GHSA-g8f2-r72m-48vx

CVE Information

Summary

A malformed OpenEXR file with an empty multiView header attribute can crash OpenEXR's multi-view channel helper path. Imf::GetChannelsInMultiPartFile() opens the attacker-controlled file through MultiPartInputFile, sees that multiView exists, and calls Imf::viewFromChannelName() for dotless channel names such as R. viewFromChannelName() then unconditionally returns multiView[0] even when the vector is empty, causing undefined behavior and a null/zero-page read crash.

This is a file-driven metadata parsing/helper bug, not a caller-precondition-only API misuse. The malformed multiView vector is parsed from the EXR header, and the crash is reached by a normal OpenEXR helper that maps multipart/multiview channel names.

Details

Root cause in OpenEXR v3.4.13:

src/lib/OpenEXR/ImfPartHelper.h:196-215 checks only hasMultiView(file.header(0)), copies multiView(file.header(0)), and calls viewFromChannelName(m.name, mview) for each channel.
src/lib/OpenEXR/ImfMultiView.cpp:98-121 parses the channel name. If the channel has no period (s.size() == 1), it returns multiView[0] as the default view.
src/lib/OpenEXR/ImfMultiView.h:61-76 documents defaultViewName() as returning "" for an empty vector and documents viewFromChannelName() as returning "" when no named view applies. It does not document a non-empty-vector precondition for callers.

The PoC file has a valid channel list with ordinary dotless channel names and an empty multiView string vector. MultiPartInputFile accepts the file. The helper path later indexes element 0 of the empty vector.

PoC package contents

It contains only the crafted EXR, the generator/probe source, a rebuild/replay script, and full v3.4.13/main logs:

poc.zip

reproduce.sh
poc_artifacts/empty_multiview.exr
poc_artifacts/gen_empty_multiview.cpp
poc_artifacts/probe_empty_multiview_helper.cpp
logs/summary.txt
logs/v3_original.log
logs/v3_original.rc
logs/v3_asan.log
logs/v3_asan.rc
logs/v3_ubsan.log
logs/v3_ubsan.rc
logs/v3_msan.log
logs/v3_msan.rc
logs/main_original.log
logs/main_original.rc
logs/main_asan.log
logs/main_asan.rc
logs/main_ubsan.log
logs/main_ubsan.rc
logs/main_msan.log
logs/main_msan.rc

Reproduction

From an extracted poc.zip, run the helper with OPENEXR_ROOT pointing to the OpenEXR v3.4.13 workspace containing the sources/ and builds/ directories:

OPENEXR_ROOT=/home/br0nzu/openexr/v3.4.13 ./reproduce.sh

Expected return-code matrix:

v3_original rc=139 expected=139
v3_asan rc=134 expected=134
v3_ubsan rc=134 expected=134
v3_msan rc=134 expected=134
main_original rc=139 expected=139
main_asan rc=134 expected=134
main_ubsan rc=134 expected=134
main_msan rc=134 expected=nonzero_baseline

The main MSAN build currently reports an unrelated static-initialization baseline warning in ImfCompression.cpp:195 before the target path. The v3.4.13 MSAN build reaches the target viewFromChannelName() path, and main original/ASAN/UBSAN reproduce the same issue.

