OpenEXR/SOURCES/openexr-CVE-2026-27622.patch

23 lines
864 B
Diff

diff -urNp a/IlmImf/ImfCompositeDeepScanLine.cpp b/IlmImf/ImfCompositeDeepScanLine.cpp
--- a/IlmImf/ImfCompositeDeepScanLine.cpp 2026-04-14 08:44:06.993263491 +0200
+++ b/IlmImf/ImfCompositeDeepScanLine.cpp 2026-04-14 09:22:40.284776121 +0200
@@ -44,6 +44,7 @@
#include <Iex.h>
#include <vector>
+#include <limits>
OPENEXR_IMF_INTERNAL_NAMESPACE_SOURCE_ENTER
using std::vector;
@@ -488,6 +489,10 @@ CompositeDeepScanLine::readPixels(int st
num_sources[ptr]=0;
for(size_t j=0;j<parts;j++)
{
+ if (total_sizes[ptr] > std::numeric_limits<unsigned int>::max() - counts[j][ptr])
+ throw IEX_NAMESPACE::ArgExc (
+ "Cannot composite scanline: pixel cannot have more than UINT_MAX samples");
+
total_sizes[ptr]+=counts[j][ptr];
if(counts[j][ptr]>0) num_sources[ptr]++;
}