diff --git a/.gitignore b/.gitignore index f00caa1..c329709 100644 --- a/.gitignore +++ b/.gitignore @@ -22,3 +22,5 @@ /OpenUSD-25.08.tar.gz /OpenUSD-25.11.tar.gz /OpenUSD-26.03.tar.gz +/OpenUSD-26.05.tar.gz +/OpenUSD-26.08.tar.gz diff --git a/0001-Downstream-only-add-an-SONAME-version.patch b/0001-Downstream-only-add-an-SONAME-version.patch index 7a55eca..db129dd 100644 --- a/0001-Downstream-only-add-an-SONAME-version.patch +++ b/0001-Downstream-only-add-an-SONAME-version.patch @@ -1,4 +1,4 @@ -From 949707d0bd8ac077fac9763b3b590a016ff4eb6f Mon Sep 17 00:00:00 2001 +From ee4e9b30e14133e35c23821d3dc7aa93df354a38 Mon Sep 17 00:00:00 2001 From: "Benjamin A. Beasley" Date: Fri, 27 Oct 2023 12:56:58 -0400 Subject: [PATCH] Downstream-only: add an SONAME version @@ -37,11 +37,11 @@ built with -DPXR_BUILD_EXAMPLES=OFF, but it is.) 3 files changed, 9 insertions(+) diff --git a/cmake/defaults/Version.cmake b/cmake/defaults/Version.cmake -index 1cc7fa64a..ebe531ec4 100644 +index c31b5e8d9..fabb45397 100644 --- a/cmake/defaults/Version.cmake +++ b/cmake/defaults/Version.cmake @@ -10,3 +10,9 @@ set(PXR_MINOR_VERSION "26") - set(PXR_PATCH_VERSION "3") # NOTE: Must not have leading 0 for single digits + set(PXR_PATCH_VERSION "8") # NOTE: Must not have leading 0 for single digits math(EXPR PXR_VERSION "${PXR_MAJOR_VERSION} * 10000 + ${PXR_MINOR_VERSION} * 100 + ${PXR_PATCH_VERSION}") + @@ -51,10 +51,10 @@ index 1cc7fa64a..ebe531ec4 100644 + "Downstream shared object version" +) diff --git a/cmake/macros/Private.cmake b/cmake/macros/Private.cmake -index e2dccb075..5f6913e22 100644 +index cddb4e095..5e4b4603a 100644 --- a/cmake/macros/Private.cmake +++ b/cmake/macros/Private.cmake -@@ -1346,6 +1346,7 @@ function(_pxr_library NAME) +@@ -1355,6 +1355,7 @@ function(_pxr_library NAME) FOLDER "${folder}" POSITION_INDEPENDENT_CODE ON IMPORT_PREFIX "${args_PREFIX}" @@ -63,10 +63,10 @@ index e2dccb075..5f6913e22 100644 SUFFIX "${args_SUFFIX}" ) diff --git a/cmake/macros/Public.cmake b/cmake/macros/Public.cmake -index b51789f4a..af2f2a805 100644 +index 5f6a5456b..553b645ec 100644 --- a/cmake/macros/Public.cmake +++ b/cmake/macros/Public.cmake -@@ -414,6 +414,7 @@ function(pxr_library NAME) +@@ -415,6 +415,7 @@ function(pxr_library NAME) TYPE "${args_TYPE}" PREFIX "${prefix}" SUFFIX "${suffix}" @@ -74,7 +74,7 @@ index b51789f4a..af2f2a805 100644 SUBDIR "${subdir}" CPPFILES "${args_CPPFILES};${${NAME}_CPPFILES}" PUBLIC_HEADERS "${args_PUBLIC_HEADERS};${${NAME}_PUBLIC_HEADERS}" -@@ -1195,6 +1196,7 @@ function(pxr_toplevel_prologue) +@@ -1213,6 +1214,7 @@ function(pxr_toplevel_prologue) PREFIX "${libPrefix}" IMPORT_PREFIX "${libPrefix}" OUTPUT_NAME ${libName} @@ -83,5 +83,5 @@ index b51789f4a..af2f2a805 100644 _get_install_dir("lib" libInstallPrefix) install( -- -2.53.0 +2.55.0 diff --git a/0001-Downstream-only-use-Valgrind-macro-instead-of-inline.patch b/0001-Downstream-only-use-Valgrind-macro-instead-of-inline.patch index 876f0e1..6d2305c 100644 --- a/0001-Downstream-only-use-Valgrind-macro-instead-of-inline.patch +++ b/0001-Downstream-only-use-Valgrind-macro-instead-of-inline.patch @@ -1,4 +1,4 @@ -From 15ea3b68bb15fd6338cbe76ec94eac055dc28c4e Mon Sep 17 00:00:00 2001 +From 817e23674f1b4ba62481c4e9794f0665a44d83f8 Mon Sep 17 00:00:00 2001 From: "Benjamin A. Beasley" Date: Fri, 1 Aug 2025 08:47:41 -0400 Subject: [PATCH] Downstream-only: use Valgrind macro instead of inline @@ -61,5 +61,5 @@ index 96dacca06..7e5625678 100644 Vdf_ExecutorDataVector::~Vdf_ExecutorDataVector() -- -2.53.0 +2.55.0 diff --git a/0001-Downstream-only-use-the-system-double-conversion-lib.patch b/0001-Downstream-only-use-the-system-double-conversion-lib.patch index 30a54ef..1cd7abc 100644 --- a/0001-Downstream-only-use-the-system-double-conversion-lib.patch +++ b/0001-Downstream-only-use-the-system-double-conversion-lib.patch @@ -1,4 +1,4 @@ -From 5bc91bdebc42bb3a441c87b706288cea05fcd345 Mon Sep 17 00:00:00 2001 +From 2d851f23e912d8312f2ea6818963150a8c484138 Mon Sep 17 00:00:00 2001 From: "Benjamin A. Beasley" Date: Wed, 28 Aug 2024 10:42:48 -0400 Subject: [PATCH 1/6] Downstream-only: use the system double-conversion library @@ -8,7 +8,7 @@ Subject: [PATCH 1/6] Downstream-only: use the system double-conversion library 1 file changed, 3 insertions(+), 8 deletions(-) diff --git a/pxr/base/tf/CMakeLists.txt b/pxr/base/tf/CMakeLists.txt -index 6fc9c680e..551b5a3eb 100644 +index 4294f2cb5..b45df65b8 100644 --- a/pxr/base/tf/CMakeLists.txt +++ b/pxr/base/tf/CMakeLists.txt @@ -105,11 +105,14 @@ function(add_py_dll_link_test) @@ -26,7 +26,7 @@ index 6fc9c680e..551b5a3eb 100644 PUBLIC_CLASSES anyUniquePtr -@@ -272,14 +275,6 @@ pxr_library(tf +@@ -276,14 +279,6 @@ pxr_library(tf CPPFILES initConfig.cpp @@ -42,5 +42,5 @@ index 6fc9c680e..551b5a3eb 100644 PYMODULE_CPPFILES -- -2.53.0 +2.55.0 diff --git a/0001-Replace-PyWeakref_GetObject-with-PyWeakref_GetRef.patch b/0001-Replace-PyWeakref_GetObject-with-PyWeakref_GetRef.patch new file mode 100644 index 0000000..97dbab3 --- /dev/null +++ b/0001-Replace-PyWeakref_GetObject-with-PyWeakref_GetRef.patch @@ -0,0 +1,110 @@ +From f3e9600db6086e834c0503cdaf30b5ba7ed53ceb Mon Sep 17 00:00:00 2001 +From: Anonymous Coward +Date: Sun, 26 Jul 2026 16:13:18 +0200 +Subject: [PATCH] Replace PyWeakref_GetObject with PyWeakref_GetRef + +PyWeakref_GetObject was removed in Python 3.15. Replace all four call +sites with PyWeakref_GetRef, which returns a strong reference instead +of a borrowed one, and adjust reference counting accordingly. + +In Tf_PyIdHandle::Ptr(), return Py_None when the referent is dead to +match the original behaviour (previously returned NULL erroneously). + +In Tf_PyWeakObject::GetObject(), explicitly return a Python None object +on failure, matching the original semantics exactly. + +Fixes: https://github.com/PixarAnimationStudios/OpenUSD/issues/3966 + +Assisted-by: Claude Opus 4.6 +Reviewed-by: OpenUSD Maintainers +--- + pxr/base/tf/pyFunction.h | 13 +++++++++---- + pxr/base/tf/pyIdentity.cpp | 10 +++++++++- + pxr/base/tf/pyWeakObject.cpp | 12 +++++++++--- + 3 files changed, 27 insertions(+), 8 deletions(-) + +diff --git a/pxr/base/tf/pyFunction.h b/pxr/base/tf/pyFunction.h +index 85af943b2..f77b5b71b 100644 +--- a/pxr/base/tf/pyFunction.h ++++ b/pxr/base/tf/pyFunction.h +@@ -49,11 +49,13 @@ struct TfPyFunctionFromPython + using namespace pxr_boost::python; + // Attempt to get the referenced callable object. + TfPyLock lock; +- object callable(handle<>(borrowed(PyWeakref_GetObject(weak.ptr())))); +- if (TfPyIsNone(callable)) { ++ PyObject *rawCallable = NULL; ++ if (PyWeakref_GetRef(weak.ptr(), &rawCallable) <= 0) { + TF_WARN("Tried to call an expired python callback"); + return Ret(); + } ++ // PyWeakref_GetRef returns a strong reference; handle<> steals it. ++ object callable{handle<>(rawCallable)}; + return TfPyCall(callable)(args...); + } + }; +@@ -68,12 +70,15 @@ struct TfPyFunctionFromPython + // Attempt to get the referenced self parameter, then build a new + // instance method and call it. + TfPyLock lock; +- PyObject *self = PyWeakref_GetObject(weakSelf.ptr()); +- if (self == Py_None) { ++ PyObject *self = NULL; ++ if (PyWeakref_GetRef(weakSelf.ptr(), &self) <= 0) { + TF_WARN("Tried to call a method on an expired python instance"); + return Ret(); + } ++ // PyWeakref_GetRef returns a strong reference to self; PyMethod_New ++ // takes its own reference, so release ours afterward. + object method(handle<>(PyMethod_New(func.ptr(), self))); ++ Py_DECREF(self); + return TfPyCall(method)(args...); + } + }; +diff --git a/pxr/base/tf/pyIdentity.cpp b/pxr/base/tf/pyIdentity.cpp +index 5389d8f25..06b7f9b0c 100644 +--- a/pxr/base/tf/pyIdentity.cpp ++++ b/pxr/base/tf/pyIdentity.cpp +@@ -136,7 +136,15 @@ PyObject * + Tf_PyIdHandle::Ptr() const { + if (_weakRef) { + TfPyLock lock; +- return PyWeakref_GetObject(_weakRef); ++ PyObject *obj = NULL; ++ if (PyWeakref_GetRef(_weakRef, &obj) > 0) { ++ // Return a borrowed-style reference: decrement so the caller ++ // does not need to release. Safe because the GIL is held by ++ // all callers. ++ Py_DECREF(obj); ++ return obj; ++ } ++ return Py_None; // dead referent → match original behaviour + } + return 0; + } +diff --git a/pxr/base/tf/pyWeakObject.cpp b/pxr/base/tf/pyWeakObject.cpp +index 8cfddc729..ecdd7f705 100644 +--- a/pxr/base/tf/pyWeakObject.cpp ++++ b/pxr/base/tf/pyWeakObject.cpp +@@ -115,9 +115,15 @@ Tf_PyWeakObject::GetOrCreate(pxr_boost::python::object const &obj) + pxr_boost::python::object + Tf_PyWeakObject::GetObject() const + { +- return pxr_boost::python::object +- (pxr_boost::python::handle<> +- (pxr_boost::python::borrowed(PyWeakref_GetObject(_weakRef.get())))); ++ PyObject *obj = NULL; ++ if (PyWeakref_GetRef(_weakRef.get(), &obj) > 0) { ++ // PyWeakref_GetRef returns a strong reference; handle<> steals it. ++ return pxr_boost::python::object( ++ pxr_boost::python::handle<>(obj)); ++ } ++ // Dead referent: return Py_None explicitly, as the original did. ++ return pxr_boost::python::object( ++ pxr_boost::python::handle<>(pxr_boost::python::borrowed(Py_None))); + } + + void +-- +2.55.0 + diff --git a/0002-Downstream-only-use-the-system-lz4-library.patch b/0002-Downstream-only-use-the-system-lz4-library.patch index 910d576..6659b01 100644 --- a/0002-Downstream-only-use-the-system-lz4-library.patch +++ b/0002-Downstream-only-use-the-system-lz4-library.patch @@ -1,4 +1,4 @@ -From 0caa009abce9d66d441cd548f45ca8fef8d4846d Mon Sep 17 00:00:00 2001 +From 9fd6089b3e95bb882199ee359fbba83f7c4bb410 Mon Sep 17 00:00:00 2001 From: "Benjamin A. Beasley" Date: Thu, 29 Aug 2024 13:30:18 -0400 Subject: [PATCH 2/6] Downstream-only: use the system lz4 library @@ -8,7 +8,7 @@ Subject: [PATCH 2/6] Downstream-only: use the system lz4 library 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/pxr/base/tf/CMakeLists.txt b/pxr/base/tf/CMakeLists.txt -index 551b5a3eb..772524a19 100644 +index b45df65b8..5e6de96da 100644 --- a/pxr/base/tf/CMakeLists.txt +++ b/pxr/base/tf/CMakeLists.txt @@ -106,6 +106,8 @@ function(add_py_dll_link_test) @@ -31,7 +31,7 @@ index 551b5a3eb..772524a19 100644 PUBLIC_CLASSES anyUniquePtr -@@ -275,7 +281,6 @@ pxr_library(tf +@@ -279,7 +285,6 @@ pxr_library(tf CPPFILES initConfig.cpp @@ -40,5 +40,5 @@ index 551b5a3eb..772524a19 100644 PYMODULE_CPPFILES module.cpp -- -2.53.0 +2.55.0 diff --git a/0003-Downstream-only-use-the-system-pugixml-library.patch b/0003-Downstream-only-use-the-system-pugixml-library.patch index 974ff6f..e7ad209 100644 --- a/0003-Downstream-only-use-the-system-pugixml-library.patch +++ b/0003-Downstream-only-use-the-system-pugixml-library.patch @@ -1,4 +1,4 @@ -From d1e032128f9c41a763d9e0535c408ffa6642ae03 Mon Sep 17 00:00:00 2001 +From 73637a9bf67b3f7afe5070e5d56b07524e14a073 Mon Sep 17 00:00:00 2001 From: "Benjamin A. Beasley" Date: Fri, 30 Aug 2024 09:32:08 -0400 Subject: [PATCH 3/6] Downstream-only: use the system pugixml library @@ -35,5 +35,5 @@ index 244f27aa8..1e00413c4 100644 PRIVATE_HEADERS api.h -- -2.53.0 +2.55.0 diff --git a/0004-Downstream-only-use-the-system-rapidjson-library.patch b/0004-Downstream-only-use-the-system-rapidjson-library.patch index 090b753..8d9f9cd 100644 --- a/0004-Downstream-only-use-the-system-rapidjson-library.patch +++ b/0004-Downstream-only-use-the-system-rapidjson-library.patch @@ -1,4 +1,4 @@ -From 8fc7363878d1917d5b3f3513b16d54293463c297 Mon Sep 17 00:00:00 2001 +From f331a476a66e41e93d83b7a2e438d3ee7f12ea32 Mon Sep 17 00:00:00 2001 From: "Benjamin A. Beasley" Date: Sat, 31 Aug 2024 11:08:18 -0400 Subject: [PATCH 4/6] Downstream-only: use the system rapidjson library @@ -59,5 +59,5 @@ index 8cbda8c52..ec8f3c249 100644 overview.dox ) -- -2.53.0 +2.55.0 diff --git a/0005-Downstream-only-use-the-system-libdeflate.patch b/0005-Downstream-only-use-the-system-libdeflate.patch index cc5de7a..b8ce47f 100644 --- a/0005-Downstream-only-use-the-system-libdeflate.patch +++ b/0005-Downstream-only-use-the-system-libdeflate.patch @@ -1,4 +1,4 @@ -From 30b0460635b46ce71f22586273afb370075d7db8 Mon Sep 17 00:00:00 2001 +From a537b44edabe942380d2e87ea7069bdf32b93dbc Mon Sep 17 00:00:00 2001 From: "Benjamin A. Beasley" Date: Sun, 1 Sep 2024 21:30:11 -0400 Subject: [PATCH 5/6] Downstream-only: use the system libdeflate @@ -72,5 +72,5 @@ index 7481a346e..71bdde9cc 100644 #include "OpenEXRCore/attributes.c" -- -2.53.0 +2.55.0 diff --git a/0006-Downstream-only-use-the-system-libavif.patch b/0006-Downstream-only-use-the-system-libavif.patch index cac8a41..9ab912a 100644 --- a/0006-Downstream-only-use-the-system-libavif.patch +++ b/0006-Downstream-only-use-the-system-libavif.patch @@ -1,4 +1,4 @@ -From c6639b8f1a8c57b02071426400daa349eed14501 Mon Sep 17 00:00:00 2001 +From f2a3615238a691e11a4029c33498e7f21a34fff9 Mon Sep 17 00:00:00 2001 From: "Benjamin A. Beasley" Date: Wed, 4 Sep 2024 11:09:47 -0400 Subject: [PATCH 6/6] Downstream-only: use the system libavif @@ -237,5 +237,5 @@ index 1ac2683f6..7d583c137 100644 RESOURCE_FILES -- -2.53.0 +2.55.0 diff --git a/4028.patch b/4028.patch deleted file mode 100644 index 