diff --git a/.gitignore b/.gitignore index c329709..f00caa1 100644 --- a/.gitignore +++ b/.gitignore @@ -22,5 +22,3 @@ /OpenUSD-25.08.tar.gz /OpenUSD-25.11.tar.gz /OpenUSD-26.03.tar.gz -/OpenUSD-26.05.tar.gz -/OpenUSD-26.08.tar.gz diff --git a/0001-Downstream-only-add-an-SONAME-version.patch b/0001-Downstream-only-add-an-SONAME-version.patch index db129dd..7a55eca 100644 --- a/0001-Downstream-only-add-an-SONAME-version.patch +++ b/0001-Downstream-only-add-an-SONAME-version.patch @@ -1,4 +1,4 @@ -From ee4e9b30e14133e35c23821d3dc7aa93df354a38 Mon Sep 17 00:00:00 2001 +From 949707d0bd8ac077fac9763b3b590a016ff4eb6f Mon Sep 17 00:00:00 2001 From: "Benjamin A. Beasley" Date: Fri, 27 Oct 2023 12:56:58 -0400 Subject: [PATCH] Downstream-only: add an SONAME version @@ -37,11 +37,11 @@ built with -DPXR_BUILD_EXAMPLES=OFF, but it is.) 3 files changed, 9 insertions(+) diff --git a/cmake/defaults/Version.cmake b/cmake/defaults/Version.cmake -index c31b5e8d9..fabb45397 100644 +index 1cc7fa64a..ebe531ec4 100644 --- a/cmake/defaults/Version.cmake +++ b/cmake/defaults/Version.cmake @@ -10,3 +10,9 @@ set(PXR_MINOR_VERSION "26") - set(PXR_PATCH_VERSION "8") # NOTE: Must not have leading 0 for single digits + set(PXR_PATCH_VERSION "3") # NOTE: Must not have leading 0 for single digits math(EXPR PXR_VERSION "${PXR_MAJOR_VERSION} * 10000 + ${PXR_MINOR_VERSION} * 100 + ${PXR_PATCH_VERSION}") + @@ -51,10 +51,10 @@ index c31b5e8d9..fabb45397 100644 + "Downstream shared object version" +) diff --git a/cmake/macros/Private.cmake b/cmake/macros/Private.cmake -index cddb4e095..5e4b4603a 100644 +index e2dccb075..5f6913e22 100644 --- a/cmake/macros/Private.cmake +++ b/cmake/macros/Private.cmake -@@ -1355,6 +1355,7 @@ function(_pxr_library NAME) +@@ -1346,6 +1346,7 @@ function(_pxr_library NAME) FOLDER "${folder}" POSITION_INDEPENDENT_CODE ON IMPORT_PREFIX "${args_PREFIX}" @@ -63,10 +63,10 @@ index cddb4e095..5e4b4603a 100644 SUFFIX "${args_SUFFIX}" ) diff --git a/cmake/macros/Public.cmake b/cmake/macros/Public.cmake -index 5f6a5456b..553b645ec 100644 +index b51789f4a..af2f2a805 100644 --- a/cmake/macros/Public.cmake +++ b/cmake/macros/Public.cmake -@@ -415,6 +415,7 @@ function(pxr_library NAME) +@@ -414,6 +414,7 @@ function(pxr_library NAME) TYPE "${args_TYPE}" PREFIX "${prefix}" SUFFIX "${suffix}" @@ -74,7 +74,7 @@ index 5f6a5456b..553b645ec 100644 SUBDIR "${subdir}" CPPFILES "${args_CPPFILES};${${NAME}_CPPFILES}" PUBLIC_HEADERS "${args_PUBLIC_HEADERS};${${NAME}_PUBLIC_HEADERS}" -@@ -1213,6 +1214,7 @@ function(pxr_toplevel_prologue) +@@ -1195,6 +1196,7 @@ function(pxr_toplevel_prologue) PREFIX "${libPrefix}" IMPORT_PREFIX "${libPrefix}" OUTPUT_NAME ${libName} @@ -83,5 +83,5 @@ index 5f6a5456b..553b645ec 100644 _get_install_dir("lib" libInstallPrefix) install( -- -2.55.0 +2.53.0 diff --git a/0001-Downstream-only-use-Valgrind-macro-instead-of-inline.patch b/0001-Downstream-only-use-Valgrind-macro-instead-of-inline.patch index 6d2305c..876f0e1 100644 --- a/0001-Downstream-only-use-Valgrind-macro-instead-of-inline.patch +++ b/0001-Downstream-only-use-Valgrind-macro-instead-of-inline.patch @@ -1,4 +1,4 @@ -From 817e23674f1b4ba62481c4e9794f0665a44d83f8 Mon Sep 17 00:00:00 2001 +From 15ea3b68bb15fd6338cbe76ec94eac055dc28c4e Mon Sep 17 00:00:00 2001 From: "Benjamin A. Beasley" Date: Fri, 1 Aug 2025 08:47:41 -0400 Subject: [PATCH] Downstream-only: use Valgrind macro instead of inline @@ -61,5 +61,5 @@ index 96dacca06..7e5625678 100644 Vdf_ExecutorDataVector::~Vdf_ExecutorDataVector() -- -2.55.0 +2.53.0 diff --git a/0001-Downstream-only-use-the-system-double-conversion-lib.patch b/0001-Downstream-only-use-the-system-double-conversion-lib.patch index 1cd7abc..30a54ef 100644 --- a/0001-Downstream-only-use-the-system-double-conversion-lib.patch +++ b/0001-Downstream-only-use-the-system-double-conversion-lib.patch @@ -1,4 +1,4 @@ -From 2d851f23e912d8312f2ea6818963150a8c484138 Mon Sep 17 00:00:00 2001 +From 5bc91bdebc42bb3a441c87b706288cea05fcd345 Mon Sep 17 00:00:00 2001 From: "Benjamin A. Beasley" Date: Wed, 28 Aug 2024 10:42:48 -0400 Subject: [PATCH 1/6] Downstream-only: use the system double-conversion library @@ -8,7 +8,7 @@ Subject: [PATCH 1/6] Downstream-only: use the system double-conversion library 1 file changed, 3 insertions(+), 8 deletions(-) diff --git a/pxr/base/tf/CMakeLists.txt b/pxr/base/tf/CMakeLists.txt -index 4294f2cb5..b45df65b8 100644 +index 6fc9c680e..551b5a3eb 100644 --- a/pxr/base/tf/CMakeLists.txt +++ b/pxr/base/tf/CMakeLists.txt @@ -105,11 +105,14 @@ function(add_py_dll_link_test) @@ -26,7 +26,7 @@ index 4294f2cb5..b45df65b8 100644 PUBLIC_CLASSES anyUniquePtr -@@ -276,14 +279,6 @@ pxr_library(tf +@@ -272,14 +275,6 @@ pxr_library(tf CPPFILES initConfig.cpp @@ -42,5 +42,5 @@ index 4294f2cb5..b45df65b8 100644 PYMODULE_CPPFILES -- -2.55.0 +2.53.0 diff --git a/0001-Replace-PyWeakref_GetObject-with-PyWeakref_GetRef.patch b/0001-Replace-PyWeakref_GetObject-with-PyWeakref_GetRef.patch deleted file mode 100644 index 97dbab3..0000000 --- a/0001-Replace-PyWeakref_GetObject-with-PyWeakref_GetRef.patch +++ /dev/null @@ -1,110 +0,0 @@ -From f3e9600db6086e834c0503cdaf30b5ba7ed53ceb Mon Sep 17 00:00:00 2001 -From: Anonymous Coward -Date: Sun, 26 Jul 2026 16:13:18 +0200 -Subject: [PATCH] Replace PyWeakref_GetObject with PyWeakref_GetRef - -PyWeakref_GetObject was removed in Python 3.15. Replace all four call -sites with PyWeakref_GetRef, which returns a strong reference instead -of a borrowed one, and adjust reference counting accordingly. - -In Tf_PyIdHandle::Ptr(), return Py_None when the referent is dead to -match the original behaviour (previously returned NULL erroneously). - -In Tf_PyWeakObject::GetObject(), explicitly return a Python None object -on failure, matching the original semantics exactly. - -Fixes: https://github.com/PixarAnimationStudios/OpenUSD/issues/3966 - -Assisted-by: Claude Opus 4.6 -Reviewed-by: OpenUSD Maintainers ---- - pxr/base/tf/pyFunction.h | 13 +++++++++---- - pxr/base/tf/pyIdentity.cpp | 10 +++++++++- - pxr/base/tf/pyWeakObject.cpp | 12 +++++++++--- - 3 files changed, 27 insertions(+), 8 deletions(-) - -diff --git a/pxr/base/tf/pyFunction.h b/pxr/base/tf/pyFunction.h -index 85af943b2..f77b5b71b 100644 ---- a/pxr/base/tf/pyFunction.h -+++ b/pxr/base/tf/pyFunction.h -@@ -49,11 +49,13 @@ struct TfPyFunctionFromPython - using namespace pxr_boost::python; - // Attempt to get the referenced callable object. - TfPyLock lock; -- object callable(handle<>(borrowed(PyWeakref_GetObject(weak.ptr())))); -- if (TfPyIsNone(callable)) { -+ PyObject *rawCallable = NULL; -+ if (PyWeakref_GetRef(weak.ptr(), &rawCallable) <= 0) { - TF_WARN("Tried to call an expired python callback"); - return Ret(); - } -+ // PyWeakref_GetRef returns a strong reference; handle<> steals it. -+ object callable{handle<>(rawCallable)}; - return TfPyCall(callable)(args...); - } - }; -@@ -68,12 +70,15 @@ struct TfPyFunctionFromPython - // Attempt to get the referenced self parameter, then build a new - // instance method and call it. - TfPyLock lock; -- PyObject *self = PyWeakref_GetObject(weakSelf.ptr()); -- if (self == Py_None) { -+ PyObject *self = NULL; -+ if (PyWeakref_GetRef(weakSelf.ptr(), &self) <= 0) { - TF_WARN("Tried to call a method on an expired python instance"); - return Ret(); - } -+ // PyWeakref_GetRef returns a strong reference to self; PyMethod_New -+ // takes its own reference, so release ours afterward. - object method(handle<>(PyMethod_New(func.ptr(), self))); -+ Py_DECREF(self); - return TfPyCall(method)(args...); - } - }; -diff --git a/pxr/base/tf/pyIdentity.cpp b/pxr/base/tf/pyIdentity.cpp -index 5389d8f25..06b7f9b0c 100644 ---- a/pxr/base/tf/pyIdentity.cpp -+++ b/pxr/base/tf/pyIdentity.cpp -@@ -136,7 +136,15 @@ PyObject * - Tf_PyIdHandle::Ptr() const { - if (_weakRef) { - TfPyLock lock; -- return PyWeakref_GetObject(_weakRef); -+ PyObject *obj = NULL; -+ if (PyWeakref_GetRef(_weakRef, &obj) > 0) { -+ // Return a borrowed-style reference: decrement so the caller -+ // does not need to release. Safe because the GIL is held by -+ // all callers. -+ Py_DECREF(obj); -+ return obj; -+ } -+ return Py_None; // dead referent → match original behaviour - } - return 0; - } -diff --git a/pxr/base/tf/pyWeakObject.cpp b/pxr/base/tf/pyWeakObject.cpp -index 8cfddc729..ecdd7f705 100644 ---- a/pxr/base/tf/pyWeakObject.cpp -+++ b/pxr/base/tf/pyWeakObject.cpp -@@ -115,9 +115,15 @@ Tf_PyWeakObject::GetOrCreate(pxr_boost::python::object const &obj) - pxr_boost::python::object - Tf_PyWeakObject::GetObject() const - { -- return pxr_boost::python::object -- (pxr_boost::python::handle<> -- (pxr_boost::python::borrowed(PyWeakref_GetObject(_weakRef.get())))); -+ PyObject *obj = NULL; -+ if (PyWeakref_GetRef(_weakRef.get(), &obj) > 0) { -+ // PyWeakref_GetRef returns a strong reference; handle<> steals it. -+ return pxr_boost::python::object( -+ pxr_boost::python::handle<>(obj)); -+ } -+ // Dead referent: return Py_None explicitly, as the original did. -+ return pxr_boost::python::object( -+ pxr_boost::python::handle<>(pxr_boost::python::borrowed(Py_None))); - } - - void --- -2.55.0 - diff --git a/0002-Downstream-only-use-the-system-lz4-library.patch b/0002-Downstream-only-use-the-system-lz4-library.patch index 6659b01..910d576 100644 --- a/0002-Downstream-only-use-the-system-lz4-library.patch +++ b/0002-Downstream-only-use-the-system-lz4-library.patch @@ -1,4 +1,4 @@ -From 9fd6089b3e95bb882199ee359fbba83f7c4bb410 Mon Sep 17 00:00:00 2001 +From 0caa009abce9d66d441cd548f45ca8fef8d4846d Mon Sep 17 00:00:00 2001 From: "Benjamin A. Beasley" Date: Thu, 29 Aug 2024 13:30:18 -0400 Subject: [PATCH 2/6] Downstream-only: use the system lz4 library @@ -8,7 +8,7 @@ Subject: [PATCH 2/6] Downstream-only: use the system lz4 library 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/pxr/base/tf/CMakeLists.txt b/pxr/base/tf/CMakeLists.txt -index b45df65b8..5e6de96da 100644 +index 551b5a3eb..772524a19 100644 --- a/pxr/base/tf/CMakeLists.txt +++ b/pxr/base/tf/CMakeLists.txt @@ -106,6 +106,8 @@ function(add_py_dll_link_test) @@ -31,7 +31,7 @@ index b45df65b8..5e6de96da 100644 PUBLIC_CLASSES anyUniquePtr -@@ -279,7 +285,6 @@ pxr_library(tf +@@ -275,7 +281,6 @@ pxr_library(tf CPPFILES initConfig.cpp @@ -40,5 +40,5 @@ index b45df65b8..5e6de96da 100644 PYMODULE_CPPFILES module.cpp -- -2.55.0 +2.53.0 diff --git a/0003-Downstream-only-use-the-system-pugixml-library.patch b/0003-Downstream-only-use-the-system-pugixml-library.patch index e7ad209..974ff6f 100644 --- a/0003-Downstream-only-use-the-system-pugixml-library.patch +++ b/0003-Downstream-only-use-the-system-pugixml-library.patch @@ -1,4 +1,4 @@ -From 73637a9bf67b3f7afe5070e5d56b07524e14a073 Mon Sep 17 00:00:00 2001 +From d1e032128f9c41a763d9e0535c408ffa6642ae03 Mon Sep 17 00:00:00 2001 From: "Benjamin A. Beasley" Date: Fri, 30 Aug 2024 09:32:08 -0400 Subject: [PATCH 3/6] Downstream-only: use the system pugixml library @@ -35,5 +35,5 @@ index 244f27aa8..1e00413c4 100644 PRIVATE_HEADERS api.h -- -2.55.0 +2.53.0 diff --git a/0004-Downstream-only-use-the-system-rapidjson-library.patch b/0004-Downstream-only-use-the-system-rapidjson-library.patch index 8d9f9cd..090b753 100644 --- a/0004-Downstream-only-use-the-system-rapidjson-library.patch +++ b/0004-Downstream-only-use-the-system-rapidjson-library.patch @@ -1,4 +1,4 @@ -From f331a476a66e41e93d83b7a2e438d3ee7f12ea32 Mon Sep 17 00:00:00 2001 +From 8fc7363878d1917d5b3f3513b16d54293463c297 Mon Sep 17 00:00:00 2001 From: "Benjamin A. Beasley" Date: Sat, 31 Aug 2024 11:08:18 -0400 Subject: [PATCH 4/6] Downstream-only: use the system rapidjson library @@ -59,5 +59,5 @@ index 8cbda8c52..ec8f3c249 100644 overview.dox ) -- -2.55.0 +2.53.0 diff --git a/0005-Downstream-only-use-the-system-libdeflate.patch b/0005-Downstream-only-use-the-system-libdeflate.patch index b8ce47f..cc5de7a 100644 --- a/0005-Downstream-only-use-the-system-libdeflate.patch +++ b/0005-Downstream-only-use-the-system-libdeflate.patch @@ -1,4 +1,4 @@ -From a537b44edabe942380d2e87ea7069bdf32b93dbc Mon Sep 17 00:00:00 2001 +From 30b0460635b46ce71f22586273afb370075d7db8 Mon Sep 17 00:00:00 2001 From: "Benjamin A. Beasley" Date: Sun, 1 Sep 2024 21:30:11 -0400 Subject: [PATCH 5/6] Downstream-only: use the system libdeflate @@ -72,5 +72,5 @@ index 7481a346e..71bdde9cc 100644 #include "OpenEXRCore/attributes.c" -- -2.55.0 +2.53.0 diff --git a/0006-Downstream-only-use-the-system-libavif.patch b/0006-Downstream-only-use-the-system-libavif.patch index 9ab912a..cac8a41 100644 --- a/0006-Downstream-only-use-the-system-libavif.patch +++ b/0006-Downstream-only-use-the-system-libavif.patch @@ -1,4 +1,4 @@ -From f2a3615238a691e11a4029c33498e7f21a34fff9 Mon Sep 17 00:00:00 2001 +From c6639b8f1a8c57b02071426400daa349eed14501 Mon Sep 17 00:00:00 2001 From: "Benjamin A. Beasley" Date: Wed, 4 Sep 2024 11:09:47 -0400 Subject: [PATCH 6/6] Downstream-only: use the system libavif @@ -237,5 +237,5 @@ index 1ac2683f6..7d583c137 100644 RESOURCE_FILES -- -2.55.0 +2.53.0 diff --git a/4028.patch b/4028.patch new file mode 100644 index 0000000..9fd2598 --- /dev/null +++ b/4028.patch @@ -0,0 +1,71 @@ +From 83c6cdfa63ad61accec35575f503b629f94dc4af Mon Sep 17 00:00:00 2001 +From: Cary Phillips +Date: Thu, 19 Mar 2026 14:22:40 -0700 +Subject: [PATCH] Fix B44/B44A integer overflow: use uint64_t for row offset + (#2312) + +The B44 and B44A decoder and encoder use channel width (`nx`) and +height (`ny`) in row pointer math. `nx` and `ny` are `int`; the +scratch buffer is correctly sized with `(uint64_t)ny * (uint64_t)nx * +bytes_per_element`, but row bases were computed as: + +``` + row0 = (uint16_t*)scratch; + row0 += y * nx; // int * int -> signed overflow when y*nx > INT_MAX +``` + +For large `nx` (e.g. 268435456), `y*nx` overflows, so `row0`/`row1`/`row2`/`row3` +point before the scratch buffer. + +Fix: compute the row offset in `uint64_t` before pointer arithmetic in both +`uncompress_b44_impl` (decoder) and `compress_b44_impl` (encoder). + +Analysis and solution with the help of Curor / Claude Opus 4.5 + +Signed-off-by: Cary Phillips +--- + .../OpenEXR/OpenEXRCore/internal_b44.c | 23 ++++++++++--------- + 1 file changed, 12 insertions(+), 11 deletions(-) + +diff --git a/pxr/imaging/plugin/hioOpenEXR/OpenEXR/OpenEXRCore/internal_b44.c b/pxr/imaging/plugin/hioOpenEXR/OpenEXR/OpenEXRCore/internal_b44.c +index 8d0c257e658..93279ff2ed5 100644 +--- a/pxr/imaging/plugin/hioOpenEXR/OpenEXR/OpenEXRCore/internal_b44.c ++++ b/pxr/imaging/plugin/hioOpenEXR/OpenEXR/OpenEXRCore/internal_b44.c +@@ -390,13 +390,13 @@ compress_b44_impl (exr_encode_pipeline_t* encode, int flat_field) + // rightmost column and the bottom row. + // + uint16_t *row0, *row1, *row2, *row3; ++ /* row offset in elements: use uint64_t so y*nx cannot overflow int */ ++ uint64_t row_off = (uint64_t) (y) * (uint64_t) (nx); + +- row0 = (uint16_t*) scratch; +- row0 += y * nx; +- +- row1 = row0 + nx; +- row2 = row1 + nx; +- row3 = row2 + nx; ++ row0 = (uint16_t*) scratch + row_off; ++ row1 = row0 + (uint64_t) nx; ++ row2 = row1 + (uint64_t) nx; ++ row3 = row2 + (uint64_t) nx; + + if (y + 3 >= ny) + { +@@ -512,11 +512,12 @@ uncompress_b44_impl ( + + for (int y = 0; y < ny; y += 4) + { +- row0 = (uint16_t*) scratch; +- row0 += y * nx; +- row1 = row0 + nx; +- row2 = row1 + nx; +- row3 = row2 + nx; ++ /* row offset in elements: use uint64_t so y*nx cannot overflow int */ ++ uint64_t row_off = (uint64_t) (y) * (uint64_t) (nx); ++ row0 = (uint16_t*) scratch + row_off; ++ row1 = row0 + (uint64_t) nx; ++ row2 = row1 + (uint64_t) nx; ++ row3 = row2 + (uint64_t) nx; + for (int x = 0; x < nx; x += 4) + { + if (bIn + 3 > comp_buf_size) return EXR_ERR_OUT_OF_MEMORY; diff --git a/4030.patch b/4030.patch new file mode 100644 index 0000000..896f2e3 --- /dev/null +++ b/4030.patch @@ -0,0 +1,612 @@ +From 4f03fb0f488d8f528bdc0f9ecac07eea8f7b63ac Mon Sep 17 00:00:00 2001 +From: Christoph Gohlke +Date: Tue, 17 Mar 2026 20:56:39 -0700 +Subject: [PATCH 1/6] Fix comparison operator for buffer size check (#2307) + +Signed-off-by: Christoph Gohlke +--- + .../plugin/hioOpenEXR/OpenEXR/OpenEXRCore/internal_zip.