Full output

v3 original log

timeout: the monitored command dumped core

v3 original return code

v3 asan log

AddressSanitizer:DEADLYSIGNAL
=================================================================
==151968==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000000 (pc 0x63106f667a0f bp 0x7ffe0af47070 sp 0x7ffe0af46fc0 T0)
==151968==The signal is caused by a READ memory access.
==151968==Hint: address points to the zero page.
    #0 0x63106f667a0f in std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>::basic_string(std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>> const&) /usr/bin/../lib/gcc/x86_64-linux-gnu/13/../../../../include/c++/13/bits/basic_string.h:551
    #1 0x63106f667a0f in Imf_3_4::viewFromChannelName(std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>> const&, std::vector<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>, std::allocator<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>>> const&) /home/br0nzu/openexr/v3.4.13/sources/openexr-3.4.13/src/lib/OpenEXR/ImfMultiView.cpp:121:16
    #2 0x63106f63e417 in void Imf_3_4::GetChannelsInMultiPartFile<std::vector<Imf_3_4::MultiViewChannelName, std::allocator<Imf_3_4::MultiViewChannelName>>>(Imf_3_4::MultiPartInputFile const&, std::vector<Imf_3_4::MultiViewChannelName, std::allocator<Imf_3_4::MultiViewChannelName>>&) /home/br0nzu/openexr/v3.4.13/sources/openexr-3.4.13/src/lib/OpenEXR/ImfPartHelper.h:215:26
    #3 0x63106f63d6c4 in main /home/br0nzu/openexr/v3.4.13/report/32. OpenEXR v3.4.13 empty multiView viewFromChannelName file crash/poc_artifacts/probe_empty_multiview_helper.cpp:10:5
    #4 0x7b4609e2a1c9 in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16
    #5 0x7b4609e2a28a in __libc_start_main csu/../csu/libc-start.c:360:3
    #6 0x63106f561dc4 in _start (/home/br0nzu/openexr/v3.4.13/report/32. OpenEXR v3.4.13 empty multiView viewFromChannelName file crash/run_logs/bin/v3_probe_asan+0x70dc4) (BuildId: 2b2489dc599cc476e64d4194bb2ccd20d8c4b0f6)

AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV /home/br0nzu/openexr/v3.4.13/sources/openexr-3.4.13/src/lib/OpenEXR/ImfMultiView.cpp:121:16 in Imf_3_4::viewFromChannelName(std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>> const&, std::vector<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>, std::allocator<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>>> const&)
==151968==ABORTING
timeout: the monitored command dumped core

v3 asan return code

v3 ubsan log

/usr/bin/../lib/gcc/x86_64-linux-gnu/13/../../../../include/c++/13/bits/stl_vector.h:1148:9: runtime error: reference binding to null pointer of type 'const value_type' (aka 'const std::basic_string<char>')
    #0 0x641a935f25e3 in std::vector<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>, std::allocator<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>>>::operator[](unsigned long) const /usr/bin/../lib/gcc/x86_64-linux-gnu/13/../../../../include/c++/13/bits/stl_vector.h:1148:2
    #1 0x641a935f25e3 in Imf_3_4::viewFromChannelName(std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>> const&, std::vector<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>, std::allocator<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>>> const&) /home/br0nzu/openexr/v3.4.13/sources/openexr-3.4.13/src/lib/OpenEXR/ImfMultiView.cpp:121:16
    #2 0x641a935d3941 in void Imf_3_4::GetChannelsInMultiPartFile<std::vector<Imf_3_4::MultiViewChannelName, std::allocator<Imf_3_4::MultiViewChannelName>>>(Imf_3_4::MultiPartInputFile const&, std::vector<Imf_3_4::MultiViewChannelName, std::allocator<Imf_3_4::MultiViewChannelName>>&) /home/br0nzu/openexr/v3.4.13/sources/openexr-3.4.13/src/lib/OpenEXR/ImfPartHelper.h:215:26
    #3 0x641a935d35cb in main /home/br0nzu/openexr/v3.4.13/report/32. OpenEXR v3.4.13 empty multiView viewFromChannelName file crash/poc_artifacts/probe_empty_multiview_helper.cpp:10:5
    #4 0x7a3dd5c2a1c9 in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16
    #5 0x7a3dd5c2a28a in __libc_start_main csu/../csu/libc-start.c:360:3
    #6 0x641a935a8264 in _start (/home/br0nzu/openexr/v3.4.13/report/32. OpenEXR v3.4.13 empty multiView viewFromChannelName file crash/run_logs/bin/v3_probe_ubsan+0x124264) (BuildId: 57ed0161445f37dc73c9dc5842900cbbf8dd4024)

SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior /usr/bin/../lib/gcc/x86_64-linux-gnu/13/../../../../include/c++/13/bits/stl_vector.h:1148:9 
timeout: the monitored command dumped core

v3 ubsan return code

v3 msan log

==171089==WARNING: MemorySanitizer: use-of-uninitialized-value
    #0 0x55555563a727 in std::char_traits<char>::assign(char&, char const&) /usr/bin/../lib/gcc/x86_64-linux-gnu/13/../../../../include/c++/13/bits/char_traits.h:358:7
    #1 0x55555563a727 in std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>::_S_copy(char*, char const*, unsigned long) /usr/bin/../lib/gcc/x86_64-linux-gnu/13/../../../../include/c++/13/bits/basic_string.h:428:4
    #2 0x55555563a727 in std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>::_S_copy_chars(char*, char*, char*) /usr/bin/../lib/gcc/x86_64-linux-gnu/13/../../../../include/c++/13/bits/basic_string.h:478:9
    #3 0x55555563a727 in void std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>::_M_construct<char*>(char*, char*, std::forward_iterator_tag) /usr/bin/../lib/gcc/x86_64-linux-gnu/13/../../../../include/c++/13/bits/basic_string.tcc:247:2
    #4 0x55555565d032 in Imf_3_4::viewFromChannelName(std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>> const&, std::vector<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>, std::allocator<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>>> const&) /home/br0nzu/openexr/v3.4.13/sources/openexr-3.4.13/src/lib/OpenEXR/ImfMultiView.cpp:109:35
    #5 0x555555637a05 in void Imf_3_4::GetChannelsInMultiPartFile<std::vector<Imf_3_4::MultiViewChannelName, std::allocator<Imf_3_4::MultiViewChannelName>>>(Imf_3_4::MultiPartInputFile const&, std::vector<Imf_3_4::MultiViewChannelName, std::allocator<Imf_3_4::MultiViewChannelName>>&) /home/br0nzu/openexr/v3.4.13/sources/openexr-3.4.13/src/lib/OpenEXR/ImfPartHelper.h:215:26
    #6 0x555555636f0a in main /home/br0nzu/openexr/v3.4.13/report/32. OpenEXR v3.4.13 empty multiView viewFromChannelName file crash/poc_artifacts/probe_empty_multiview_helper.cpp:10:5
    #7 0x7ffff782a1c9 in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16
    #8 0x7ffff782a28a in __libc_start_main csu/../csu/libc-start.c:360:3
    #9 0x55555559cea4 in _start (/home/br0nzu/openexr/v3.4.13/report/32. OpenEXR v3.4.13 empty multiView viewFromChannelName file crash/run_logs/bin/v3_probe_msan+0x48ea4) (BuildId: ca88f1d07306f852c7f2e43324fad669166a93b8)

  Uninitialized value was created by an allocation of 'agg.tmp' in the stack frame
    #0 0x55555565cff2 in Imf_3_4::viewFromChannelName(std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>> const&, std::vector<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>, std::allocator<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>>> const&) /home/br0nzu/openexr/v3.4.13/sources/openexr-3.4.13/src/lib/OpenEXR/ImfMultiView.cpp:99

SUMMARY: MemorySanitizer: use-of-uninitialized-value /home/br0nzu/openexr/v3.4.13/sources/openexr-3.4.13/src/lib/OpenEXR/ImfMultiView.cpp:109:35 in Imf_3_4::viewFromChannelName(std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>> const&, std::vector<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>, std::allocator<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>>> const&)
Exiting
timeout: the monitored command dumped core

v3 msan return code

main original log

timeout: the monitored command dumped core

main original return code

main asan log

AddressSanitizer:DEADLYSIGNAL
=================================================================
==182424==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000000 (pc 0x582b4be7393f bp 0x7ffd2df27910 sp 0x7ffd2df27860 T0)
==182424==The signal is caused by a READ memory access.
==182424==Hint: address points to the zero page.
    #0 0x582b4be7393f in std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>::basic_string(std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>> const&) /usr/bin/../lib/gcc/x86_64-linux-gnu/13/../../../../include/c++/13/bits/basic_string.h:551
    #1 0x582b4be7393f in Imf_4_0::viewFromChannelName(std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>> const&, std::vector<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>, std::allocator<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>>> const&) /home/br0nzu/openexr/v3.4.13/sources/openexr-main/src/lib/OpenEXR/ImfMultiView.cpp:121:16
    #2 0x582b4be4a407 in void Imf_4_0::GetChannelsInMultiPartFile<std::vector<Imf_4_0::MultiViewChannelName, std::allocator<Imf_4_0::MultiViewChannelName>>>(Imf_4_0::MultiPartInputFile const&, std::vector<Imf_4_0::MultiViewChannelName, std::allocator<Imf_4_0::MultiViewChannelName>>&) /home/br0nzu/openexr/v3.4.13/sources/openexr-main/src/lib/OpenEXR/ImfPartHelper.h:215:26
    #3 0x582b4be496b4 in main /home/br0nzu/openexr/v3.4.13/report/32. OpenEXR v3.4.13 empty multiView viewFromChannelName file crash/poc_artifacts/probe_empty_multiview_helper.cpp:10:5
    #4 0x77052a02a1c9 in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16
    #5 0x77052a02a28a in __libc_start_main csu/../csu/libc-start.c:360:3
    #6 0x582b4bd6ddb4 in _start (/home/br0nzu/openexr/v3.4.13/report/32. OpenEXR v3.4.13 empty multiView viewFromChannelName file crash/run_logs/bin/main_probe_asan+0x70db4) (BuildId: 0651e086be4c7a89ef6d0dfa43193fcbad067c68)

AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV /home/br0nzu/openexr/v3.4.13/sources/openexr-main/src/lib/OpenEXR/ImfMultiView.cpp:121:16 in Imf_4_0::viewFromChannelName(std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>> const&, std::vector<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>, std::allocator<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>>> const&)
==182424==ABORTING
timeout: the monitored command dumped core

main asan return code

main ubsan log

/usr/bin/../lib/gcc/x86_64-linux-gnu/13/../../../../include/c++/13/bits/stl_vector.h:1148:9: runtime error: reference binding to null pointer of type 'const value_type' (aka 'const std::basic_string<char>')
    #0 0x5ef49d749563 in std::vector<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>, std::allocator<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>>>::operator[](unsigned long) const /usr/bin/../lib/gcc/x86_64-linux-gnu/13/../../../../include/c++/13/bits/stl_vector.h:1148:2
    #1 0x5ef49d749563 in Imf_4_0::viewFromChannelName(std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>> const&, std::vector<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>, std::allocator<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>>> const&) /home/br0nzu/openexr/v3.4.13/sources/openexr-main/src/lib/OpenEXR/ImfMultiView.cpp:121:16
    #2 0x5ef49d72a931 in void Imf_4_0::GetChannelsInMultiPartFile<std::vector<Imf_4_0::MultiViewChannelName, std::allocator<Imf_4_0::MultiViewChannelName>>>(Imf_4_0::MultiPartInputFile const&, std::vector<Imf_4_0::MultiViewChannelName, std::allocator<Imf_4_0::MultiViewChannelName>>&) /home/br0nzu/openexr/v3.4.13/sources/openexr-main/src/lib/OpenEXR/ImfPartHelper.h:215:26
    #3 0x5ef49d72a5bb in main /home/br0nzu/openexr/v3.4.13/report/32. OpenEXR v3.4.13 empty multiView viewFromChannelName file crash/poc_artifacts/probe_empty_multiview_helper.cpp:10:5
    #4 0x7db27502a1c9 in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16
    #5 0x7db27502a28a in __libc_start_main csu/../csu/libc-start.c:360:3
    #6 0x5ef49d6ff254 in _start (/home/br0nzu/openexr/v3.4.13/report/32. OpenEXR v3.4.13 empty multiView viewFromChannelName file crash/run_logs/bin/main_probe_ubsan+0x125254) (BuildId: fd1e9ab8ee5d4d96d970655c6d53653225e9e148)

SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior /usr/bin/../lib/gcc/x86_64-linux-gnu/13/../../../../include/c++/13/bits/stl_vector.h:1148:9 
timeout: the monitored command dumped core

