An issue was discovered in OpenEXR before v2.5.2. Invalid chunkCount attributes could cause a heap buffer overflow in getChunkOffsetTableSize() in IlmImf/ImfMisc.cpp. References: https://github.com/AcademySoftwareFoundation/openexr/blob/master/CHANGES.md https://github.com/AcademySoftwareFoundation/openexr/blob/master/SECURITY.md https://github.com/AcademySoftwareFoundation/openexr/pull/738 https://github.com/AcademySoftwareFoundation/openexr/releases/tag/v2.5.2
Created OpenEXR tracking bugs for this issue: Affects: fedora-all [bug 1852008] Created mingw-OpenEXR tracking bugs for this issue: Affects: fedora-all [bug 1852007]
The vulnerable getChunkOffsetTableSize() routine uses a parameter to decide when to ignore or not ignore the header's chunkCount; exposing the possibility that the chunkCount could be used even when it should have been ignored. The patch places the rules for when to ignore the chunkCount attribute directly into getChunkOffsetTableSize() so that the callers do not determine this.
Statement: This flaw does not affect versions of OpenEXR shipped with Red Hat Enterprise Linux 6 or 7 as the vulnerable code was introduced in subsequent versions of OpenEXR.
To exploit this flaw, OpenEXR would need to be used in a service which parses untrusted input data, such as data received by a web server, or in a social engineering attack where a user is tricked into opening a specially crafted file to be parsed by OpenEXR via some application which uses the library, e.g. GIMP.