[sync] PR-188: fix: CVE-2026-59183 CVE-2026-59184 CVE-2026-59186 CVE-2026-59189 CVE-2026-59981 CVE-2026-59982 CVE-2026-61555-OpenEXR-AtomGit

MOpenEXR.spec+11-1

	@@ -1,7 +1,7 @@
1	Name: OpenEXR	1	Name: OpenEXR
2	Summary: A high dynamic-range (HDR) image file format for use in computer imaging applications	2	Summary: A high dynamic-range (HDR) image file format for use in computer imaging applications
3	Version: 3.1.11	3	Version: 3.1.11
4	-Release: 10	4	+Release: 12
5	License: BSD-3-Clause	5	License: BSD-3-Clause
6	URL: http://www.openexr.com/	6	URL: http://www.openexr.com/
7	Source0: https://github.com/AcademySoftwareFoundation/openexr/archive/v%{version}/openexr-%{version}.tar.gz	7	Source0: https://github.com/AcademySoftwareFoundation/openexr/archive/v%{version}/openexr-%{version}.tar.gz
	@@ -20,6 +20,10 @@ Patch10: CVE-2026-42216.patch
20	Patch11: CVE-2026-42217.patch	20	Patch11: CVE-2026-42217.patch
21	Patch12: backport-CVE-2026-59983.patch	21	Patch12: backport-CVE-2026-59983.patch
22	Patch13: backport-CVE-2026-68515.patch	22	Patch13: backport-CVE-2026-68515.patch
		23	+Patch14: backport-CVE-2026-59183.patch
		24	+Patch15: backport-CVE-2026-59184-2026-59189-2026-59981-2026-59982.patch
		25	+Patch16: backport-CVE-2026-59186.patch
		26	+Patch17: backport-CVE-2026-61555.patch
23		27
24	BuildRequires: gcc-c++ zlib-devel pkgconfig python3-devel	28	BuildRequires: gcc-c++ zlib-devel pkgconfig python3-devel
25	BuildRequires: cmake gcc boost-devel pkgconfig(Imath)	29	BuildRequires: cmake gcc boost-devel pkgconfig(Imath)
	@@ -88,6 +92,12 @@ EXCLUDE_REGEX='DWA[AB]Compression'
88	%{_libdir}/pkgconfig/OpenEXR.pc	92	%{_libdir}/pkgconfig/OpenEXR.pc
89		93
90	%changelog	94	%changelog
		95	+* Mon Nov 02 2026 Funda Wang <fundawang@yeah.net> - 3.1.11-12
		96	+- Align release with openEuler-24.03-LTS branches
		97	+
		98	+* Tue Sep 29 2026 chenyanpan <chenyanpan@xfusion.com> - 3.1.11-11
		99	+- Fix CVE-2026-59183 CVE-2026-59184 CVE-2026-59186 CVE-2026-59189 CVE-2026-59981 CVE-2026-59982 CVE-2026-61555
		100	+
91	* Wed Aug 26 2026 chenyanpan <chenyanpan@xfusion.com> - 3.1.11-10	101	* Wed Aug 26 2026 chenyanpan <chenyanpan@xfusion.com> - 3.1.11-10
92	- Fix CVE-2026-59983 CVE-2026-68515	102	- Fix CVE-2026-59983 CVE-2026-68515
93		103

Abackport-CVE-2026-59183.patch+60-0

@@ -0,0 +1,60 @@
	1	+From e2adb5be3bbc3a1f82f2bc06cc9699995a99a607 Mon Sep 17 00:00:00 2001
	2	+From: Cary Phillips <cary@ilm.com>
	3	+Date: Mon, 22 Jun 2026 06:25:03 -0700
	4	+Subject: [PATCH] Fix signed integer overflow in unpack_sample_table() (#2484)
	5	+
	6	+* Fix signed integer overflow in unpack_sample_table()
	7	+
	8	+Declare w and h as int64_t instead of int32_t so that index
	9	+arithmetic yw and wh in unpack_sample_table() does not overflow
	10	+when tile dimensions are large (e.g. 46342x46342).