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/pxr/imaging/plugin/hioOpenEXR/OpenEXR/OpenEXRCore/internal_zip.c b/pxr/imaging/plugin/hioOpenEXR/OpenEXR/OpenEXRCore/internal_zip.c +index 628438c5c01..56df6a49c2f 100644 +--- a/pxr/imaging/plugin/hioOpenEXR/OpenEXR/OpenEXRCore/internal_zip.c ++++ b/pxr/imaging/plugin/hioOpenEXR/OpenEXR/OpenEXRCore/internal_zip.c +@@ -367,7 +367,7 @@ apply_zip_impl (exr_encode_pipeline_t* encode) + + if (rv == EXR_ERR_SUCCESS) + { +- if (compbufsz > encode->packed_bytes) ++ if (compbufsz >= encode->packed_bytes) + { + memcpy ( + encode->compressed_buffer, + +From 0512b6c41b95e5c0ac9e01b2f87b56acd437d8e9 Mon Sep 17 00:00:00 2001 +From: Cary Phillips +Date: Thu, 26 Mar 2026 16:35:49 -0700 +Subject: [PATCH 2/6] Fix integer overflow in `srcbuffer` pointer arithmetic in + `unpack_*` (#2321) + +Pointer arithmetic involving `srcbuffer` in the `unpack_*` functions +can overflow for very wide images. + +Multiplying `int w` by a bytes-per-element constant (2, 4, 6, or 8) in +`srcbuffer +=` expressions causes signed integer overflow when the +image width is large. + +Promote the leading operand to `int64_t` at every affected multiplication +so pointer arithmetic is performed in 64-bit signed arithmetic throughout, +eliminating the undefined behavior without imposing any image size limit. + +Affected sites: `generic_unpack`, `unpack_16bit`, `unpack_32bit`, and +all 3- and 4-channel interleave/planar specializations. + +Made-with: Cursor + +Signed-off-by: Cary Phillips +--- + .../hioOpenEXR/OpenEXR/OpenEXRCore/unpack.c | 38 +++++++++---------- + 1 file changed, 19 insertions(+), 19 deletions(-) + +diff --git a/pxr/imaging/plugin/hioOpenEXR/OpenEXR/OpenEXRCore/unpack.c b/pxr/imaging/plugin/hioOpenEXR/OpenEXR/OpenEXRCore/unpack.c +index 1324508c5b4..8765bfa50d6 100644 +--- a/pxr/imaging/plugin/hioOpenEXR/OpenEXR/OpenEXRCore/unpack.c ++++ b/pxr/imaging/plugin/hioOpenEXR/OpenEXR/OpenEXRCore/unpack.c +@@ -229,7 +229,7 @@ unpack_16bit_3chan_interleave (exr_decode_pipeline_t* decode) + in1 = in0 + w; + in2 = in1 + w; + +- srcbuffer += w * 6; // 3 * sizeof(uint16_t), avoid type conversion ++ srcbuffer += (int64_t) w * 6; // 3 * sizeof(uint16_t), avoid type conversion + for (int x = 0; x < w; ++x) + { + out[0] = one_to_native16 (in0[x]); +@@ -269,7 +269,7 @@ unpack_16bit_3chan_interleave_rev (exr_decode_pipeline_t* decode) + in1 = in0 + w; // G + in2 = in1 + w; // R + +- srcbuffer += w * 6; // 3 * sizeof(uint16_t), avoid type conversion ++ srcbuffer += (int64_t) w * 6; // 3 * sizeof(uint16_t), avoid type conversion + for (int x = 0; x < w; ++x) + { + out[0] = one_to_native16 (in2[x]); +@@ -309,7 +309,7 @@ unpack_half_to_float_3chan_interleave (exr_decode_pipeline_t* decode) + in1 = in0 + w; + in2 = in1 + w; + +- srcbuffer += w * 6; // 3 * sizeof(uint16_t), avoid type conversion ++ srcbuffer += (int64_t) w * 6; // 3 * sizeof(uint16_t), avoid type conversion + for (int x = 0; x < w; ++x) + { + out[0] = half_to_float (one_to_native16 (in0[x])); +@@ -349,7 +349,7 @@ unpack_half_to_float_3chan_interleave_rev (exr_decode_pipeline_t* decode) + in1 = in0 + w; + in2 = in1 + w; + +- srcbuffer += w * 6; // 3 * sizeof(uint16_t), avoid type conversion ++ srcbuffer += (int64_t) w * 6; // 3 * sizeof(uint16_t), avoid type conversion + for (int x = 0; x < w; ++x) + { + out[0] = half_to_float (one_to_native16 (in2[x])); +@@ -390,7 +390,7 @@ unpack_16bit_3chan_planar (exr_decode_pipeline_t* decode) + in0 = (const uint16_t*) srcbuffer; + in1 = in0 + w; + in2 = in1 + w; +- srcbuffer += w * 6; // 3 * sizeof(uint16_t), avoid type conversion ++ srcbuffer += (int64_t) w * 6; // 3 * sizeof(uint16_t), avoid type conversion + /* specialise to memcpy if we can */ + #if EXR_HOST_IS_NOT_LITTLE_ENDIAN + for (int x = 0; x < w; ++x) +@@ -440,7 +440,7 @@ unpack_half_to_float_3chan_planar (exr_decode_pipeline_t* decode) + in0 = (const uint16_t*) srcbuffer; + in1 = in0 + w; + in2 = in1 + w; +- srcbuffer += w * 6; // 3 * sizeof(uint16_t), avoid type conversion ++ srcbuffer += (int64_t) w * 6; // 3 * sizeof(uint16_t), avoid type conversion + /* specialise to memcpy if we can */ + half_to_float_buffer ((float*) out0, in0, w); + half_to_float_buffer ((float*) out1, in1, w); +@@ -485,7 +485,7 @@ unpack_16bit_3chan (exr_decode_pipeline_t* decode) + in0 = (const uint16_t*) srcbuffer; + in1 = in0 + w; + in2 = in1 + w; +- srcbuffer += w * 6; // 3 * sizeof(uint16_t), avoid type conversion ++ srcbuffer += (int64_t) w * 6; // 3 * sizeof(uint16_t), avoid type conversion + for (int x = 0; x < w; ++x) + *((uint16_t*) (out0 + x * inc0)) = one_to_native16 (in0[x]); + for (int x = 0; x < w; ++x) +@@ -539,7 +539,7 @@ unpack_16bit_4chan_interleave (exr_decode_pipeline_t* decode) + in2 = in1 + w; + in3 = in2 + w; + +- srcbuffer += w * 8; // 4 * sizeof(uint16_t), avoid type conversion ++ srcbuffer += (int64_t) w * 8; // 4 * sizeof(uint16_t), avoid