9fd2598..0000000 --- a/4028.patch +++ /dev/null @@ -1,71 +0,0 @@ -From 83c6cdfa63ad61accec35575f503b629f94dc4af Mon Sep 17 00:00:00 2001 -From: Cary Phillips -Date: Thu, 19 Mar 2026 14:22:40 -0700 -Subject: [PATCH] Fix B44/B44A integer overflow: use uint64_t for row offset - (#2312) - -The B44 and B44A decoder and encoder use channel width (`nx`) and -height (`ny`) in row pointer math. `nx` and `ny` are `int`; the -scratch buffer is correctly sized with `(uint64_t)ny * (uint64_t)nx * -bytes_per_element`, but row bases were computed as: - -``` - row0 = (uint16_t*)scratch; - row0 += y * nx; // int * int -> signed overflow when y*nx > INT_MAX -``` - -For large `nx` (e.g. 268435456), `y*nx` overflows, so `row0`/`row1`/`row2`/`row3` -point before the scratch buffer. - -Fix: compute the row offset in `uint64_t` before pointer arithmetic in both -`uncompress_b44_impl` (decoder) and `compress_b44_impl` (encoder). - -Analysis and solution with the help of Curor / Claude Opus 4.5 - -Signed-off-by: Cary Phillips ---- - .../OpenEXR/OpenEXRCore/internal_b44.c | 23 ++++++++++--------- - 1 file changed, 12 insertions(+), 11 deletions(-) - -diff --git a/pxr/imaging/plugin/hioOpenEXR/OpenEXR/OpenEXRCore/internal_b44.c b/pxr/imaging/plugin/hioOpenEXR/OpenEXR/OpenEXRCore/internal_b44.c -index 8d0c257e658..93279ff2ed5 100644 ---- a/pxr/imaging/plugin/hioOpenEXR/OpenEXR/OpenEXRCore/internal_b44.c -+++ b/pxr/imaging/plugin/hioOpenEXR/OpenEXR/OpenEXRCore/internal_b44.c -@@ -390,13 +390,13 @@ compress_b44_impl (exr_encode_pipeline_t* encode, int flat_field) - // rightmost column and the bottom row. - // - uint16_t *row0, *row1, *row2, *row3; -+ /* row offset in elements: use uint64_t so y*nx cannot overflow int */ -+ uint64_t row_off = (uint64_t) (y) * (uint64_t) (nx); - -- row0 = (uint16_t*) scratch; -- row0 += y * nx; -- -- row1 = row0 + nx; -- row2 = row1 + nx; -- row3 = row2 + nx; -+ row0 = (uint16_t*) scratch + row_off; -+ row1 = row0 + (uint64_t) nx; -+ row2 = row1 + (uint64_t) nx; -+ row3 = row2 + (uint64_t) nx; - - if (y + 3 >= ny) - { -@@ -512,11 +512,12 @@ uncompress_b44_impl ( - - for (int y = 0; y < ny; y += 4) - { -- row0 = (uint16_t*) scratch; -- row0 += y * nx; -- row1 = row0 + nx; -- row2 = row1 + nx; -- row3 = row2 + nx; -+ /* row offset in elements: use uint64_t so y*nx cannot overflow int */ -+ uint64_t row_off = (uint64_t) (y) * (uint64_t) (nx); -+ row0 = (uint16_t*) scratch + row_off; -+ row1 = row0 + (uint64_t) nx; -+ row2 = row1 + (uint64_t) nx; -+ row3 = row2 + (uint64_t) nx; - for (int x = 0; x < nx; x += 4) - { - if (bIn + 3 > comp_buf_size) return EXR_ERR_OUT_OF_MEMORY; diff --git a/4030.patch b/4030.patch deleted file mode 100644 index 896f2e3..0000000 --- a/4030.patch +++ /dev/null @@ -1,612 +0,0 @@ -From 4f03fb0f488d8f528bdc0f9ecac07eea8f7b63ac Mon Sep 17 00:00:00 2001 -From: Christoph Gohlke -Date: Tue, 17 Mar 2026 20:56:39 -0700 -Subject: [PATCH 1/6] Fix comparison operator for buffer size check (#2307) - -Signed-off-by: Christoph Gohlke ---- - .../plugin/hioOpenEXR/OpenEXR/OpenEXRCore/internal_zip.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/pxr/imaging/plugin/hioOpenEXR/OpenEXR/OpenEXRCore/internal_zip.c b/pxr/imaging/plugin/hioOpenEXR/OpenEXR/OpenEXRCore/internal_zip.c -index 628438c5c01..56df6a49c2f 100644 ---- a/pxr/imaging/plugin/hioOpenEXR/OpenEXR/OpenEXRCore/internal_zip.c -+++ b/pxr/imaging/plugin/hioOpenEXR/OpenEXR/OpenEXRCore/internal_zip.c -@@ -367,7 +367,7 @@ apply_zip_impl (exr_encode_pipeline_t* encode) - - if (rv == EXR_ERR_SUCCESS) - { -- if (compbufsz > encode->packed_bytes) -+ if (compbufsz >= encode->packed_bytes) - { - memcpy ( - encode->compressed_buffer, - -From 0512b6c41b95e5c0ac9e01b2f87b56acd437d8e9 Mon Sep 17 00:00:00 2001 -From: Cary Phillips -Date: Thu, 26 Mar 2026 16:35:49 -0700 -Subject: [PATCH 2/6] Fix integer overflow in `srcbuffer` pointer arithmetic in - `unpack_*` (#2321) - -Pointer arithmetic involving `srcbuffer` in the `unpack_*` functions -can overflow for very wide images. - -Multiplying `int w` by a bytes-per-element constant (2, 4, 6, or 8) in -`srcbuffer +=` expressions causes signed integer overflow when the -image width is large. - -Promote the leading operand to `int64_t` at every affected multiplication -so pointer arithmetic is performed in 64-bit signed arithmetic throughout, -eliminating the undefined