	11	+
	12	+Addresses https://github.com/AcademySoftwareFoundation/openexr/security/advisories/GHSA-rqp5-pmwm-wj6x
	13	+
	14	+Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
	15	+Signed-off-by: Cary Phillips <cary@ilm.com>
	16	+
	17	+* declare y as int64_t
	18	+
	19	+Signed-off-by: Cary Phillips <cary@ilm.com>
	20	+
	21	+---------
	22	+
	23	+Signed-off-by: Cary Phillips <cary@ilm.com>
	24	+Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
	25	+---
	26	+ src/lib/OpenEXRCore/decoding.c \| 8 ++++----
	27	+ 1 file changed, 4 insertions(+), 4 deletions(-)
	28	+diff --git a/src/lib/OpenEXRCore/decoding.c b/src/lib/OpenEXRCore/decoding.c
	29	+index e6e8ac1..53b9952 100644
	30	+--- a/src/lib/OpenEXRCore/decoding.c
	31	++++ b/src/lib/OpenEXRCore/decoding.c
	32	+@@ -346,8 +346,8 @@ unpack_sample_table (
	33	+ const struct _internal_exr_context* pctxt, exr_decode_pipeline_t* decode)
	34	+ {
	35	+ exr_result_t rv = EXR_ERR_SUCCESS;
	36	+- int32_t w = decode->chunk.width;
	37	+- int32_t h = decode->chunk.height;
	38	++ int64_t w = decode->chunk.width;
	39	++ int64_t h = decode->chunk.height;
	40	+ uint64_t totsamp = 0;
	41	+ int32_t* samptable = decode->sample_count_table;
	42	+ size_t combSampSize = 0;
	43	+@@ -357,7 +357,7 @@ unpack_sample_table (
	44	+
	45	+ if ((decode->decode_flags & EXR_DECODE_SAMPLE_COUNTS_AS_INDIVIDUAL))
	46	+ {
	47	+- for (int32_t y = 0; y < h; ++y)
	48	++ for (int64_t y = 0; y < h; ++y)
	49	+ {
	50	+ int32_t cursampline = samptable + y w;
	51	+ int32_t prevsamp = 0;
	52	+@@ -378,7 +378,7 @@ unpack_sample_table (
	53	+ }
	54	+ else
	55	+ {
	56	+- for (int32_t y = 0; y < h; ++y)
	57	++ for (int64_t y = 0; y < h; ++y)
	58	+ {
	59	+ int32_t cursampline = samptable + y w;
	60	+ int32_t prevsamp = 0;

Abackport-CVE-2026-59184-2026-59189-2026-59981-2026-59982.patch+137-0

@@ -0,0 +1,137 @@
	1	+From 37f03b6ed90f3dd9910f31de3a40f25f2bc2aca1 Mon Sep 17 00:00:00 2001
	2	+From: Cary Phillips <cary@ilm.com>
	3	+Date: Sun, 21 Jun 2026 14:39:47 -0700
	4	+Subject: [PATCH] Fix OpenEXRUtil row() OOB read with non-zero data window
	5	+ origin (#2488)
	6	+
	7	+The row() method in TypedDeepImageChannel, TypedFlatImageChannel, and
	8	+SampleCountChannel is documented as 0-based within the data window,
	9	+but used the _base offset meant for absolute (x, y) access. Index the
	10	+compact backing arrays instead so row(0) aliases the first pixel when
	11	+dataWindow.min is non-zero.
	12	+
	13	+Addresses https://github.com/AcademySoftwareFoundation/openexr/security/advisories/GHSA-hwmv-39v6-739m
	14	+
	15	+Signed-off-by: Cary Phillips <cary@ilm.com>
	16	+Co-authored-by: Cursor <cursoragent@cursor.com>
	17	+
	18	+Adapted to openEuler OpenEXR 3.1.11:
	19	+- the row() fix is replayed against the 3.1.11 member layout: the
	20	+ channels use _sampleListPointers / _pixels / _numSamples instead of
	21	+ the upstream _base member names.