type conversion + for (int x = 0; x < w; ++x) + { + combined.a = one_to_native16 (in0[x]); +@@ -592,7 +592,7 @@ unpack_16bit_4chan_interleave_rev (exr_decode_pipeline_t* decode) + in2 = in1 + w; + in3 = in2 + w; + +- srcbuffer += w * 8; // 4 * sizeof(uint16_t), avoid type conversion ++ srcbuffer += (int64_t) w * 8; // 4 * sizeof(uint16_t), avoid type conversion + for (int x = 0; x < w; ++x) + { + combined.a = one_to_native16 (in0[x]); +@@ -633,7 +633,7 @@ unpack_half_to_float_4chan_interleave (exr_decode_pipeline_t* decode) + in2 = in1 + w; + in3 = in2 + w; + +- srcbuffer += w * 8; // 4 * sizeof(uint16_t), avoid type conversion ++ srcbuffer += (int64_t) w * 8; // 4 * sizeof(uint16_t), avoid type conversion + for (int x = 0; x < w; ++x) + { + out[0] = half_to_float (one_to_native16 (in3[x])); +@@ -674,7 +674,7 @@ unpack_half_to_float_4chan_interleave_rev (exr_decode_pipeline_t* decode) + in2 = in1 + w; + in3 = in2 + w; + +- srcbuffer += w * 8; // 4 * sizeof(uint16_t), avoid type conversion ++ srcbuffer += (int64_t) w * 8; // 4 * sizeof(uint16_t), avoid type conversion + for (int x = 0; x < w; ++x) + { + out[0] = half_to_float (one_to_native16 (in0[x])); +@@ -719,7 +719,7 @@ unpack_16bit_4chan_planar (exr_decode_pipeline_t* decode) + in1 = in0 + w; + in2 = in1 + w; + in3 = in2 + w; +- srcbuffer += w * 8; // 4 * sizeof(uint16_t), avoid type conversion ++ srcbuffer += (int64_t) w * 8; // 4 * sizeof(uint16_t), avoid type conversion + /* specialize to memcpy if we can */ + #if EXR_HOST_IS_NOT_LITTLE_ENDIAN + for (int x = 0; x < w; ++x) +@@ -775,7 +775,7 @@ unpack_half_to_float_4chan_planar (exr_decode_pipeline_t* decode) + in1 = in0 + w; + in2 = in1 + w; + in3 = in2 + w; +- srcbuffer += w * 8; // 4 * sizeof(uint16_t), avoid type conversion ++ srcbuffer += (int64_t) w * 8; // 4 * sizeof(uint16_t), avoid type conversion + + half_to_float_buffer ((float*) out0, in0, w); + half_to_float_buffer ((float*) out1, in1, w); +@@ -825,7 +825,7 @@ unpack_16bit_4chan (exr_decode_pipeline_t* decode) + in1 = in0 + w; + in2 = in1 + w; + in3 = in2 + w; +- srcbuffer += w * 8; // 4 * sizeof(uint16_t), avoid type conversion ++ srcbuffer += (int64_t) w * 8; // 4 * sizeof(uint16_t), avoid type conversion + for (int x = 0; x < w; ++x) + *((uint16_t*) (out0 + x * inc0)) = one_to_native16 (in0[x]); + for (int x = 0; x < w; ++x) +@@ -898,7 +898,7 @@ unpack_16bit (exr_decode_pipeline_t* decode) + } + } + #endif +- srcbuffer += w * 2; ++ srcbuffer += (int64_t) w * 2; + } + } + return EXR_ERR_SUCCESS; +@@ -963,7 +963,7 @@ unpack_32bit (exr_decode_pipeline_t* decode) + } + } + #endif +- srcbuffer += w * 4; ++ srcbuffer += (int64_t) w * 4; + } + } + return EXR_ERR_SUCCESS; +@@ -1118,7 +1118,7 @@ generic_unpack (exr_decode_pipeline_t* decode) + (uint64_t) decc->user_line_stride); + else + { +- srcbuffer += w * bpc; ++ srcbuffer += (int64_t) w * bpc; + continue; + } + } +@@ -1128,12 +1128,12 @@ generic_unpack (exr_decode_pipeline_t* decode) + } + else + { +- srcbuffer += w * bpc; ++ srcbuffer += (int64_t) w * bpc; + continue; + } + + UNPACK_SAMPLES (w) +- srcbuffer += w * bpc; ++ srcbuffer += (int64_t) w * bpc; + } + } + return EXR_ERR_SUCCESS; + +From f5f7f32d5761b8d28d61e391e9daf68bd62bc9e5 Mon Sep 17 00:00:00 2001 +From: Cary Phillips +Date: Sun, 29 Mar 2026 19:19:12 -0700 +Subject: [PATCH 3/6] Security: fix signed integer overflow in + `undo_pxr24_impl()` (PXR24 decoder) (#2323) + +In the `EXR_PIXEL_FLOAT` branch of `undo_pxr24_impl()`, the expressions + + (uint64_t)(w * 3) + +compute the signed 32-bit product `w * 3` before the cast to `uint64_t`. +When `w` is large this is undefined behavior under the C standard; on +two's-complement builds without sanitizers the result wraps to a small +positive value, which can cause the bounds check + + if (nDec + (uint64_t)(w * 3) > outSize) + +to pass incorrectly. If the check is bypassed the decode loop proceeds +to write `4*w` bytes through `dout`, potentially far beyond the allocated +output buffer. + +Fix: cast `w` to `uint64_t` before multiplying so that both the bounds +check and the counter update are performed entirely in 64-bit unsigned +arithmetic: + + (uint64_t)w * 3 (cast before multiply, not after) + +The `EXR_PIXEL_UINT` and `EXR_PIXEL_HALF` decode branches are unaffected: +they reuse the pre-computed `nBytes` variable, which is already formed as +`(uint64_t)(w) * (uint64_t)(bytes_per_element)`. + +Also fix the symmetric issue in `apply_pxr24_impl()` (the encoder): + lastIn += w * 4 +advances a pointer by a signed 32-bit product; corrected to + lastIn += (uint64_t)w * 4 + +Made-with: Cursor + +Signed-off-by: Cary Phillips +--- + .../plugin/hioOpenEXR/OpenEXR/OpenEXRCore/internal_pxr24.