(anonymous namespace)::PyFile>&, pybind11::arg const&, pybind11::arg_v const&, pybind11::arg_v const&, pybind11::arg_v const&, char const (&) [641])::'lambda'(pybind11::detail::value_and_holder&, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>, bool, bool, int)&) && /usr/include/pybind11/detail/../cast.h:1454:35
    #17 0x7524d6474296 in void pybind11::cpp_function::initialize<void pybind11::detail::initimpl::constructor<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>, bool, bool, int>::execute<pybind11::class_<(anonymous namespace)::PyFile>, pybind11::arg, pybind11::arg_v, pybind11::arg_v, pybind11::arg_v, char [641], 0>(pybind11::class_<(anonymous namespace)::PyFile>&, pybind11::arg const&, pybind11::arg_v const&, pybind11::arg_v const&, pybind11::arg_v const&, char const (&) [641])::'lambda'(pybind11::detail::value_and_holder&, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>, bool, bool, int), void, pybind11::detail::value_and_holder&, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>, bool, bool, int, pybind11::name, pybind11::is_method, pybind11::sibling, pybind11::detail::is_new_style_constructor, pybind11::arg, pybind11::arg_v, pybind11::arg_v, pybind11::arg_v, char [641]>(pybind11::class_<(anonymous namespace)::PyFile>&&, void (*)(pybind11::detail::value_and_holder&, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>, bool, bool, int), pybind11::name const&, pybind11::is_method const&, pybind11::sibling const&, pybind11::detail::is_new_style_constructor const&, pybind11::arg const&, pybind11::arg_v const&, pybind11::arg_v const&, pybind11::arg_v const&, char const (&) [641])::'lambda'(pybind11::detail::function_call&)::operator()(pybind11::detail::function_call&) const /usr/include/pybind11/pybind11.h:254:56
    #18 0x7524d6474296 in void pybind11::cpp_function::initialize<void pybind11::detail::initimpl::constructor<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>, bool, bool, int>::execute<pybind11::class_<(anonymous namespace)::PyFile>, pybind11::arg, pybind11::arg_v, pybind11::arg_v, pybind11::arg_v, char [641], 0>(pybind11::class_<(anonymous namespace)::PyFile>&, pybind11::arg const&, pybind11::arg_v const&, pybind11::arg_v const&, pybind11::arg_v const&, char const (&) [641])::'lambda'(pybind11::detail::value_and_holder&, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>, bool, bool, int), void, pybind11::detail::value_and_holder&, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>, bool, bool, int, pybind11::name, pybind11::is_method, pybind11::sibling, pybind11::detail::is_new_style_constructor, pybind11::arg, pybind11::arg_v, pybind11::arg_v, pybind11::arg_v, char [641]>(pybind11::class_<(anonymous namespace)::PyFile>&&, void (*)(pybind11::detail::value_and_holder&, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>, bool, bool, int), pybind11::name const&, pybind11::is_method const&, pybind11::sibling const&, pybind11::detail::is_new_style_constructor const&, pybind11::arg const&, pybind11::arg_v const&, pybind11::arg_v const&, pybind11::arg_v const&, char const (&) [641])::'lambda'(pybind11::detail::function_call&)::__invoke(pybind11::detail::function_call&) /usr/include/pybind11/pybind11.h:224:21
    #19 0x7524d64c572e in pybind11::cpp_function::dispatcher(_object*, _object*, _object*) /usr/include/pybind11/pybind11.h:946:30
    #20 0x5821ee  (/usr/bin/python3.12+0x5821ee) (BuildId: 7aa38bef4bcd63064ecbd05a66f6120026526b74)
    #21 0x5492b4 in _PyObject_MakeTpCall (/usr/bin/python3.12+0x5492b4) (BuildId: 7aa38bef4bcd63064ecbd05a66f6120026526b74)
    #22 0x54cfc6  (/usr/bin/python3.12+0x54cfc6) (BuildId: 7aa38bef4bcd63064ecbd05a66f6120026526b74)
    #23 0x59e300  (/usr/bin/python3.12+0x59e300) (BuildId: 7aa38bef4bcd63064ecbd05a66f6120026526b74)
    #24 0x599c52  (/usr/bin/python3.12+0x599c52) (BuildId: 7aa38bef4bcd63064ecbd05a66f6120026526b74)
    #25 0x7524d64b80e7 in pybind11_meta_call /usr/include/pybind11/detail/class.h:187:22
    #26 0x5492b4 in _PyObject_MakeTpCall (/usr/bin/python3.12+0x5492b4) (BuildId: 7aa38bef4bcd63064ecbd05a66f6120026526b74)
    #27 0x5d7388 in _PyEval_EvalFrameDefault (/usr/bin/python3.12+0x5d7388) (BuildId: 7aa38bef4bcd63064ecbd05a66f6120026526b74)
    #28 0x5d58ba in PyEval_EvalCode (/usr/bin/python3.12+0x5d58ba) (BuildId: 7aa38bef4bcd63064ecbd05a66f6120026526b74)
    #29 0x608b51  (/usr/bin/python3.12+0x608b51) (BuildId: 7aa38bef4bcd63064ecbd05a66f6120026526b74)
    #30 0x6b5262  (/usr/bin/python3.12+0x6b5262) (BuildId: 7aa38bef4bcd63064ecbd05a66f6120026526b74)
    #31 0x6b4fc9 in _PyRun_SimpleFileObject (/usr/bin/python3.12+0x6b4fc9) (BuildId: 7aa38bef4bcd63064ecbd05a66f6120026526b74)
    #32 0x6b4dfe in _PyRun_AnyFileObject (/usr/bin/python3.12+0x6b4dfe) (BuildId: 7aa38bef4bcd63064ecbd05a66f6120026526b74)
    #33 0x6bce64 in Py_RunMain (/usr/bin/python3.12+0x6bce64) (BuildId: 7aa38bef4bcd63064ecbd05a66f6120026526b74)
    #34 0x6bc94c in Py_BytesMain (/usr/bin/python3.12+0x6bc94c) (BuildId: 7aa38bef4bcd63064ecbd05a66f6120026526b74)
    #35 0x7524d942a1c9 in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16
    #36 0x7524d942a28a in __libc_start_main csu/../csu/libc-start.c:360:3

