Skip to content

GHSA-m799-ffc3-8pxc

CVE Information

Summary

OpenEXRUtil v3.4.12 can return an out-of-bounds pointer from the documented SampleCountChannel::row(row) API when a deep image has a non-zero dataWindow origin. The primary PoC crashes the original build with SIGSEGV, ASAN and UBSAN report a read-triggered SEGV at row(0)[0], and MSAN exits before useful PoC evidence with the same static-initialization warning seen in this local MSAN build.

A separate original-build marker probe demonstrates potential information disclosure under a controlled heap layout: row(0)[idx] can read a later heap word and return a synthetic marker value.

Details

Root cause:

  • src/lib/OpenEXRUtil/ImfSampleCountChannel.h:87-95 documents row(r) as 0-based row access.
  • src/lib/OpenEXRUtil/ImfSampleCountChannel.h:316-320 returns _base + r * pixelsPerRow().
  • src/lib/OpenEXRUtil/ImfSampleCountChannel.cpp:323-326 sets _base to _numSamples - dataWindow.min.y * pixelsPerRow() - dataWindow.min.x for absolute-coordinate access.

Those two coordinate models conflict for non-zero dataWindow.min. at(dataWindow.min.x, dataWindow.min.y) is valid, but documented row(0) should start at the first logical row and instead points outside the _numSamples allocation.

Primary PoC input:

file: poc_samplecount_row_read_minx0_minyneg32768.exr
dataWindow: (0, -32768) - (7, -32761)
channel: Z, FLOAT
type: deepscanline

For this 8x8 image, pixelsPerRow() == 8 and dataWindow.min.y == -32768, so row(0) is shifted 262144 unsigned int elements past _numSamples, while the allocation contains only 64 elements.

Fresh local verification:

original primary -> SIGSEGV, rc=139
ASAN primary     -> SEGV caused by READ at repro_sample_count_row_read.cpp:29, rc=134
UBSAN primary    -> SEGV caused by READ at repro_sample_count_row_read.cpp:29, rc=134
MSAN primary     -> pre-input static-initialization report, rc=134
original marker  -> marker-scan HIT, rc=77

PoC

poc.zip contains only reproducible PoC files, helper sources/scripts, and fresh logs:

poc.zip

README.md
poc_samplecount_row_read_minx0_minyneg32768.exr
marker20.exr
repro/repro_sample_count_row_read.cpp
repro/probe_sample_row_marker.cpp
repro/build_repro.sh
repro/run_repro.sh
logs/original_primary.log
logs/asan_primary.log
logs/ubsan_primary.log
logs/msan_primary.log
logs/original_marker_recheck.log

Run from the OpenEXR v3.4.12 workspace root:

mkdir -p artifacts/tmp/report20-poc
unzip -o 'report/20. OpenEXRUtil SampleCountChannel row nonzero dataWindow heap OOB read/poc.zip' -d artifacts/tmp/report20-poc

artifacts/tmp/report20-poc/repro/build_repro.sh "$PWD" original
artifacts/tmp/report20-poc/repro/build_repro.sh "$PWD" asan
artifacts/tmp/report20-poc/repro/build_repro.sh "$PWD" ubsan
artifacts/tmp/report20-poc/repro/build_repro.sh "$PWD" msan

artifacts/tmp/report20-poc/repro/run_repro.sh "$PWD" original primary
artifacts/tmp/report20-poc/repro/run_repro.sh "$PWD" asan primary
artifacts/tmp/report20-poc/repro/run_repro.sh "$PWD" ubsan primary
artifacts/tmp/report20-poc/repro/run_repro.sh "$PWD" msan primary
artifacts/tmp/report20-poc/repro/run_repro.sh "$PWD" original marker

Full ASAN log

AddressSanitizer:DEADLYSIGNAL
=================================================================
==1280159==ERROR: AddressSanitizer: SEGV on unknown address 0x5110001002c0 (pc 0x60d5e989f144 bp 0x7ffed7af3ea0 sp 0x7ffed7af3e00 T0)
==1280159==The signal is caused by a READ memory access.
    #0 0x60d5e989f144 in main /home/br0nzu/openexr/v3.4.12/artifacts/tmp/report20-clean/repro/repro_sample_count_row_read.cpp:29:22
    #1 0x77706a82a1c9 in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16
    #2 0x77706a82a28a in __libc_start_main csu/../csu/libc-start.c:360:3
    #3 0x60d5e97c35c4 in _start (/home/br0nzu/openexr/v3.4.12/artifacts/tmp/report20-clean/bin/repro_sample_count_row_read_asan+0x795c4)

AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV /home/br0nzu/openexr/v3.4.12/artifacts/tmp/report20-clean/repro/repro_sample_count_row_read.cpp:29:22 in main
==1280159==ABORTING

Full UBSAN log

UndefinedBehaviorSanitizer:DEADLYSIGNAL
==1280166==ERROR: UndefinedBehaviorSanitizer: SEGV on unknown address 0x564af6845c10 (pc 0x564abf479e22 bp 0x7ffe835e0b90 sp 0x7ffe835e0b00 T1280166)
==1280166==The signal is caused by a READ memory access.
    #0 0x564abf479e22 in main /home/br0nzu/openexr/v3.4.12/artifacts/tmp/report20-clean/repro/repro_sample_count_row_read.cpp:29:22
    #1 0x75528a42a1c9 in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16
    #2 0x75528a42a28a in __libc_start_main csu/../csu/libc-start.c:360:3
    #3 0x564abf44e7c4 in _start (/home/br0nzu/openexr/v3.4.12/artifacts/tmp/report20-clean/bin/repro_sample_count_row_read_ubsan+0x1807c4)

UndefinedBehaviorSanitizer can not provide additional info.
SUMMARY: UndefinedBehaviorSanitizer: SEGV /home/br0nzu/openexr/v3.4.12/artifacts/tmp/report20-clean/repro/repro_sample_count_row_read.cpp:29:22 in main
==1280166==ABORTING

Full MSAN log

==1280172==WARNING: MemorySanitizer: use-of-uninitialized-value
    #0 0x55555567fab7 in std::_Rb_tree<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>, std::pair<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>> const, Imf_3_4::Compression>, std::_Select1st<std::pair<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>> const, Imf_3_4::Compression>>, std::less<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>>, std::allocator<std::pair<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>> const, Imf_3_4::Compression>>>::_M_get_insert_unique_pos(std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>> const&) /usr/bin/../lib/gcc/x86_64-linux-gnu/13/../../../../include/c++/13/bits/stl_tree.h:2115:7
    #1 0x55555567f163 in std::_Rb_tree<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>, std::pair<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>> const, Imf_3_4::Compression>, std::_Select1st<std::pair<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>> const, Imf_3_4::Compression>>, std::less<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>>, std::allocator<std::pair<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>> const, Imf_3_4::Compression>>>::_M_get_insert_hint_unique_pos(std::_Rb_tree_const_iterator<std::pair<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>> const, Imf_3_4::Compression>>, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>> const&) /usr/bin/../lib/gcc/x86_64-linux-gnu/13/../../../../include/c++/13/bits/stl_tree.h:2224:13
    #2 0x55555567f163 in std::_Rb_tree_iterator<std::pair<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>> const, Imf_3_4::Compression>> std::_Rb_tree<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>, std::pair<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>> const, Imf_3_4::Compression>, std::_Select1st<std::pair<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>> const, Imf_3_4::Compression>>, std::less<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>>, std::allocator<std::pair<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>> const, Imf_3_4::Compression>>>::_M_insert_unique_<std::pair<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>> const, Imf_3_4::Compression> const&, std::_Rb_tree<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>, std::pair<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>> const, Imf_3_4::Compression>, std::_Select1st<std::pair<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>> const, Imf_3_4::Compression>>, std::less<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>>, std::allocator<std::pair<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>> const, Imf_3_4::Compression>>>::_Alloc_node>(std::_Rb_tree_const_iterator<std::pair<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>> const, Imf_3_4::Compression>>, std::pair<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>> const, Imf_3_4::Compression> const&, std::_Rb_tree<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>, std::pair<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>> const, Imf_3_4::Compression>, std::_Select1st<std::pair<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>> const, Imf_3_4::Compression>>, std::less<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>>, std::allocator<std::pair<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>> const, Imf_3_4::Compression>>>::_Alloc_node&) /usr/bin/../lib/gcc/x86_64-linux-gnu/13/../../../../include/c++/13/bits/stl_tree.h:2281:4
    #3 0x55555567f163 in std::enable_if<__same_value_type<std::pair<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>> const, Imf_3_4::Compression> const*>::value, void>::type std::_Rb_tree<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>, std::pair<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>> const, Imf_3_4::Compression>, std::_Select1st<std::pair<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>> const, Imf_3_4::Compression>>, std::less<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>>, std::allocator<std::pair<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>> const, Imf_3_4::Compression>>>::_M_insert_range_unique<std::pair<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>> const, Imf_3_4::Compression> const*>(std::pair<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>> const, Imf_3_4::Compression> const*, std::pair<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>> const, Imf_3_4::Compression> const*) /usr/bin/../lib/gcc/x86_64-linux-gnu/13/../../../../include/c++/13/bits/stl_tree.h:1104:6
    #4 0x55555567f163 in std::map<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>, Imf_3_4::Compression, std::less<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>>, std::allocator<std::pair<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>> const, Imf_3_4::Compression>>>::map(std::initializer_list<std::pair<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>> const, Imf_3_4::Compression>>, std::less<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>> const&, std::allocator<std::pair<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>> const, Imf_3_4::Compression>> const&) /usr/bin/../lib/gcc/x86_64-linux-gnu/13/../../../../include/c++/13/bits/stl_map.h:244:14
    #5 0x55555559cae8 in __cxx_global_var_init.24 /home/br0nzu/openexr/v3.4.12/sources/openexr-3.4.12/src/lib/OpenEXR/ImfCompression.cpp:195:71
    #6 0x55555559cae8 in _GLOBAL__sub_I_ImfCompression.cpp /home/br0nzu/openexr/v3.4.12/sources/openexr-3.4.12/src/lib/OpenEXR/ImfCompression.cpp
    #7 0x7ffff782a303 in call_init csu/../csu/libc-start.c:145:3
    #8 0x7ffff782a303 in __libc_start_main csu/../csu/libc-start.c:347:5
    #9 0x55555559f8c4 in _start (/home/br0nzu/openexr/v3.4.12/artifacts/tmp/report20-clean/bin/repro_sample_count_row_read_msan+0x4b8c4)