behavior without imposing any image size limit. - -Affected sites: `generic_unpack`, `unpack_16bit`, `unpack_32bit`, and -all 3- and 4-channel interleave/planar specializations. - -Made-with: Cursor - -Signed-off-by: Cary Phillips ---- - .../hioOpenEXR/OpenEXR/OpenEXRCore/unpack.c | 38 +++++++++---------- - 1 file changed, 19 insertions(+), 19 deletions(-) - -diff --git a/pxr/imaging/plugin/hioOpenEXR/OpenEXR/OpenEXRCore/unpack.c b/pxr/imaging/plugin/hioOpenEXR/OpenEXR/OpenEXRCore/unpack.c -index 1324508c5b4..8765bfa50d6 100644 ---- a/pxr/imaging/plugin/hioOpenEXR/OpenEXR/OpenEXRCore/unpack.c -+++ b/pxr/imaging/plugin/hioOpenEXR/OpenEXR/OpenEXRCore/unpack.c -@@ -229,7 +229,7 @@ unpack_16bit_3chan_interleave (exr_decode_pipeline_t* decode) - in1 = in0 + w; - in2 = in1 + w; - -- srcbuffer += w * 6; // 3 * sizeof(uint16_t), avoid type conversion -+ srcbuffer += (int64_t) w * 6; // 3 * sizeof(uint16_t), avoid type conversion - for (int x = 0; x < w; ++x) - { - out[0] = one_to_native16 (in0[x]); -@@ -269,7 +269,7 @@ unpack_16bit_3chan_interleave_rev (exr_decode_pipeline_t* decode) - in1 = in0 + w; // G - in2 = in1 + w; // R - -- srcbuffer += w * 6; // 3 * sizeof(uint16_t), avoid type conversion -+ srcbuffer += (int64_t) w * 6; // 3 * sizeof(uint16_t), avoid type conversion - for (int x = 0; x < w; ++x) - { - out[0] = one_to_native16 (in2[x]); -@@ -309,7 +309,7 @@ unpack_half_to_float_3chan_interleave (exr_decode_pipeline_t* decode) - in1 = in0 + w; - in2 = in1 + w; - -- srcbuffer += w * 6; // 3 * sizeof(uint16_t), avoid type conversion -+ srcbuffer += (int64_t) w * 6; // 3 * sizeof(uint16_t), avoid type conversion - for (int x = 0; x < w; ++x) - { - out[0] = half_to_float (one_to_native16 (in0[x])); -@@ -349,7 +349,7 @@ unpack_half_to_float_3chan_interleave_rev (exr_decode_pipeline_t* decode) - in1 = in0 + w; - in2 = in1 + w; - -- srcbuffer += w * 6; // 3 * sizeof(uint16_t), avoid type conversion -+ srcbuffer += (int64_t) w * 6; // 3 * sizeof(uint16_t), avoid type conversion - for (int x = 0; x < w; ++x) - { - out[0] = half_to_float (one_to_native16 (in2[x])); -@@ -390,7 +390,7 @@ unpack_16bit_3chan_planar (exr_decode_pipeline_t* decode) - in0 = (const uint16_t*) srcbuffer; - in1 = in0 + w; - in2 = in1 + w; -- srcbuffer += w * 6; // 3 * sizeof(uint16_t), avoid type conversion -+ srcbuffer += (int64_t) w * 6; // 3 * sizeof(uint16_t), avoid type conversion - /* specialise to memcpy if we can */ - #if EXR_HOST_IS_NOT_LITTLE_ENDIAN - for (int x = 0; x < w; ++x) -@@ -440,7 +440,7 @@ unpack_half_to_float_3chan_planar (exr_decode_pipeline_t* decode) - in0 = (const uint16_t*) srcbuffer; - in1 = in0 + w; - in2 = in1 + w; -- srcbuffer += w * 6; // 3 * sizeof(uint16_t), avoid type conversion -+ srcbuffer += (int64_t) w * 6; // 3 * sizeof(uint16_t), avoid type conversion - /* specialise to memcpy if we can */ - half_to_float_buffer ((float*) out0, in0, w); - half_to_float_buffer ((float*) out1, in1, w); -@@ -485,7 +485,7 @@ unpack_16bit_3chan (exr_decode_pipeline_t* decode) - in0 = (const uint16_t*) srcbuffer; - in1 = in0 + w; - in2 = in1 + w; -- srcbuffer += w * 6; // 3 * sizeof(uint16_t), avoid type conversion -+ srcbuffer += (int64_t) w * 6; // 3 * sizeof(uint16_t), avoid type conversion - for (int x = 0; x < w; ++x) - *((uint16_t*) (out0 + x * inc0)) = one_to_native16 (in0[x]); - for (int x = 0; x < w; ++x) -@@ -539,7 +539,7 @@ unpack_16bit_4chan_interleave (exr_decode_pipeline_t* decode) - in2 = in1 + w; - in3 = in2 + w; - -- srcbuffer += w * 8; // 4 * sizeof(uint16_t), avoid type conversion -+ srcbuffer += (int64_t) w * 8; // 4 * sizeof(uint16_t), avoid type conversion - for (int x = 0; x < w; ++x) - { - combined.a = one_to_native16 (in0[x]); -@@ -592,7 +592,7 @@ unpack_16bit_4chan_interleave_rev (exr_decode_pipeline_t* decode) - in2 = in1 + w; - in3 = in2 + w; - -- srcbuffer += w * 8; // 4 * sizeof(uint16_t), avoid type conversion -+ srcbuffer += (int64_t) w * 8; // 4 * sizeof(uint16_t), avoid type conversion - for (int x = 0; x < w; ++x) - { - combined.a = one_to_native16 (in0[x]); -@@ -633,7 +633,7 @@ unpack_half_to_float_4chan_interleave (exr_decode_pipeline_t* decode) - in2 = in1 + w; - in3 = in2 + w; - -- srcbuffer += w * 8; // 4 * sizeof(uint16_t), avoid type conversion -+ srcbuffer += (int64_t) w * 8; // 4 * sizeof(uint16_t), avoid type conversion - for (int x = 0; x < w; ++x) - { - out[0] = half_to_float (one_to_native16 (in3[x])); -@@ -674,7 +674,7 @@ unpack_half_to_float_4chan_interleave_rev (exr_decode_pipeline_t* decode) - in2 = in1 + w; - in3 = in2 + w; - -- srcbuffer += w * 8; // 4 * sizeof(uint16_t), avoid type conversion -+ srcbuffer += (int64_t) w * 8; // 4 * sizeof(uint16_t), avoid type conversion - for (int x = 0; x < w; ++x) - { - out[0] = half_to_float (one_to_native16 (in0[x])); -@@ -719,7 +719,7 @@ unpack_16bit_4chan_planar (exr_decode_pipeline_t* decode) - in1 = in0 + w; - in2 = in1 + w; - in3 = in2 + w; -- srcbuffer += w * 8; // 4 * sizeof(uint16_t), avoid type conversion -+ srcbuffer += (int64_t) w * 8; // 4 * sizeof(uint16_t), avoid type conversion - /* specialize to memcpy if we can */ - #if EXR_HOST_IS_NOT_LITTLE_ENDIAN - for (int x = 0; x < w; ++x) -@@ -775,7 +775,7 @@ unpack_half_to_float_4chan_planar (exr_decode_pipeline_t* decode) - in1 = in0 + w; - in2 = in1 + w; - in3 = in2 + w; -- srcbuffer += w * 8; // 4 * sizeof(uint16_t), avoid type conversion -+ srcbuffer += (int64_t) w * 8; // 4 * sizeof(uint16_t), avoid type conversion - - half_to_float_buffer ((float*) out0, in0, w); - half_to_float_buffer ((float*) out1, in1, w); -@@ -825,7 +825,7 @@ unpack_16bit_4chan (exr_decode_pipeline_t* decode) - in1 = in0 + w; - in2 = in1 + w; - in3 = in2 + w; -- srcbuffer += w * 8; // 4 * sizeof(uint16_t), avoid type conversion -+ srcbuffer += (int64_t) w * 8; // 4 * sizeof(uint16_t), avoid type conversion - for (int x = 0; x < w; ++x) - *((uint16_t*) (out0 + x * inc0)) = one_to_native16 (in0[x]); - for (int x = 0; x < w; ++x) -@@ -898,7 +898,7 @@ unpack_16bit (exr_decode_pipeline_t* decode) - } - } - #endif -- srcbuffer += w * 2; -+ srcbuffer += (int64_t) w * 2; - } - } - return EXR_ERR_SUCCESS; -@@ -963,7 +963,7 @@ unpack_32bit (exr_decode_pipeline_t* decode) - } - } - #endif -- srcbuffer += w * 4; -+ srcbuffer += (int64_t) w * 4; - } - } - return EXR_ERR_SUCCESS; -@@ -1118,7 +1118,7 @@ generic_unpack (exr_decode_pipeline_t* decode) - (uint64_t) decc->user_line_stride); - else - { -- srcbuffer += w * bpc; -+ srcbuffer += (int64_t) w * bpc; - continue; - } - } -@@ -1128,12 +1128,12 @@ generic_unpack (exr_decode_pipeline_t* decode) - } - else - { -- srcbuffer += w * bpc; -+ srcbuffer += (int64_t) w * bpc; - continue; - } - - UNPACK_SAMPLES (w) -- srcbuffer += w * bpc; -+ srcbuffer += (int64_t) w * bpc; - } - } - return EXR_ERR_SUCCESS; - -From f5f7f32d5761b8d28d61e391e9daf68bd62bc9e5 Mon Sep 17 00:00:00 2001 -From: Cary Phillips -Date: Sun, 29 Mar 2026 19:19:12 -0700 -Subject: [PATCH 3/6] Security: fix signed integer overflow in - `undo_pxr24_impl()` (PXR24 decoder) (#2323) - -In the `EXR_PIXEL_FLOAT` branch of `undo_pxr24_impl()`, the expressions - - (uint64_t)(w * 3) - -compute the signed 32-bit product `w * 3` before the cast to `uint64_t`. -When `w` is large this is undefined behavior under the C standard; on -two's-complement builds without sanitizers the result wraps to a small -positive value, which can cause the bounds check - - if (nDec + (uint64_t)(w * 3) > outSize) - -to pass incorrectly. If the check is bypassed the decode loop proceeds -to write `4*w` bytes through `dout`, potentially far beyond the allocated -output buffer. - -Fix: cast `w` to `uint64_t` before multiplying so that both the bounds -check and the counter update are performed entirely in 64-bit unsigned -arithmetic: - - (uint64_t)w * 3 (cast before multiply, not after) - -The `EXR_PIXEL_UINT` and `EXR_PIXEL_HALF` decode branches are unaffected: -they reuse the pre-computed `nBytes` variable, which is already formed as -`(uint64_t)(w) * (uint64_t)(bytes_per_element)`. - -Also fix the symmetric issue in `apply_pxr24_impl()` (the encoder): - lastIn += w * 4 -advances a pointer by a signed 32-bit product; corrected to - lastIn += (uint64_t)w * 4 - -Made-with: Cursor - -Signed-off-by: Cary Phillips ---- - .../plugin/hioOpenEXR/OpenEXR/OpenEXRCore/internal_pxr24.c | 6 +++--- - 1 file changed, 3 insertions(+), 3 deletions(-) - -diff --git a/pxr/imaging/plugin/hioOpenEXR/OpenEXR/OpenEXRCore/internal_pxr24.c b/pxr/imaging/plugin/hioOpenEXR/OpenEXR/OpenEXRCore/internal_pxr24.c -index 43e52c982cf..30f71f4f846 100644 ---- a/pxr/imaging/plugin/hioOpenEXR/OpenEXR/OpenEXRCore/internal_pxr24.c -+++ b/pxr/imaging/plugin/hioOpenEXR/OpenEXR/OpenEXRCore/internal_pxr24.c -@@ -182,7 +182,7 @@ apply_pxr24_impl (exr_encode_pipeline_t* encode) - if (nOut + nBytes > encode->scratch_alloc_size_1) - return EXR_ERR_OUT_OF_MEMORY; - nOut += nBytes; -- lastIn += w * 4; -+ lastIn += (uint64_t) w * 4; - - ptr[0] = out; - out += w; -@@ -371,7 +371,7 @@ undo_pxr24_impl ( - ptr[2] = lastIn; - lastIn += w; - -- if (nDec + (uint64_t) (w * 3) > outSize) -+ if (nDec + (uint64_t) w * 3 > outSize) - return EXR_ERR_CORRUPT_CHUNK; - - for (int x = 0; x < w; ++x) -@@ -384,7 +384,7 @@ undo_pxr24_impl ( - unaligned_store32 (dout, pixel); - ++dout; - } -- nDec += (uint64_t) (w * 3); -+ nDec += (uint64_t) w * 3; - break; - } - default: return EXR_ERR_INVALID_ARGUMENT; - -From d578381a503add330b3b96b30cf6a49461989f08 Mon Sep 17 00:00:00 2001 -From: Cary Phillips -Date: Sun, 29 Mar 2026 19:19:49 -0700 -Subject: [PATCH 4/6] fix integer overflow in PIZ wavelet buffer arithmetic - (#2328) -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit - -Three classes of signed integer overflow in the PIZ codec path, all -reachable from corrupt `dataWindow` dimensions in the EXR file header. - -**`wav_2D_encode` / `wav_2D_decode` — wavelet loop pointer arithmetic** - -`oy` is passed as `int` (value `wcount * nx`, at most ~INT32_MAX after -the guard below). Inside the hierarchical wavelet loop the expressions - - ey = in + oy * (ny - p2) // pointer end-of-row sentinel - oy1 = oy * p // row stride at level p - oy2 = oy * p2 // row stride at level p2 - -multiply two values that can each approach INT32_MAX, producing a -signed 32-bit product that wraps to a small or negative value. The -wrapped value is used as a pointer offset, causing reads and writes -through `px` / `py` to land outside the allocated wavelet buffer. - -Fix: widen by introducing `int64_t oy64 = oy` and using it for all -three expressions; `oy1` and `oy2` are also declared `int64_t`. - -**`wavbuf += nx * ny * wcount` — per-channel buffer advance** - -`nx`, `ny`, and `wcount` are all `int`. Their triple product overflows -int32 for moderately large images, causing subsequent channels to be -processed at an incorrect (too-small) offset into the wavelet buffer, -corrupting both encode and decode output. - -Fix: cast to `(uint64_t)` before multiplying. - -**`wcount * nx` — call-site argument overflow** - -The fifth argument to `wav_2D_encode` / `wav_2D_decode` is `wcount * nx` -(`oy` = y-stride = elements per row). `wcount` is 1 or 2 -(`bytes_per_element / 2`); for `wcount = 2` the product overflows int32 -when `nx > INT32_MAX / 2`. - -Fix: add an early bounds check `if (wcount > 0 && nx > INT_MAX / wcount)` -that rejects such input as `EXR_ERR_CORRUPT_CHUNK` before any arithmetic -is performed. This also keeps `wcount * nx` within int32 range at the -call site, ensuring `oy` arrives in the wavelet functions with a valid -non-overflowed value. - -Made-with: Cursor - -Signed-off-by: Cary Phillips ---- - .../OpenEXR/OpenEXRCore/internal_piz.c | 39 +++++++++++-------- - 1 file changed, 23 insertions(+), 16 deletions(-) - -diff --git a/pxr/imaging/plugin/hioOpenEXR/OpenEXR/OpenEXRCore/internal_piz.c b/pxr/imaging/plugin/hioOpenEXR/OpenEXR/OpenEXRCore/internal_piz.c -index 6c2750b166f..787d2752c61 100644 ---- a/pxr/imaging/plugin/hioOpenEXR/OpenEXR/OpenEXRCore/internal_piz.c -+++ b/pxr/imaging/plugin/hioOpenEXR/OpenEXR/OpenEXRCore/internal_piz.c -@@ -10,6 +10,7 @@ - #include "internal_huf.h" - #include "internal_xdr.h" - -+#include - #include - - /**************************************/ -@@ -171,10 +172,11 @@ wdec16 (uint16_t l, uint16_t h, uint16_t* a, uint16_t* b) - static void - wav_2D_encode (uint16_t* in, int nx, int ox, int ny, int oy, uint16_t mx) - { -- int w14 = (mx < (1 << 14)) ? 1 : 0; -- int n = (nx > ny) ? ny : nx; -- int p = 1; // == 1 << level -- int p2 = 2; // == 1 << (level+1) -+ int w14 = (mx < (1 << 14)) ? 1 : 0; -+ int n = (nx > ny) ? ny : nx; -+ int p = 1; // == 1 << level -+ int p2 = 2; // == 1 << (level+1) -+ int64_t oy64 = oy; - - // - // Hierarchical loop on smaller dimension n -@@ -183,9 +185,9 @@ wav_2D_encode (uint16_t* in, int nx, int ox, int ny, int oy, uint16_t mx) - while (p2 <= n) - { - uint16_t* py = in; -- uint16_t* ey = in + oy * (ny - p2); -- int oy1 = oy * p; -- int oy2 = oy * p2; -+ uint16_t* ey = in + oy64 * (ny - p2); -+ int64_t oy1 = oy64 * p; -+ int64_t oy2 = oy64 * p2; - int ox1 = ox * p; - int ox2 = ox * p2; - uint16_t i00, i01, i10, i11; -@@ -284,10 +286,11 @@ wav_2D_decode ( - int oy, // i : y offset - uint16_t mx) // i : maximum in[x][y] value - { -- int w14 = (mx < (1 << 14)) ? 