	22	+- the testDeepImage.cpp hunk context matches the 3.1.11 test file.
	23	+---
	24	+ src/lib/OpenEXRUtil/ImfDeepImageChannel.h \| 4 ++-
	25	+ src/lib/OpenEXRUtil/ImfFlatImageChannel.h \| 4 ++-
	26	+ src/lib/OpenEXRUtil/ImfSampleCountChannel.h \| 2 +-
	27	+ src/test/OpenEXRUtilTest/testDeepImage.cpp \| 34 +++++++++++++++++++++++++++
	28	+ 4 files changed, 39 insertions(+), 5 deletions(-)
	29	+diff --git a/src/lib/OpenEXRUtil/ImfDeepImageChannel.h b/src/lib/OpenEXRUtil/ImfDeepImageChannel.h
	30	+index df793a4..49a9c77 100644
	31	+--- a/src/lib/OpenEXRUtil/ImfDeepImageChannel.h
	32	++++ b/src/lib/OpenEXRUtil/ImfDeepImageChannel.h
	33	+@@ -265,7 +265,7 @@ template <class T>
	34	+ inline T * const *
	35	+ TypedDeepImageChannel<T>::row (int r)
	36	+ {
	37	+- return _base + r * pixelsPerRow();
	38	++ return _sampleListPointers + r * pixelsPerRow();
	39	+ }
	40	+
	41	+
	42	+@@ -273,7 +273,7 @@ template <class T>
	43	+ inline const T * const *
	44	+ TypedDeepImageChannel<T>::row (int r) const
	45	+ {
	46	+- return _base + r * pixelsPerRow();
	47	++ return _sampleListPointers + r * pixelsPerRow();
	48	+ }
	49	+
	50	+ #ifndef COMPILING_IMF_DEEP_IMAGE_CHANNEL
	51	+diff --git a/src/lib/OpenEXRUtil/ImfFlatImageChannel.h b/src/lib/OpenEXRUtil/ImfFlatImageChannel.h
	52	+index 3ec6507..f16f94e 100644
	53	+--- a/src/lib/OpenEXRUtil/ImfFlatImageChannel.h
	54	++++ b/src/lib/OpenEXRUtil/ImfFlatImageChannel.h
	55	+@@ -218,7 +218,7 @@ template <class T>
	56	+ inline T *
	57	+ TypedFlatImageChannel<T>::row (int r)
	58	+ {
	59	+- return _base + r * pixelsPerRow();
	60	++ return _pixels + r * pixelsPerRow();
	61	+ }
	62	+
	63	+
	64	+@@ -226,7 +226,7 @@ template <class T>
	65	+ inline const T *
	66	+ TypedFlatImageChannel<T>::row (int n) const
	67	+ {
	68	+- return _base + n * pixelsPerRow();
	69	++ return _pixels + n * pixelsPerRow();
	70	+ }
	71	+
	72	+ #ifndef COMPILING_IMF_FLAT_IMAGE_CHANNEL
	73	+diff --git a/src/lib/OpenEXRUtil/ImfSampleCountChannel.h b/src/lib/OpenEXRUtil/ImfSampleCountChannel.h
	74	+index a16775a..c4c1f36 100644
	75	+--- a/src/lib/OpenEXRUtil/ImfSampleCountChannel.h
	76	++++ b/src/lib/OpenEXRUtil/ImfSampleCountChannel.h
	77	+@@ -342,7 +342,7 @@ SampleCountChannel::at (int x, int y) const
	78	+ inline const unsigned int *
	79	+ SampleCountChannel::row (int n) const
	80	+ {
	81	+- return _base + n * pixelsPerRow();
	82	++ return _numSamples + n * pixelsPerRow();
	83	+ }
	84	+
	85	+
	86	+diff --git a/src/test/OpenEXRUtilTest/testDeepImage.cpp b/src/test/OpenEXRUtilTest/testDeepImage.cpp
	87	+index 7b1d42d..ccd7489 100644
	88	+--- a/src/test/OpenEXRUtilTest/testDeepImage.cpp
	89	++++ b/src/test/OpenEXRUtilTest/testDeepImage.cpp
	90	+@@ -483,6 +483,39 @@ testSetSampleCounts ()
	91	+ }
	92	+
	93	+
	94	++void
	95	++testDeepChannelRowOffset ()
	96	++{
	97	++ //
	98	++ // Regression test for GHSA-hwmv-39v6-739m: row() is 0-based relative
	99	++ // to the data window and must not use the _base pointer offset.
