Heap-buffer-overflow in Imf_2_5::copyIntoFrameBuffer
Created OpenEXR tracking bugs for this issue:
Affects: fedora-all [bug 1939178]
Upstream PR which references patch commit and confirms it's association with aforementioned oss-fuzz report: https://github.com/AcademySoftwareFoundation/openexr/pull/831
An integer overflow in IlmImf/ImfTiledMisc.cpp function dataWindowForTile(), when dataWindow.min + tileSize > INT_MAX, could lead to an out-of-bounds write of heap buffer. The data written does not appear to be directly controllable via this flaw, but could be combined with other flaws to achieve a greater impact.