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/pxr/imaging/plugin/hioOpenEXR/OpenEXR/OpenEXRCore/internal_pxr24.c b/pxr/imaging/plugin/hioOpenEXR/OpenEXR/OpenEXRCore/internal_pxr24.c +index 43e52c982cf..30f71f4f846 100644 +--- a/pxr/imaging/plugin/hioOpenEXR/OpenEXR/OpenEXRCore/internal_pxr24.c ++++ b/pxr/imaging/plugin/hioOpenEXR/OpenEXR/OpenEXRCore/internal_pxr24.c +@@ -182,7 +182,7 @@ apply_pxr24_impl (exr_encode_pipeline_t* encode) + if (nOut + nBytes > encode->scratch_alloc_size_1) + return EXR_ERR_OUT_OF_MEMORY; + nOut += nBytes; +- lastIn += w * 4; ++ lastIn += (uint64_t) w * 4; + + ptr[0] = out; + out += w; +@@ -371,7 +371,7 @@ undo_pxr24_impl ( + ptr[2] = lastIn; + lastIn += w; + +- if (nDec + (uint64_t) (w * 3) > outSize) ++ if (nDec + (uint64_t) w * 3 > outSize) + return EXR_ERR_CORRUPT_CHUNK; + + for (int x = 0; x < w; ++x) +@@ -384,7 +384,7 @@ undo_pxr24_impl ( + unaligned_store32 (dout, pixel); + ++dout; + } +- nDec += (uint64_t) (w * 3); ++ nDec += (uint64_t) w * 3; + break; + } + default: return EXR_ERR_INVALID_ARGUMENT; + +From d578381a503add330b3b96b30cf6a49461989f08 Mon Sep 17 00:00:00 2001 +From: Cary Phillips +Date: Sun, 29 Mar 2026 19:19:49 -0700 +Subject: [PATCH 4/6] fix integer overflow in PIZ wavelet buffer arithmetic + (#2328) +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +Three classes of signed integer overflow in the PIZ codec path, all +reachable from corrupt `dataWindow` dimensions in the EXR file header. + +**`wav_2D_encode` / `wav_2D_decode` — wavelet loop pointer arithmetic** + +`oy` is passed as `int` (value `wcount * nx`, at most ~INT32_MAX after +the guard below). Inside the hierarchical wavelet loop the expressions + + ey = in + oy * (ny - p2) // pointer end-of-row sentinel + oy1 = oy * p // row stride at level p + oy2 = oy * p2 // row stride at level p2 + +multiply two values that can each approach INT32_MAX, producing a +signed 32-bit product that wraps to a small or negative value. The +wrapped value is used as a pointer offset, causing reads and writes +through `px` / `py` to land outside the allocated wavelet buffer. + +Fix: widen by introducing `int64_t oy64 = oy` and using it for all +three expressions; `oy1` and `oy2` are also declared `int64_t`. + +**`wavbuf += nx * ny * wcount` — per-channel buffer advance** + +`nx`, `ny`, and `wcount` are all `int`. Their triple product overflows +int32 for moderately large images, causing subsequent channels to be +processed at an incorrect (too-small) offset into the wavelet buffer, +corrupting both encode and decode output. + +Fix: cast to `(uint64_t)` before multiplying. + +**`wcount * nx` — call-site argument overflow** + +The fifth argument to `wav_2D_encode` / `wav_2D_decode` is `wcount * nx` +(`oy` = y-stride = elements per row). `wcount` is 1 or 2 +(`bytes_per_element / 2`); for `wcount = 2` the product overflows int32 +when `nx > INT32_MAX / 2`. + +Fix: add an early bounds check `if (wcount > 0 && nx > INT_MAX / wcount)` +that rejects such input as `EXR_ERR_CORRUPT_CHUNK` before any arithmetic +is performed. This also keeps `wcount * nx` within int32 range at the +call site, ensuring `oy` arrives in the wavelet functions with a valid +non-overflowed value. + +Made-with: Cursor + +Signed-off-by: Cary Phillips +--- + .../OpenEXR/OpenEXRCore/internal_piz.c | 39 +++++++++++-------- + 1 file changed, 23 insertions(+), 16 deletions(-) + +diff --git a/pxr/imaging/plugin/hioOpenEXR/OpenEXR/OpenEXRCore/internal_piz.c b/pxr/imaging/plugin/hioOpenEXR/OpenEXR/OpenEXRCore/internal_piz.c +index 6c2750b166f..787d2752c61 100644 +--- a/pxr/imaging/plugin/hioOpenEXR/OpenEXR/OpenEXRCore/internal_piz.c ++++ b/pxr/imaging/plugin/hioOpenEXR/OpenEXR/OpenEXRCore/internal_piz.c +@@ -10,6 +10,7 @@ + #include "internal_huf.h" + #include "internal_xdr.h" + ++#include + #include + + /**************************************/ +@@ -171,10 +172,11 @@ wdec16 (uint16_t l, uint16_t h, uint16_t* a, uint16_t* b) + static void + wav_2D_encode (uint16_t* in, int nx, int ox, int ny, int oy, uint16_t mx) + { +- int w14 = (mx < (1 << 14)) ? 1 : 0; +- int n = (nx > ny) ? ny : nx; +- int p = 1; // == 1 << level +- int p2 = 2; // == 1 << (level+1) ++ int w14 = (mx < (1 << 14)) ? 1 : 0; ++ int n = (nx > ny) ? ny : nx; ++ int p = 1; // == 1 << level ++ int p2 = 2; // == 1 << (level+1) ++ int64_t oy64 = oy; + + // + // Hierarchical loop on smaller dimension n +@@ -183,9 +185,9 @@ wav_2D_encode (uint16_t* in, int nx, int ox, int ny, int oy, uint16_t mx) + while (p2 <= n) + { + uint16_t* py = in; +- uint16_t* ey = in + oy * (ny - p2); +- int oy1 = oy * p; +- int oy2 = oy * p2; ++ uint16_t* ey = in + oy64 * (ny - p2); ++ int64_t oy1 = oy64 * p; ++ int64_t oy2 = oy64 * p2; + int ox1 = ox * p; + int ox2 = ox * p2; + uint16_t i00, i01, i10, i11; +@@ -284,10 +286,11 @@ wav_2D_decode ( + int oy, // i : y offset + uint16_t mx) // i : maximum in[x][y] value + { +- int w14 = (mx < (1 << 14)) ? 1 : 0; +- int n = (nx > ny) ? ny : nx; +- int p = 1; +- int p2; ++ int w14 = (mx < (1 << 14)) ? 