	100	++ //
	101	++
	102	++ cout << "deep channel row() with non-zero data window origin" << endl;
	103	++
	104	++ DeepImage img;
	105	++ img.insertChannel ("Z", FLOAT, 1, 1, false);
	106	++
	107	++ const Box2i dataWindow (V2i (1024, -1024), V2i (1031, -1017));
	108	++ img.resize (dataWindow, ONE_LEVEL, ROUND_DOWN);
	109	++
	110	++ DeepImageLevel& level = img.level (0);
	111	++ TypedDeepImageChannel<float>& channel = level.typedChannel<float> ("Z");
	112	++ SampleCountChannel& sc = level.sampleCounts ();
	113	++
	114	++ assert (channel.row (0)[0] ==
	115	++ channel.at (dataWindow.min.x, dataWindow.min.y));
	116	++ assert (&sc.row (0)[0] == &sc.at (dataWindow.min.x, dataWindow.min.y));
	117	++
	118	++ const int lastRow = channel.pixelsPerColumn () - 1;
	119	++ const int lastCol = channel.pixelsPerRow () - 1;
	120	++
	121	++ assert (channel.row (lastRow)[lastCol] ==
	122	++ channel.at (dataWindow.max.x, dataWindow.max.y));
	123	++ assert (&sc.row (lastRow)[lastCol] ==
	124	++ &sc.at (dataWindow.max.x, dataWindow.max.y));
	125	++}
	126	++
	127	+ void
	128	+ testShiftPixels ()
	129	+ {
	130	+@@ -722,6 +755,7 @@ testDeepImage (const string &tempDir)
	131	+ testScanLineImages (tempDir + "deepScanLines.exr");
	132	+ testTiledImages (tempDir + "deepTiles.exr");
	133	+ testSetSampleCounts();
	134	++ testDeepChannelRowOffset();
	135	+ testShiftPixels();
	136	+ testCropping (tempDir + "deepCropped.exr");
	137	+ testRenameChannel();

Abackport-CVE-2026-59186.patch+132-0

@@ -0,0 +1,132 @@
	1	+From 71907b44ce9a1b05bf3934b8a7821752750731ab Mon Sep 17 00:00:00 2001
	2	+From: Cary Phillips <cary@ilm.com>
	3	+Date: Mon, 22 Jun 2026 20:36:19 -0700
	4	+Subject: [PATCH] Fix integer overflow in Array2D::resizeErase() on ILP32/LLP64
	5	+ builds (#2486)
	6	+
	7	+* Fix integer overflow in Array2D::resizeErase() on ILP32/LLP64 builds
	8	+
	9	+sizeX * sizeY used long arithmetic, which is 32 bits on ILP32 (32-bit
	10	+Linux) and on Windows (MSVC LLP64). A tile size of 65537x65537 overflows
	11	+to a small positive value, causing new[] to under-allocate and subsequent
	12	+tile decoding to write past the buffer.
	13	+
	14	+Cast both operands to size_t before multiplying so the allocation is
	15	+always correct regardless of the width of long.