main ubsan return code

main msan log

==200216==WARNING: MemorySanitizer: use-of-uninitialized-value
    #0 0x5555556a8cb7 in std::_Rb_tree<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>, std::pair<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>> const, Imf_4_0::Compression>, std::_Select1st<std::pair<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>> const, Imf_4_0::Compression>>, std::less<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>>, std::allocator<std::pair<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>> const, Imf_4_0::Compression>>>::_M_get_insert_unique_pos(std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>> const&) /usr/bin/../lib/gcc/x86_64-linux-gnu/13/../../../../include/c++/13/bits/stl_tree.h:2115:7
    #1 0x5555556a8363 in std::_Rb_tree<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>, std::pair<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>> const, Imf_4_0::Compression>, std::_Select1st<std::pair<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>> const, Imf_4_0::Compression>>, std::less<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>>, std::allocator<std::pair<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>> const, Imf_4_0::Compression>>>::_M_get_insert_hint_unique_pos(std::_Rb_tree_const_iterator<std::pair<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>> const, Imf_4_0::Compression>>, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>> const&) /usr/bin/../lib/gcc/x86_64-linux-gnu/13/../../../../include/c++/13/bits/stl_tree.h:2224:13
    #2 0x5555556a8363 in std::_Rb_tree_iterator<std::pair<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>> const, Imf_4_0::Compression>> std::_Rb_tree<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>, std::pair<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>> const, Imf_4_0::Compression>, std::_Select1st<std::pair<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>> const, Imf_4_0::Compression>>, std::less<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>>, std::allocator<std::pair<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>> const, Imf_4_0::Compression>>>::_M_insert_unique_<std::pair<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>> const, Imf_4_0::Compression> const&, std::_Rb_tree<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>, std::pair<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>> const, Imf_4_0::Compression>, std::_Select1st<std::pair<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>> const, Imf_4_0::Compression>>, std::less<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>>, std::allocator<std::pair<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>> const, Imf_4_0::Compression>>>::_Alloc_node>(std::_Rb_tree_const_iterator<std::pair<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>> const, Imf_4_0::Compression>>, std::pair<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>> const, Imf_4_0::Compression> const&, std::_Rb_tree<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>, std::pair<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>> const, Imf_4_0::Compression>, std::_Select1st<std::pair<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>> const, Imf_4_0::Compression>>, std::less<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>>, std::allocator<std::pair<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>> const, Imf_4_0::Compression>>>::_Alloc_node&) /usr/bin/../lib/gcc/x86_64-linux-gnu/13/../../../../include/c++/13/bits/stl_tree.h:2281:4
    #3 0x5555556a8363 in std::enable_if<__same_value_type<std::pair<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>> const, Imf_4_0::Compression> const*>::value, void>::type std::_Rb_tree<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>, std::pair<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>> const, Imf_4_0::Compression>, std::_Select1st<std::pair<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>> const, Imf_4_0::Compression>>, std::less<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>>, std::allocator<std::pair<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>> const, Imf_4_0::Compression>>>::_M_insert_range_unique<std::pair<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>> const, Imf_4_0::Compression> const*>(std::pair<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>> const, Imf_4_0::Compression> const*, std::pair<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>> const, Imf_4_0::Compression> const*) /usr/bin/../lib/gcc/x86_64-linux-gnu/13/../../../../include/c++/13/bits/stl_tree.h:1104:6
    #4 0x5555556a8363 in std::map<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>, Imf_4_0::Compression, std::less<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>>, std::allocator<std::pair<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>> const, Imf_4_0::Compression>>>::map(std::initializer_list<std::pair<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>> const, Imf_4_0::Compression>>, std::less<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>> const&, std::allocator<std::pair<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>> const, Imf_4_0::Compression>> const&) /usr/bin/../lib/gcc/x86_64-linux-gnu/13/../../../../include/c++/13/bits/stl_map.h:244:14
    #5 0x55555559ace8 in __cxx_global_var_init.24 /home/br0nzu/openexr/v3.4.13/sources/openexr-main/src/lib/OpenEXR/ImfCompression.cpp:195:71
    #6 0x55555559ace8 in _GLOBAL__sub_I_ImfCompression.cpp /home/br0nzu/openexr/v3.4.13/sources/openexr-main/src/lib/OpenEXR/ImfCompression.cpp
    #7 0x7ffff782a303 in call_init csu/../csu/libc-start.c:145:3
    #8 0x7ffff782a303 in __libc_start_main csu/../csu/libc-start.c:347:5
    #9 0x55555559cac4 in _start (/home/br0nzu/openexr/v3.4.13/report/32. OpenEXR v3.4.13 empty multiView viewFromChannelName file crash/run_logs/bin/main_probe_msan+0x48ac4) (BuildId: 273703d1f1c8838cbbe259813be04b6eee104200)