SUMMARY: AddressSanitizer: heap-buffer-overflow /home/br0nzu/openexr/v3.4.13/sources/openexr-main/src/lib/OpenEXRCore/unpack.c:1425:37 in generic_unpack_deep_pointers
Shadow bytes around the buggy address:
  0x502000018b00: fa fa fd fa fa fa 00 00 fa fa 01 fa fa fa fd fd
  0x502000018b80: fa fa fd fd fa fa 00 fa fa fa 00 fa fa fa 00 fa
  0x502000018c00: fa fa 00 fa fa fa 00 00 fa fa 00 00 fa fa 00 00
  0x502000018c80: fa fa 00 00 fa fa 00 00 fa fa 00 00 fa fa 00 fa
  0x502000018d00: fa fa fd fa fa fa fd fa fa fa fd fa fa fa fd fd
=>0x502000018d80: fa fa fd fd fa fa fd fd fa fa 00[04]fa fa fd fd
  0x502000018e00: fa fa fd fd fa fa fd fd fa fa fd fd fa fa fd fd
  0x502000018e80: fa fa fd fd fa fa 04 fa fa fa 00 fa fa fa fa fa
  0x502000018f00: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x502000018f80: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x502000019000: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
==438218==ABORTING
timeout: the monitored command dumped core

main ASAN 2-sample stdout

main ASAN 2-sample rc

main_asan_2samp rc=134

main original 4-sample stderr

double free or corruption (out)
timeout: the monitored command dumped core

main original 4-sample stdout

main original 4-sample rc

main_original_4samp rc=134

v3.4.13 MSAN environment-blocked stderr

ERROR: ld.so: object 'libclang_rt.msan-x86_64.so' from LD_PRELOAD cannot be preloaded (cannot open shared object file): ignored.
ERROR: ld.so: object 'libclang_rt.msan-x86_64.so' from LD_PRELOAD cannot be preloaded (cannot open shared object file): ignored.
Traceback (most recent call last):
  File "/home/br0nzu/openexr/v3.4.13/artifacts/solo_audit_python_mixed_rgba_type_20260623/repro_read.py", line 2, in <module>
    import OpenEXR
ImportError: /home/br0nzu/openexr/v3.4.13/builds/python_msan/src/lib/OpenEXRCore/libOpenEXRCore-3_4.so.33: undefined symbol: __msan_retval_tls

v3.4.13 MSAN environment-blocked rc

rc=1

Updates

2026-08-11 03:50 CEST

Metadata changes:

  • Status for package openexr: “Plausible”

2026-08-11 03:32 CEST

Metadata changes:

  • Status for package openexr: “New”