OpenImageIO vulnerabilities

In OpenImageIO prior to versions 3.0.18.0 and 3.1.13.0, a signed 32-bit integer overflow in the SwapRGBABytes() function causes a large negative pointer offset when processing large kABGR DPX images. This results in immediate crashes and out-of-bounds reads and writes.

In OpenImageIO prior to versions 3.0.18.0 and 3.1.13.0, a signed 32-bit integer overflow in the pixel-loop index expression causes an out-of-bounds write that crashes the process.

In OpenImageIO versions prior to 3.0.18.0 and 3.1.13.0, a heap-based buffer overflow occurs due to a signed integer overflow in the QueryRGBBufferSizeInternal() function. This issue arises when processing crafted DPX image files, leading to writes outside the allocated buffer.

OpenImageIO prior to versions 3.0.18.0 and 3.1.13.0 contains a heap-based buffer overflow in the HEIF decoder, allowing out-of-bounds writes. This can lead to memory corruption and potential code execution.

OpenImageIO prior to versions 3.0.18.0 and 3.1.13.0 has a vulnerability related to buffer size calculation in jpeg2000input.cpp, leading to heap overflow. This issue occurs when the product of image dimensions exceeds the maximum value for 32-bit arithmetic, resulting in the allocation of an undersized buffer.

OpenImageIO prior to versions 3.0.18.0 and 3.1.13.0 contains a vulnerability that allows for heap overflow up to 65535 bytes due to improper clamping of run length in .pic files. The issue occurs in the code responsible for processing RLE.

OpenImageIO prior to versions 3.0.18.0 and 3.1.13.0 contains a vulnerability in sgiinput.cpp where the use of OIIO_DASSERT for bounds checking in the RLE decode loop does not function in release builds. As a result, a crafted .sgi file with RLE count exceeding scanline width causes heap buffer overflow and crash.

OpenImageIO is a toolset for reading, writing, and manipulating image files. Prior to 3.1.16.0, a crafted 1-bit contiguous cmyk tiff is exposed through a native uint1 imagespec, so callers allocate a bit-packed buffer. tiffinput::read_native_scanline_locked() nevertheless invokes tiffinput::bit_convert() with 8-bit output and writes one expanded byte per value into that smaller buffer, resulting in a heap out-of-bounds write and memory corruption. This issue is fixed in 3.1.16.0.

In OpenImageIO prior to 3.1.16.0, a crafted ZIP-compressed TIFF processed with TIFF multithreading enabled can make TIFFInput::read_native_scanlines() return through an error path while asynchronous strip-decompression work remains queued. Because task_set is declared before ok and compressed_scratch, those captured objects are destroyed before the task-set destructor waits, allowing worker tasks to use stale stack and heap storage.

In OpenImageIO prior to 3.0.21.0, 3.1.16.0, and 3.2.0.3-beta1, a truncated TGA can leave a pending GIF frame that is processed during output close. gifsplitpalette() computes numpixels multiplied by the palette partition width in signed 32-bit arithmetic; a large image overflows that intermediate, corrupts subpixelsa, and drives an out-of-bounds read while building the GIF palette.

OpenImageIO is a toolset for reading, writing, and manipulating image files. Prior to 3.0.21.0, 3.1.16.0, and 3.2.0.3-beta1, a crafted cineon image can declare unsupported component bit depth 26. cineoninput::open() maps it to a 32-bit imagespec, but libcineon maps the unsupported depth to an 8-byte value, so cineoninput::read_native_scanline() causes attacker-controlled data to be written beyond the 4-byte-per-pixel caller buffer, resulting in a heap out-of-bounds write and memory corruption. This issue is fixed in versions 3.0.21.0, 3.1.16.0, and 3.2.0.3-beta1.

In OpenImageIO prior to 3.0.21.0, 3.1.16.0, and 3.2.0.3-beta1, a crafted PSD with an invalid color_mode bypasses normal validation when oiio:rawcolor or psd:rawdata is enabled. psdinput::setup() then uses the attacker-controlled value to index fixed color-mode tables, causing a global out-of-bounds read and potentially a bogus allocation.

OpenImageIO is a toolset for reading, writing, and manipulating image files. Prior to 3.0.21.0, 3.1.16.0, and 3.2.0.3-beta1, a valid tiled openexr image whose width is not a multiple of its tile width can trigger an overflow when a caller reads a partial edge-tile rectangle. openexrinput::read_native_tiles() copies each row into the caller buffer using the padded whole-tile scanline_stride rather than user_scanline_bytes for the requested rectangle, resulting in a heap out-of-bounds write and memory corruption. This issue is fixed in versions 3.0.21.0, 3.1.16.0, and 3.2.0.3-beta1.

In OpenImageIO prior to 3.0.21.0, 3.1.16.0, and 3.2.0.3-beta1, an indexed PSD with transparency metadata creates fewer stored channel_buffers than the spec.nchannels value advertised by the rawcolor path. When oiio:rawcolor or psd:rawdata is enabled, psdinput::read_native_scanline() passes spec.nchannels to psdinput::interleave_row(), which indexes beyond channel_buffers.

OpenImageIO is a toolset for reading, writing, and manipulating image files. Prior to 3.0.21.0, 3.1.16.0, and 3.2.0.3-beta1, a zbuffer-only tiled iff is exposed with a 16-bit public imagespec while the decoder retains a 32-bit internal pixel size. iffinput::read_native_tile() copies according to m_header.pixel_bytes() rather than imagespec::tile_bytes(true), and a failed read can leave m_buf nonempty so a later call copies partially initialized data into the undersized caller buffer, resulting in a heap out-of-bounds write and memory corruption. This issue is fixed in versions 3.0.21.0, 3.1.16.0, and 3.2.0.3-beta1.

In OpenImageIO prior to 3.0.20.0, 3.1.15.0, and 3.2.0.3-beta1, an uncompressed 16-bit IFF image with a z-buffer makes iffinput::readimg() allocate a temporary scanline from m_header.rgba_count but copy from it using m_header.pixel_bytes(), whose stride also includes z-buffer bytes. The oversized memcpy reads beyond the temporary heap buffer and copies adjacent memory into the output image.

In OpenImageIO prior to 3.0.20.0, 3.1.15.0, and 3.2.0.3-beta1, a crafted Cineon file can supply a numberofelements value greater than the format maximum of eight. cineoninput::open() uses that unchecked value as the loop bound while filling the fixed strings[8] array, writing pointers beyond the stack buffer and into adjacent state.

In OpenImageIO prior to 3.0.20.0, 3.1.15.0, and 3.2.0.3-beta1, a crafted FITS stream containing consecutive 2880-byte header blocks without the mandatory END keyword makes fitsinput::read_fits_header() call itself without a depth bound. Repeated recursive parsing exhausts the application stack.

OpenImageIO before versions 3.0.16.0 and 3.1.11.0 contains a vulnerability in BMP handling. Processing a crafted BMP file through oiiotool or an application linked to OpenImageIO can reach BMP palette handling in src/bmp.imageio/bmpinput.cpp with an empty color table. BmpInput::read_native_scanline then performs an invalid palette read while decoding an RLE-compressed scanline, causing a process crash and denial of service. This issue is fixed in versions 3.0.16.0 and 3.1.11.0.

Buffer Overflow vulnerability in OpenImageIO v.2.4.12.0 and before allows a remote attacker to execute arbitrary code and obtain sensitive information via a crafted file to the readimg function.