  Uninitialized value was created by a heap allocation
    #0 0x555555635a30 in operator new(unsigned long) (/home/br0nzu/openexr/v3.4.13/report/32. OpenEXR v3.4.13 empty multiView viewFromChannelName file crash/run_logs/bin/main_probe_msan+0xe1a30) (BuildId: 273703d1f1c8838cbbe259813be04b6eee104200)
    #1 0x5555556a8984 in std::__new_allocator<std::_Rb_tree_node<std::pair<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>> const, Imf_4_0::Compression>>>::allocate(unsigned long, void const*) /usr/bin/../lib/gcc/x86_64-linux-gnu/13/../../../../include/c++/13/bits/new_allocator.h:151:27
    #2 0x5555556a8984 in std::allocator_traits<std::allocator<std::_Rb_tree_node<std::pair<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>> const, Imf_4_0::Compression>>>>::allocate(std::allocator<std::_Rb_tree_node<std::pair<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>> const, Imf_4_0::Compression>>>&, unsigned long) /usr/bin/../lib/gcc/x86_64-linux-gnu/13/../../../../include/c++/13/bits/alloc_traits.h:482:20
    #3 0x5555556a8984 in std::_Rb_tree<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>, std::pair<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>> const, Imf_4_0::Compression>, std::_Select1st<std::pair<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>> const, Imf_4_0::Compression>>, std::less<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>>, std::allocator<std::pair<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>> const, Imf_4_0::Compression>>>::_M_get_node() /usr/bin/../lib/gcc/x86_64-linux-gnu/13/../../../../include/c++/13/bits/stl_tree.h:563:16
    #4 0x5555556a8984 in std::_Rb_tree_node<std::pair<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>> const, Imf_4_0::Compression>>* std::_Rb_tree<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>, std::pair<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>> const, Imf_4_0::Compression>, std::_Select1st<std::pair<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>> const, Imf_4_0::Compression>>, std::less<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>>, std::allocator<std::pair<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>> const, Imf_4_0::Compression>>>::_M_create_node<std::pair<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>> const, Imf_4_0::Compression> const&>(std::pair<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>> const, Imf_4_0::Compression> const&) /usr/bin/../lib/gcc/x86_64-linux-gnu/13/../../../../include/c++/13/bits/stl_tree.h:613:23
    #5 0x5555556a8984 in std::_Rb_tree_node<std::pair<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>> const, Imf_4_0::Compression>>* std::_Rb_tree<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>, std::pair<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>> const, Imf_4_0::Compression>, std::_Select1st<std::pair<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>> const, Imf_4_0::Compression>>, std::less<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>>, std::allocator<std::pair<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>> const, Imf_4_0::Compression>>>::_Alloc_node::operator()<std::pair<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>> const, Imf_4_0::Compression> const&>(std::pair<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>> const, Imf_4_0::Compression> const&) const /usr/bin/../lib/gcc/x86_64-linux-gnu/13/../../../../include/c++/13/bits/stl_tree.h:531:18
    #6 0x5555556a8984 in std::_Rb_tree_iterator<std::pair<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>> const, Imf_4_0::Compression>> std::_Rb_tree<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>, std::pair<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>> const, Imf_4_0::Compression>, std::_Select1st<std::pair<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>> const, Imf_4_0::Compression>>, std::less<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>>, std::allocator<std::pair<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>> const, Imf_4_0::Compression>>>::_M_insert_<std::pair<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>> const, Imf_4_0::Compression> const&, std::_Rb_tree<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>, std::pair<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>> const, Imf_4_0::Compression>, std::_Select1st<std::pair<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>> const, Imf_4_0::Compression>>, std::less<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>>, std::allocator<std::pair<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>> const, Imf_4_0::Compression>>>::_Alloc_node>(std::_Rb_tree_node_base*, std::_Rb_tree_node_base*, std::pair<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>> const, Imf_4_0::Compression> const&, std::_Rb_tree<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>, std::pair<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>> const, Imf_4_0::Compression>, std::_Select1st<std::pair<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>> const, Imf_4_0::Compression>>, std::less<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>>, std::allocator<std::pair<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>> const, Imf_4_0::Compression>>>::_Alloc_node&) /usr/bin/../lib/gcc/x86_64-linux-gnu/13/../../../../include/c++/13/bits/stl_tree.h:1831:19