1 : 0; ++ int n = (nx > ny) ? ny : nx; ++ int p = 1; ++ int p2; ++ int64_t oy64 = oy; + + // + // Search max level +@@ -307,9 +310,9 @@ wav_2D_decode ( + while (p >= 1) + { + uint16_t* py = in; +- uint16_t* ey = in + oy * (ny - p2); +- int oy1 = oy * p; +- int oy2 = oy * p2; ++ uint16_t* ey = in + oy64 * (ny - p2); ++ int64_t oy1 = oy64 * p; ++ int64_t oy2 = oy64 * p2; + int ox1 = ox * p; + int ox2 = ox * p2; + uint16_t i00, i01, i10, i11; +@@ -502,11 +505,13 @@ internal_exr_apply_piz (exr_encode_pipeline_t* encode) + nx = curc->width; + ny = curc->height; + wcount = (int) (curc->bytes_per_element / 2); ++ if (wcount > 0 && nx > INT_MAX / wcount) ++ return EXR_ERR_CORRUPT_CHUNK; + for (int j = 0; j < wcount; ++j) + { + wav_2D_encode (wavbuf + j, nx, wcount, ny, wcount * nx, maxValue); + } +- wavbuf += nx * ny * wcount; ++ wavbuf += (uint64_t) nx * ny * wcount; + } + + nBytes = 0; +@@ -655,11 +660,13 @@ internal_exr_undo_piz ( + nx = curc->width; + ny = curc->height; + wcount = (int) (curc->bytes_per_element / 2); ++ if (wcount > 0 && nx > INT_MAX / wcount) ++ return EXR_ERR_CORRUPT_CHUNK; + for (int j = 0; j < wcount; ++j) + { + wav_2D_decode (wavbuf + j, nx, wcount, ny, wcount * nx, maxValue); + } +- wavbuf += nx * ny * wcount; ++ wavbuf += (uint64_t) nx * ny * wcount; + } + + // + +From a76474285ddc24e9956b5e12fab658b908912ed4 Mon Sep 17 00:00:00 2001 +From: Cary Phillips +Date: Sun, 29 Mar 2026 19:20:52 -0700 +Subject: [PATCH 5/6] Fix signed integer overflow in + `LossyDctDecoder_execute()` pointer arithmetic (#2329) + +`numBlocksX` and `numBlocksY` are declared as `int`. Two pointer-offset +expressions in `LossyDctDecoder_execute()` multiplied them as signed +32-bit integers before using the result as a pointer offset: + + rowBlock[comp] = rowBlock[comp - 1] + numBlocksX * 64; + currDcComp[comp] = currDcComp[comp - 1] + numBlocksX * numBlocksY; + +`dataWindow.max.x` is a signed 32-bit value in the EXR file format, so +`numBlocksX` can reach `(INT32_MAX + 7) / 8 = 268,435,456`. At that +point `numBlocksX * 64 = 17,179,869,184` overflows `int32`, and +`numBlocksX * numBlocksY` overflows even sooner. The wraparound +produces a small or negative pointer offset, causing `rowBlock[comp]` +and `currDcComp[comp]` to point into already-used or pre-buffer memory +rather than the intended component stride. + +Fix: cast `numBlocksX` to `size_t` before multiplying so the +arithmetic is performed in pointer-sized unsigned arithmetic: + + rowBlock[comp] = rowBlock[comp - 1] + (size_t) numBlocksX * 64; + currDcComp[comp] = currDcComp[comp - 1] + (size_t) numBlocksX * numBlocksY; + +This is consistent with the allocation on the line above, which already +uses `(size_t) numComp * (size_t) numBlocksX * 64 * sizeof(uint16_t)`, +and with the packed-DC count check, which uses explicit `uint64_t` casts. + +Made-with: Cursor + +Signed-off-by: Cary Phillips +--- + .../hioOpenEXR/OpenEXR/OpenEXRCore/internal_dwa_decoder.h | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/pxr/imaging/plugin/hioOpenEXR/OpenEXR/OpenEXRCore/internal_dwa_decoder.h b/pxr/imaging/plugin/hioOpenEXR/OpenEXR/OpenEXRCore/internal_dwa_decoder.h +index bcdebd985f9..e289b064dac 100644 +--- a/pxr/imaging/plugin/hioOpenEXR/OpenEXR/OpenEXRCore/internal_dwa_decoder.h ++++ b/pxr/imaging/plugin/hioOpenEXR/OpenEXR/OpenEXRCore/internal_dwa_decoder.h +@@ -265,7 +265,7 @@ LossyDctDecoder_execute ( + } + + for (int comp = 1; comp < numComp; ++comp) +- rowBlock[comp] = rowBlock[comp - 1] + numBlocksX * 64; ++ rowBlock[comp] = rowBlock[comp - 1] + (size_t) numBlocksX * 64; + + // + // Pack DC components together by common plane, so we can get +@@ -275,7 +275,7 @@ LossyDctDecoder_execute ( + + currDcComp[0] = (uint16_t*) d->_packedDc; + for (int comp = 1; comp < numComp; ++comp) +- currDcComp[comp] = currDcComp[comp - 1] + numBlocksX * numBlocksY; ++ currDcComp[comp] = currDcComp[comp - 1] + (size_t) numBlocksX * numBlocksY; + + for (int blocky = 0; blocky < numBlocksY; ++blocky) + { + +From 219a0870506f80c7353016800e467ad0de923424 Mon Sep 17 00:00:00 2001 +From: Cary Phillips +Date: Tue, 31 Mar 2026 07:49:09 -0700 +Subject: [PATCH 6/6] =?UTF-8?q?Fix=20misaligned=20memory=20access=20in=20`?= + =?UTF-8?q?LossyDctDecoder=5Fexecute`=20HALF=E2=86=92FLOAT=20expansion=20(?= + =?UTF-8?q?#2324)?= +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +* Fix misaligned memory access in `LossyDctDecoder_execute` HALF→FLOAT expansion + +After DCT decoding, `LossyDctDecoder_execute()` expands FLOAT-type channels +from their intermediate HALF (16-bit) XDR representation back to FLOAT (32-bit) +XDR in place. The expansion was done by casting `_rows[y]` (a `uint8_t *`) +directly to `float *` and `uint16_t *`, then reading and writing through those +typed pointers. + +Because row buffers are assigned by advancing a byte pointer with no alignment +padding (`outBufferEnd += chan->width * chan->bytes_per_element` in +`internal_dwa_compressor.h`), a FLOAT channel that follows a HALF channel of +odd width receives a `_rows[y]` pointer that is 2-byte aligned but not 4-byte +aligned. Dereferencing a `float *` cast from such a pointer is undefined +behavior under the C standard: + +- On ARM, RISC-V, and MIPS (strict alignment) this crashes immediately. +- On x86 it is silently tolerated at the hardware level but remains UB: + auto-vectorizing compilers (SSE/AVX) may assume aligned access and generate + incorrect code. +- UBSan reports: `store to misaligned address ... for type 'float', which + requires 4 byte alignment` at `internal_dwa_decoder.h:749`. + +Fix: replace the cast-and-dereference pattern with the `unaligned_load16` / +`memcpy` / `unaligned_store32` helpers already used throughout the rest of +OpenEXRCore (`internal_xdr.h`, `unpack.c`, `pack.c`, `internal_pxr24.c`). +These helpers use `memcpy` internally, which the C standard guarantees is safe +for unaligned addresses and which compilers compile to a single load/store +instruction on architectures that support it. + +The byte-order handling