	16	+
	17	+Addresses https://github.com/AcademySoftwareFoundation/openexr/security/advisories/GHSA-f667-c4wm-c8gq
	18	+
	19	+Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
	20	+Signed-off-by: Cary Phillips <cary@ilm.com>
	21	+
	22	+* validate non-negative sizes
	23	+
	24	+Signed-off-by: Cary Phillips <cary@ilm.com>
	25	+
	26	+---------
	27	+
	28	+Signed-off-by: Cary Phillips <cary@ilm.com>
	29	+Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
	30	+
	31	+Adapted to openEuler OpenEXR 3.1.11:
	32	+- the ImfArray.h hunk context (whitespace and surrounding members)
	33	+ matches the 3.1.11 baseline instead of the upstream one.
	34	+---
	35	+ src/lib/OpenEXR/ImfArray.h \| 38 +++++++++++++++++++++++++++++++++-----
	36	+ 1 file changed, 33 insertions(+), 5 deletions(-)
	37	+diff --git a/src/lib/OpenEXR/ImfArray.h b/src/lib/OpenEXR/ImfArray.h
	38	+index b840b99..8932c8d 100644
	39	+--- a/src/lib/OpenEXR/ImfArray.h
	40	++++ b/src/lib/OpenEXR/ImfArray.h
	41	+@@ -9,6 +9,10 @@
	42	+
	43	+ #include "ImfForward.h"
	44	+
	45	++#include "IexBaseExc.h"
	46	++
	47	++#include <cstddef>
	48	++
	49	+ //-------------------------------------------------------------------------
	50	+ //
	51	+ // class Array
	52	+@@ -53,7 +57,14 @@ class IMF_EXPORT_TEMPLATE_TYPE Array
	53	+ //-----------------------------
	54	+
	55	+ Array () {_data = 0; _size = 0;}
	56	+- Array (long size) {_data = new T[size]; _size = size;}
	57	++ Array (long size)
	58	++ {
	59	++ if (size < 0)
	60	++ throw IEX_NAMESPACE::ArgExc ("Array size must be non-negative");
	61	++
	62	++ _data = new T[size];
	63	++ _size = size;
	64	++ }
	65	+ ~Array () {delete [] _data;}
	66	+
	67	+
	68	+@@ -167,6 +178,9 @@ template <class T>
	69	+ inline void
	70	+ Array<T>::resizeErase (long size)
	71	+ {
	72	++ if (size < 0)
	73	++ throw IEX_NAMESPACE::ArgExc ("Array size must be non-negative");
	74	++
	75	+ T *tmp = new T[size];
	76	+ delete [] _data;
	77	+ _size = size;
	78	+@@ -178,6 +192,9 @@ template <class T>
	79	+ inline void
	80	+ Array<T>::resizeEraseUnsafe (long size)
	81	+ {
	82	++ if (size < 0)
	83	++ throw IEX_NAMESPACE::ArgExc ("Array size must be non-negative");
	84	++
	85	+ delete [] _data;
	86	+ _data = 0;
	87	+ _size = 0;
	88	+@@ -198,9 +215,14 @@ Array2D<T>::Array2D ():
	89	+ template <class T>
	90	+ inline
	91	+ Array2D<T>::Array2D (long sizeX, long sizeY):
	92	+- _sizeX (sizeX), _sizeY (sizeY), _data (new T[sizeX * sizeY])
	93	++ _sizeX (0), _sizeY (0), _data (0)
	94	+ {
	95	+- // empty
	96	++ if (sizeX < 0 \|\| sizeY < 0)
	97	++ throw IEX_NAMESPACE::ArgExc ("Array2D dimensions must be non-negative");
	98	++
	99	++ _sizeX = sizeX;
	100	++ _sizeY = sizeY;
	101	++ _data = new T[(size_t) sizeX * (size_t) sizeY];
	102	+ }
	103	+
	104	+
	105	+@@ -232,7 +254,10 @@ template <class T>
	106	+ inline void
	107	+ Array2D<T>::resizeErase (long sizeX, long sizeY)
	108	+ {
	109	+- T tmp = new T[sizeX sizeY];