  Uninitialized value was created by a heap allocation
    #0 0x555555638830 in operator new(unsigned long) (/home/br0nzu/openexr/v3.4.12/artifacts/tmp/report20-clean/bin/repro_sample_count_row_read_msan+0xe4830)
    #1 0x55555567f784 in std::__new_allocator<std::_Rb_tree_node<std::pair<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>> const, Imf_3_4::Compression>>>::allocate(unsigned long, void const*) /usr/bin/../lib/gcc/x86_64-linux-gnu/13/../../../../include/c++/13/bits/new_allocator.h:151:27
    #2 0x55555567f784 in std::allocator_traits<std::allocator<std::_Rb_tree_node<std::pair<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>> const, Imf_3_4::Compression>>>>::allocate(std::allocator<std::_Rb_tree_node<std::pair<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>> const, Imf_3_4::Compression>>>&, unsigned long) /usr/bin/../lib/gcc/x86_64-linux-gnu/13/../../../../include/c++/13/bits/alloc_traits.h:482:20
    #3 0x55555567f784 in std::_Rb_tree<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>, std::pair<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>> const, Imf_3_4::Compression>, std::_Select1st<std::pair<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>> const, Imf_3_4::Compression>>, std::less<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>>, std::allocator<std::pair<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>> const, Imf_3_4::Compression>>>::_M_get_node() /usr/bin/../lib/gcc/x86_64-linux-gnu/13/../../../../include/c++/13/bits/stl_tree.h:563:16
    #4 0x55555567f784 in std::_Rb_tree_node<std::pair<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>> const, Imf_3_4::Compression>>* std::_Rb_tree<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>, std::pair<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>> const, Imf_3_4::Compression>, std::_Select1st<std::pair<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>> const, Imf_3_4::Compression>>, std::less<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>>, std::allocator<std::pair<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>> const, Imf_3_4::Compression>>>::_M_create_node<std::pair<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>> const, Imf_3_4::Compression> const&>(std::pair<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>> const, Imf_3_4::Compression> const&) /usr/bin/../lib/gcc/x86_64-linux-gnu/13/../../../../include/c++/13/bits/stl_tree.h:613:23
    #5 0x55555567f784 in std::_Rb_tree_node<std::pair<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>> const, Imf_3_4::Compression>>* std::_Rb_tree<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>, std::pair<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>> const, Imf_3_4::Compression>, std::_Select1st<std::pair<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>> const, Imf_3_4::Compression>>, std::less<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>>, std::allocator<std::pair<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>> const, Imf_3_4::Compression>>>::_Alloc_node::operator()<std::pair<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>> const, Imf_3_4::Compression> const&>(std::pair<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>> const, Imf_3_4::Compression> const&) const /usr/bin/../lib/gcc/x86_64-linux-gnu/13/../../../../include/c++/13/bits/stl_tree.h:531:18
    #6 0x55555567f784 in std::_Rb_tree_iterator<std::pair<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>> const, Imf_3_4::Compression>> std::_Rb_tree<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>, std::pair<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>> const, Imf_3_4::Compression>, std::_Select1st<std::pair<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>> const, Imf_3_4::Compression>>, std::less<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>>, std::allocator<std::pair<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>> const, Imf_3_4::Compression>>>::_M_insert_<std::pair<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>> const, Imf_3_4::Compression> const&, std::_Rb_tree<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>, std::pair<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>> const, Imf_3_4::Compression>, std::_Select1st<std::pair<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>> const, Imf_3_4::Compression>>, std::less<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>>, std::allocator<std::pair<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>> const, Imf_3_4::Compression>>>::_Alloc_node>(std::_Rb_tree_node_base*, std::_Rb_tree_node_base*, std::pair<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>> const, Imf_3_4::Compression> const&, std::_Rb_tree<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>, std::pair<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>> const, Imf_3_4::Compression>, std::_Select1st<std::pair<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>> const, Imf_3_4::Compression>>, std::less<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>>, std::allocator<std::pair<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>> const, Imf_3_4::Compression>>>::_Alloc_node&) /usr/bin/../lib/gcc/x86_64-linux-gnu/13/../../../../include/c++/13/bits/stl_tree.h:1831:19