is preserved correctly: +- `unaligned_load16` reads 2 bytes via `memcpy` and applies `one_to_native16` + (XDR → native), returning a native-endian HALF value. +- `half_to_float` converts native HALF → native float. +- `memcpy(&bits, &f, 4)` reinterprets the float's bit pattern as `uint32_t` + without numeric conversion (the correct type-pun idiom in C). +- `unaligned_store32` applies `one_from_native32` (native → XDR) and writes + 4 bytes via `memcpy`, storing the result in XDR float format. + +Made-with: Cursor +Signed-off-by: Cary Phillips + +* add TODO comment + +Signed-off-by: Cary Phillips + +--------- + +Signed-off-by: Cary Phillips +--- + .../OpenEXR/OpenEXRCore/internal_dwa_decoder.h | 17 +++++++++++++---- + 1 file changed, 13 insertions(+), 4 deletions(-) + +diff --git a/pxr/imaging/plugin/hioOpenEXR/OpenEXR/OpenEXRCore/internal_dwa_decoder.h b/pxr/imaging/plugin/hioOpenEXR/OpenEXR/OpenEXRCore/internal_dwa_decoder.h +index e289b064dac..046615ec5b8 100644 +--- a/pxr/imaging/plugin/hioOpenEXR/OpenEXR/OpenEXRCore/internal_dwa_decoder.h ++++ b/pxr/imaging/plugin/hioOpenEXR/OpenEXR/OpenEXRCore/internal_dwa_decoder.h +@@ -651,13 +651,22 @@ LossyDctDecoder_execute ( + /* process in place in reverse to avoid temporary buffer */ + for (int y = 0; y < d->_height; ++y) + { +- float* floatXdrPtr = (float*) chanData[chan]->_rows[y]; +- uint16_t* halfXdr = (uint16_t*) floatXdrPtr; ++ uint8_t* rowBytes = chanData[chan]->_rows[y]; + + for (int x = d->_width - 1; x >= 0; --x) + { +- floatXdrPtr[x] = one_from_native_float ( +- half_to_float (one_to_native16 (halfXdr[x]))); ++ // TODO: make an unaligned_store32f that takes the float and ++ // packages up a one_from_native_float and calls memcpy ++ // instead of the two memcpy. We should look at the metrics ++ // for dwa and see if there's a performance difference to do ++ // so at some point. See: ++ // https://github.com/AcademySoftwareFoundation/openexr/pull/2324 ++ ++ uint16_t h = unaligned_load16 (rowBytes + x * sizeof (uint16_t)); ++ float f = half_to_float (h); ++ uint32_t bits; ++ memcpy (&bits, &f, sizeof (bits)); ++ unaligned_store32 (rowBytes + x * sizeof (float), bits); + } + } + } diff --git a/sources b/sources index 695949f..d2dbf60 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (OpenUSD-26.08.tar.gz) = 82f7bb4f77b295be79cd36f591f242276d36c0d589b0fca383344c27e70daf7e29151bf587528bb2fc2b2a8b974387a253993ace3caf5f79ae70f9ebbc71cf1a +SHA512 (OpenUSD-26.03.tar.gz) = 3d5dae46c7ae096501dc51b373ba05c8603a1cf16e5054728d41d0c2970b59ce3ee5ec83e1c575b92482bc8cf2c59643df093a9e7aa82bcdd53dada05292720d diff --git a/usd.spec b/usd.spec index 05bcd6e..e2186c4 100644 --- a/usd.spec +++ b/usd.spec @@ -2,7 +2,7 @@ # package version, as a reminder of the need to rebuild dependent packages on # every update. See additional notes near the downstream ABI versioning patch. # It should be 0.MAJOR.MINOR without leading zeros, e.g. 22.03 → 0.22.3. -%global downstream_so_version 0.26.8 +%global downstream_so_version 0.26.3 %bcond alembic 1 %bcond draco 1 @@ -25,7 +25,7 @@ %bcond test 0 Name: usd -Version: 26.08 +Version: 26.03 Release: %autorelease Summary: 3D VFX pipeline interchange file format @@ -151,14 +151,18 @@ Patch: 0006-Downstream-only-use-the-system-libavif.patch # Backport fixes for CVE-2025-64181 etc. in OpenEXRCore # https://github.com/PixarAnimationStudios/OpenUSD/pull/3903 Patch: %{forgeurl}/pull/3903.patch - -# Replace PyWeakref_GetObject with PyWeakref_GetRef -# Fixes RHBZ#2433881. This patch is LLM-generated and needs expert human -# review, but it at least builds. See discussion in -# https://bugzilla.redhat.com/show_bug.cgi?id=2433881. -# Mentioned upstream in -# https://github.com/PixarAnimationStudios/OpenUSD/issues/3966#issuecomment-5128542913. -Patch: 0001-Replace-PyWeakref_GetObject-with-PyWeakref_GetRef.patch +# Backport fix for CVE-2026-34544 in OpenEXRCore +# https://github.com/PixarAnimationStudios/OpenUSD/pull/4028 +Patch: %{forgeurl}/pull/4028.patch +# Backport several OpenEXRCore security fixes +# https://github.com/PixarAnimationStudios/OpenUSD/pull/4030 +# Fixes: +# - CVE-2026-34378 / GHSA-v76p-4qvv-vh4g / RHBZ#2455493 +# - CVE-2026-34380 / GHSA-q3v8-hw4m-59w5 / RHBZ#2455534 +# - CVE-2026-34588 / GHSA-588r-cr5c-w6hf / RHBZ#2455505 +# - CVE-2026-34589 / GHSA-p8xc-w3q4-h64x / RHBZ#2455501 +# - CVE-2026-34379 / GHSA-w88v-vqhq-5p24 / RHBZ#2455497 +Patch: %{forgeurl}/pull/4030.patch # Base BuildRequires: gcc-c++ @@ -238,7 +242,7 @@ BuildRequires: openvdb-devel %endif %if %{with ptex} -BuildRequires: cmake(ptex) +BuildRequires: pkgconfig(ptex) %endif # Header-only library: -static is for tracking per guidelines @@ -722,7 +726,6 @@ desktop-file-validate %{buildroot}%{_datadir}/applications/org.openusd.usdview.d %{_bindir}/usdstitch %{_bindir}/usdstitchclips %{_bindir}/usdtree -%{_bindir}/usdupdatecrate %{_bindir}/usdzip %if %{with usdview} %{_datadir}/applications/org.openusd.usdview.desktop @@ -754,7 +757,6 @@ desktop-file-validate %{buildroot}%{_datadir}/applications/org.openusd.usdview.d %{_mandir}/man1/usdstitch.1* %{_mandir}/man1/usdstitchclips.1* %{_mandir}/man1/usdtree.1* -%{_mandir}/man1/usdupdatecrate.1* %{_mandir}/man1/usdzip.1* %if %{with usdview} %{_mandir}/man1/testusdview.1*