	110	++ if (sizeX < 0 \|\| sizeY < 0)
	111	++ throw IEX_NAMESPACE::ArgExc ("Array2D dimensions must be non-negative");
	112	++
	113	++ T tmp = new T[(size_t) sizeX (size_t) sizeY];
	114	+ delete [] _data;
	115	+ _sizeX = sizeX;
	116	+ _sizeY = sizeY;
	117	+@@ -244,11 +269,14 @@ template <class T>
	118	+ inline void
	119	+ Array2D<T>::resizeEraseUnsafe (long sizeX, long sizeY)
	120	+ {
	121	++ if (sizeX < 0 \|\| sizeY < 0)
	122	++ throw IEX_NAMESPACE::ArgExc ("Array2D dimensions must be non-negative");
	123	++
	124	+ delete [] _data;
	125	+ _data = 0;
	126	+ _sizeX = 0;
	127	+ _sizeY = 0;
	128	+- _data = new T[sizeX * sizeY];
	129	++ _data = new T[(size_t) sizeX * (size_t) sizeY];
	130	+ _sizeX = sizeX;
	131	+ _sizeY = sizeY;
	132	+ }

Abackport-CVE-2026-61555.patch+52-0

@@ -0,0 +1,52 @@
	1	+From 6c6bc2d485f1435d3776b3b4a36f1617cf87070b Mon Sep 17 00:00:00 2001
	2	+From: Cary Phillips <cary@ilm.com>
	3	+Date: Mon, 22 Jun 2026 17:48:16 -0700
	4	+Subject: [PATCH] Fix empty multiView crash in viewFromChannelName() (#2496)
	5	+
	6	+Dotless channel names used multiView[0] without checking for an empty
	7	+vector. Use defaultViewName() so malformed files return "" instead of
	8	+OOB access.
	9	+
	10	+Addresses https://github.com/AcademySoftwareFoundation/openexr/security/advisories/GHSA-g8f2-r72m-48vx
	11	+
	12	+Signed-off-by: Cary Phillips <cary@ilm.com>
	13	+Co-authored-by: Cursor <cursoragent@cursor.com>
	14	+
	15	+Adapted to openEuler OpenEXR 3.1.11:
	16	+- the ImfMultiView.cpp / testMultiView.cpp hunk context matches the
	17	+ 3.1.11 baseline instead of the upstream one.
	18	+---
	19	+ src/lib/OpenEXR/ImfMultiView.cpp \| 2 +-
	20	+ src/test/OpenEXRTest/testMultiView.cpp \| 7 +++++++
	21	+ 2 files changed, 8 insertions(+), 1 deletion(-)
	22	+diff --git a/src/lib/OpenEXR/ImfMultiView.cpp b/src/lib/OpenEXR/ImfMultiView.cpp
	23	+index d3d5a03..cea6a34 100644
	24	+--- a/src/lib/OpenEXR/ImfMultiView.cpp
	25	++++ b/src/lib/OpenEXR/ImfMultiView.cpp
	26	+@@ -123,7 +123,7 @@ viewFromChannelName (const string &channel,
	27	+ // in the name belong to the default view.
	28	+ //
	29	+
	30	+- return multiView[0];
	31	++ return defaultViewName (multiView);
	32	+ }
	33	+ else
	34	+ {
	35	+diff --git a/src/test/OpenEXRTest/testMultiView.cpp b/src/test/OpenEXRTest/testMultiView.cpp
	36	+index 17190d5..a5d138e 100644
	37	+--- a/src/test/OpenEXRTest/testMultiView.cpp
	38	++++ b/src/test/OpenEXRTest/testMultiView.cpp
	39	+@@ -110,6 +110,13 @@ testMultiViewFunctions ()
	40	+ assert (viewFromChannelName ("devon.and.cornwall.longwool",
	41	+ multiView) == "");
	42	+
	43	++ //
	44	++ // Regression test for GHSA-g8f2-r72m-48vx: empty multiView must not
	45	++ // index element 0; dotless channels belong to no named view.
	46	++ //
	47	++
	48	++ assert (viewFromChannelName ("R", StringVector ()) == "");
	49	++
	50	+ //
	51	+ // Test areCounterparts()
	52	+ //