    #7 0x55555567f1cd in std::_Rb_tree_iterator<std::pair<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>> const, Imf_3_4::Compression>> std::_Rb_tree<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>, std::pair<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>> const, Imf_3_4::Compression>, std::_Select1st<std::pair<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>> const, Imf_3_4::Compression>>, std::less<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>>, std::allocator<std::pair<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>> const, Imf_3_4::Compression>>>::_M_insert_unique_<std::pair<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>> const, Imf_3_4::Compression> const&, std::_Rb_tree<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>, std::pair<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>> const, Imf_3_4::Compression>, std::_Select1st<std::pair<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>> const, Imf_3_4::Compression>>, std::less<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>>, std::allocator<std::pair<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>> const, Imf_3_4::Compression>>>::_Alloc_node>(std::_Rb_tree_const_iterator<std::pair<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>> const, Imf_3_4::Compression>>, std::pair<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>> const, Imf_3_4::Compression> const&, std::_Rb_tree<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>, std::pair<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>> const, Imf_3_4::Compression>, std::_Select1st<std::pair<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>> const, Imf_3_4::Compression>>, std::less<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>>, std::allocator<std::pair<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>> const, Imf_3_4::Compression>>>::_Alloc_node&) /usr/bin/../lib/gcc/x86_64-linux-gnu/13/../../../../include/c++/13/bits/stl_tree.h:2284:9
    #8 0x55555567f1cd in std::enable_if<__same_value_type<std::pair<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>> const, Imf_3_4::Compression> const*>::value, void>::type std::_Rb_tree<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>, std::pair<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>> const, Imf_3_4::Compression>, std::_Select1st<std::pair<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>> const, Imf_3_4::Compression>>, std::less<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>>, std::allocator<std::pair<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>> const, Imf_3_4::Compression>>>::_M_insert_range_unique<std::pair<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>> const, Imf_3_4::Compression> const*>(std::pair<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>> const, Imf_3_4::Compression> const*, std::pair<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>> const, Imf_3_4::Compression> const*) /usr/bin/../lib/gcc/x86_64-linux-gnu/13/../../../../include/c++/13/bits/stl_tree.h:1104:6
    #9 0x55555567f1cd in std::map<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>, Imf_3_4::Compression, std::less<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>>, std::allocator<std::pair<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>> const, Imf_3_4::Compression>>>::map(std::initializer_list<std::pair<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>> const, Imf_3_4::Compression>>, std::less<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>> const&, std::allocator<std::pair<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>> const, Imf_3_4::Compression>> const&) /usr/bin/../lib/gcc/x86_64-linux-gnu/13/../../../../include/c++/13/bits/stl_map.h:244:14
    #10 0x55555559cae8 in __cxx_global_var_init.24 /home/br0nzu/openexr/v3.4.12/sources/openexr-3.4.12/src/lib/OpenEXR/ImfCompression.cpp:195:71
    #11 0x55555559cae8 in _GLOBAL__sub_I_ImfCompression.cpp /home/br0nzu/openexr/v3.4.12/sources/openexr-3.4.12/src/lib/OpenEXR/ImfCompression.cpp
    #12 0x7ffff782a303 in call_init csu/../csu/libc-start.c:145:3
    #13 0x7ffff782a303 in __libc_start_main csu/../csu/libc-start.c:347:5
    #14 0x55555559f8c4 in _start (/home/br0nzu/openexr/v3.4.12/artifacts/tmp/report20-clean/bin/repro_sample_count_row_read_msan+0x4b8c4)