    #7 0x5555556a83cd in std::_Rb_tree_iterator<std::pair<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>> const, Imf_4_0::Compression>> std::_Rb_tree<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>, std::pair<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>> const, Imf_4_0::Compression>, std::_Select1st<std::pair<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>> const, Imf_4_0::Compression>>, std::less<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>>, std::allocator<std::pair<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>> const, Imf_4_0::Compression>>>::_M_insert_unique_<std::pair<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>> const, Imf_4_0::Compression> const&, std::_Rb_tree<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>, std::pair<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>> const, Imf_4_0::Compression>, std::_Select1st<std::pair<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>> const, Imf_4_0::Compression>>, std::less<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>>, std::allocator<std::pair<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>> const, Imf_4_0::Compression>>>::_Alloc_node>(std::_Rb_tree_const_iterator<std::pair<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>> const, Imf_4_0::Compression>>, std::pair<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>> const, Imf_4_0::Compression> const&, std::_Rb_tree<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>, std::pair<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>> const, Imf_4_0::Compression>, std::_Select1st<std::pair<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>> const, Imf_4_0::Compression>>, std::less<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>>, std::allocator<std::pair<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>> const, Imf_4_0::Compression>>>::_Alloc_node&) /usr/bin/../lib/gcc/x86_64-linux-gnu/13/../../../../include/c++/13/bits/stl_tree.h:2284:9
    #8 0x5555556a83cd in std::enable_if<__same_value_type<std::pair<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>> const, Imf_4_0::Compression> const*>::value, void>::type std::_Rb_tree<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>, std::pair<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>> const, Imf_4_0::Compression>, std::_Select1st<std::pair<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>> const, Imf_4_0::Compression>>, std::less<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>>, std::allocator<std::pair<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>> const, Imf_4_0::Compression>>>::_M_insert_range_unique<std::pair<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>> const, Imf_4_0::Compression> const*>(std::pair<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>> const, Imf_4_0::Compression> const*, std::pair<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>> const, Imf_4_0::Compression> const*) /usr/bin/../lib/gcc/x86_64-linux-gnu/13/../../../../include/c++/13/bits/stl_tree.h:1104:6
    #9 0x5555556a83cd in std::map<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>, Imf_4_0::Compression, std::less<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>>, std::allocator<std::pair<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>> const, Imf_4_0::Compression>>>::map(std::initializer_list<std::pair<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>> const, Imf_4_0::Compression>>, std::less<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>> const&, std::allocator<std::pair<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>> const, Imf_4_0::Compression>> const&) /usr/bin/../lib/gcc/x86_64-linux-gnu/13/../../../../include/c++/13/bits/stl_map.h:244:14
    #10 0x55555559ace8 in __cxx_global_var_init.24 /home/br0nzu/openexr/v3.4.13/sources/openexr-main/src/lib/OpenEXR/ImfCompression.cpp:195:71
    #11 0x55555559ace8 in _GLOBAL__sub_I_ImfCompression.cpp /home/br0nzu/openexr/v3.4.13/sources/openexr-main/src/lib/OpenEXR/ImfCompression.cpp
    #12 0x7ffff782a303 in call_init csu/../csu/libc-start.c:145:3
    #13 0x7ffff782a303 in __libc_start_main csu/../csu/libc-start.c:347:5
    #14 0x55555559cac4 in _start (/home/br0nzu/openexr/v3.4.13/report/32. OpenEXR v3.4.13 empty multiView viewFromChannelName file crash/run_logs/bin/main_probe_msan+0x48ac4) (BuildId: 273703d1f1c8838cbbe259813be04b6eee104200)

SUMMARY: MemorySanitizer: use-of-uninitialized-value /home/br0nzu/openexr/v3.4.13/sources/openexr-main/src/lib/OpenEXR/ImfCompression.cpp:195:71 in __cxx_global_var_init.24
Exiting
timeout: the monitored command dumped core

main msan return code

Impact

A crafted EXR file can crash applications or tools that process multi-view channel metadata through GetChannelsInMultiPartFile() or equivalent viewFromChannelName() flows. The demonstrated impact is deterministic denial of service / process crash from an out-of-bounds vector access. Because the dereference is controlled by malformed file metadata and occurs in a common metadata-helper path, consumers that inspect or convert multi-view/multipart channel layouts before rejecting malformed input are impacted.

CTRL-OS 26.05