PT-2026-59481 · Pypi · Openexr

Publicado

2026-07-13

·

Atualizado

2026-07-13

CVSS v3.1

7.5

Alta

VetorAV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Summary

While fuzzing openexr exrcheck fuzzer, Valgrind reports a conditional branch depending on uninitialized data inside generic unpack. This indicates a use of uninitialized memory (CWE-457). The issue is reproducible with the current OSS-Fuzz harness and a single-file PoC.

Details

Environment:
  • Tooling: valgrind --tool=memcheck --track-origins=yes
  • Target: openexr exrcheck fuzzer
  • OS: Ubuntu 20.04.6 LTS focal x86 64
  • openexr version and Git-commit hash: openexr 3.4.2 | commit fd657e8a41e157e5841c7cc2e2a5efe094b069a1 (grafted, HEAD -> main, origin/main, origin/HEAD)
Function: generic unpack
Possible root cause (based on observed symptoms): The unpacker is branching on bytes in a scratch buffer that were never written because the decode step didn’t fully populate it.
  • The first use flagged is in generic unpack(). That function reads from the decompressed/expanded pixel buffer to scatter data into the framebuffer. A “conditional jump depends on uninitialised value(s)” means it’s consulting bytes in that buffer before they were written.
  • Valgrind says the uninitialised value “was created by a heap allocation (malloc)”, not the stack: this matches a per-tile/per-scanline decode scratch buffer allocated in exr decoding run().
Valgrind Trace (top frames):
bash
==454== Conditional jump or move depends on uninitialised value(s)
==454==  at 0x4539BE: generic unpack (in /out/openexr exrcheck fuzzer)
==454==  by 0x44B85F: exr decoding run (in /out/openexr exrcheck fuzzer)
==454==  by 0x38BC5F: Imf 4 0::(anonymous namespace)::TileProcess::run decode( priv exr context t const*, int, Imf 4 0::FrameBuffer const*, std:: 1::vector<Imf 4 0::Slice, std:: 1::allocator<Imf 4 0::Slice> > const&) (in /out/openexr exrcheck fuzzer)
==454==  by 0x388BE1: Imf 4 0::TiledInputFile::Data::readTiles(int, int, int, int, int, int) (in /out/openexr exrcheck fuzzer)
==454==  by 0x388619: Imf 4 0::TiledInputFile::readTiles(int, int, int, int, int, int) (in /out/openexr exrcheck fuzzer)
==454==  by 0x353755: Imf 4 0::InputFile::Data::bufferedReadPixels(int, int) (in /out/openexr exrcheck fuzzer)
==454==  by 0x352286: Imf 4 0::InputFile::readPixels(int) (in /out/openexr exrcheck fuzzer)
==454==  by 0x3190FA: Imf 4 0::(anonymous namespace)::readMultiPart(Imf 4 0::MultiPartInputFile&, bool, bool) (in /out/openexr exrcheck fuzzer)
==454==  by 0x314C4D: Imf 4 0::checkOpenEXRFile(char const*, unsigned long, bool, bool, bool) (in /out/openexr exrcheck fuzzer)
==454== Uninitialised value was created by a heap allocation at 0x483B7F3: malloc (in /usr/lib/x86 64-linux-gnu/valgrind/vgpreload memcheck-amd64-linux.so)

PoC

In the attached archive, you will find:
  • The executable used for our tests.
  • The testcase used to trigger the bug.
To observe the bug, simply run the OSS-Fuzz helper script:
bash
git clone https://github.com/google/oss-fuzz.git
cd oss-fuzz

python3 infra/helper.py build image openexr
python3 infra/helper.py build fuzzers --sanitizer=none openexr
python3 infra/helper.py shell openexr

apt update && apt install -y valgrind
ulimit -n 65535
valgrind --tool=memcheck --track-origins=yes /out/openexr exrcheck fuzzer /path/to/poc

Impact

  • Undefined Behavior
  • Potential crash
  • Denial of Service
Credit: Aldo Ristori archive0.zip

Update Note:

Other saved testcases from the fuzzing campaign trigger the same underlying bug, but with a different manifestation. So there is one root cause (missing post-decode validation / zero-init before any unpack), with different call-sites. Below there are several archives, formatted like the previous one, that reproduce the other test cases.
Other observed sinks (distinct manifestations of the same bug):
Deep pointers path: generic unpack deep pointers (deep scanline/tiled) archive1.zip
Deep sample table path: unpack sample table (deep scanline) archive2.zip
Half conversion path: half to float buffer f16c via unpack half to float 3chan planar archive3.zip
Deep compositing: CompositeDeepScanLine::readPixels → ThreadPool::addTask → LineCompositeTask::execute archive4.zip

Correção

Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com

Identificadores relacionados

PYSEC-2026-2843

Produtos afetados

Openexr