SUMMARY: MemorySanitizer: use-of-uninitialized-value /home/br0nzu/openexr/v3.4.12/sources/openexr-3.4.12/src/lib/OpenEXR/ImfCompression.cpp:195:71 in __cxx_global_var_init.24
Exiting

Original marker probe log

marker-scan miny=-1000
miny=-1000 w=8 h=8 ns=0x5839f52c25f0 row0=0x5839f52ca2f0 marker=0x5839f52ca220 offset=8000 delta_marker=7948 idx_to_marker=-52 NOHIT
marker-scan miny=-999
miny=-999 w=8 h=8 ns=0x61a92be515f0 row0=0x61a92be592d0 marker=0x61a92be59220 offset=7992 delta_marker=7948 idx_to_marker=-44 NOHIT
marker-scan miny=-998
miny=-998 w=8 h=8 ns=0x5bf54dfa85f0 row0=0x5bf54dfb02b0 marker=0x5bf54dfb0220 offset=7984 delta_marker=7948 idx_to_marker=-36 NOHIT
marker-scan miny=-997
miny=-997 w=8 h=8 ns=0x63b4095d55f0 row0=0x63b4095dd290 marker=0x63b4095dd220 offset=7976 delta_marker=7948 idx_to_marker=-28 NOHIT
marker-scan miny=-996
miny=-996 w=8 h=8 ns=0x63f8db1925f0 row0=0x63f8db19a270 marker=0x63f8db19a220 offset=7968 delta_marker=7948 idx_to_marker=-20 NOHIT
marker-scan miny=-995
miny=-995 w=8 h=8 ns=0x636444cdb5f0 row0=0x636444ce3250 marker=0x636444ce3220 offset=7960 delta_marker=7948 idx_to_marker=-12 NOHIT
marker-scan miny=-994
miny=-994 w=8 h=8 ns=0x57d9096d55f0 row0=0x57d9096dd230 marker=0x57d9096dd220 offset=7952 delta_marker=7948 idx_to_marker=-4 NOHIT
marker-scan miny=-993
miny=-993 w=8 h=8 ns=0x5958e62f95f0 row0=0x5958e6301210 marker=0x5958e6301220 offset=7944 delta_marker=7948 idx_to_marker=4 HIT idx=4 value=0xdead03e1 expected0=0xdead03e1

Impact

An application that accepts a crafted deep EXR, loads it with OpenEXRUtil, and uses SampleCountChannel::row(row) can be crashed by a heap out-of-bounds read. The marker probe also shows potential information disclosure when surrounding heap layout makes the out-of-bounds sample-count entry application-observable.