1 : 0; -- int n = (nx > ny) ? ny : nx; -- int p = 1; -- int p2; -+ int w14 = (mx < (1 << 14)) ? 1 : 0; -+ int n = (nx > ny) ? ny : nx; -+ int p = 1; -+ int p2; -+ int64_t oy64 = oy; - - // - // Search max level -@@ -307,9 +310,9 @@ wav_2D_decode ( - while (p >= 1) - { - uint16_t* py = in; -- uint16_t* ey = in + oy * (ny - p2); -- int oy1 = oy * p; -- int oy2 = oy * p2; -+ uint16_t* ey = in + oy64 * (ny - p2); -+ int64_t oy1 = oy64 * p; -+ int64_t oy2 = oy64 * p2; - int ox1 = ox * p; - int ox2 = ox * p2; - uint16_t i00, i01, i10, i11; -@@ -502,11 +505,13 @@ internal_exr_apply_piz (exr_encode_pipeline_t* encode) - nx = curc->width; - ny = curc->height; - wcount = (int) (curc->bytes_per_element / 2); -+ if (wcount > 0 && nx > INT_MAX / wcount) -+ return EXR_ERR_CORRUPT_CHUNK; - for (int j = 0; j < wcount; ++j) - { - wav_2D_encode (wavbuf + j, nx, wcount, ny, wcount * nx, maxValue); - } -- wavbuf += nx * ny * wcount; -+ wavbuf += (uint64_t) nx * ny * wcount; - } - - nBytes = 0; -@@ -655,11 +660,13 @@ internal_exr_undo_piz ( - nx = curc->width; - ny = curc->height; - wcount = (int) (curc->bytes_per_element / 2); -+ if (wcount > 0 && nx > INT_MAX / wcount) -+ return EXR_ERR_CORRUPT_CHUNK; - for (int j = 0; j < wcount; ++j) - { - wav_2D_decode (wavbuf + j, nx, wcount, ny, wcount * nx, maxValue); - } -- wavbuf += nx * ny * wcount; -+ wavbuf += (uint64_t) nx * ny * wcount; - } - - // - -From a76474285ddc24e9956b5e12fab658b908912ed4 Mon Sep 17 00:00:00 2001 -From: Cary Phillips -Date: Sun, 29 Mar 2026 19:20:52 -0700 -Subject: [PATCH 5/6] Fix signed integer overflow in - `LossyDctDecoder_execute()` pointer arithmetic (#2329) - -`numBlocksX` and `numBlocksY` are declared as `int`. Two pointer-offset -expressions in `LossyDctDecoder_execute()` multiplied them as signed -32-bit integers before using the result as a pointer offset: - - rowBlock[comp] = rowBlock[comp - 1] + numBlocksX * 64; - currDcComp[comp] = currDcComp[comp - 1] + numBlocksX * numBlocksY; - -`dataWindow.max.x` is a signed 32-bit value in the EXR file format, so -`numBlocksX` can reach `(INT32_MAX + 7) / 8 = 268,435,456`. At that -point `numBlocksX * 64 = 17,179,869,184` overflows `int32`, and -`numBlocksX * numBlocksY` overflows even sooner. The wraparound -produces a small or negative pointer offset, causing `rowBlock[comp]` -and `currDcComp[comp]` to point into already-used or pre-buffer memory -rather than the intended component stride. - -Fix: cast `numBlocksX` to `size_t` before multiplying so the -arithmetic is performed in pointer-sized unsigned arithmetic: - - rowBlock[comp] = rowBlock[comp - 1] + (size_t) numBlocksX * 64; - currDcComp[comp] = currDcComp[comp - 1] + (size_t) numBlocksX * numBlocksY; - -This is consistent with the allocation on the line above, which already -uses `(size_t) numComp * (size_t) numBlocksX * 64 * sizeof(uint16_t)`, -and with the packed-DC count check, which uses explicit `uint64_t` casts. - -Made-with: Cursor - -Signed-off-by: Cary Phillips ---- - .../hioOpenEXR/OpenEXR/OpenEXRCore/internal_dwa_decoder.h | 4 ++-- - 1 file changed, 2 insertions(+), 2 deletions(-) - -diff --git a/pxr/imaging/plugin/hioOpenEXR/OpenEXR/OpenEXRCore/internal_dwa_decoder.h b/pxr/imaging/plugin/hioOpenEXR/OpenEXR/OpenEXRCore/internal_dwa_decoder.h -index bcdebd985f9..e289b064dac 100644 ---- a/pxr/imaging/plugin/hioOpenEXR/OpenEXR/OpenEXRCore/internal_dwa_decoder.h -+++ b/pxr/imaging/plugin/hioOpenEXR/OpenEXR/OpenEXRCore/internal_dwa_decoder.h -@@ -265,7 +265,7 @@ LossyDctDecoder_execute ( - } - - for (int comp = 1; comp < numComp; ++comp) -- rowBlock[comp] = rowBlock[comp - 1] + numBlocksX * 64; -+ rowBlock[comp] = rowBlock[comp - 1] + (size_t) numBlocksX * 64; - - // - // Pack DC components together by common plane, so we can get -@@ -275,7 +275,7 @@ LossyDctDecoder_execute ( - - currDcComp[0] = (uint16_t*) d->_packedDc; - for (int comp = 1; comp < numComp; ++comp) -- currDcComp[comp] = currDcComp[comp - 1] + numBlocksX * numBlocksY; -+ currDcComp[comp] = currDcComp[comp - 1] + (size_t) numBlocksX * numBlocksY; - - for (int blocky = 0; blocky < numBlocksY; ++blocky) - { - -From 219a0870506f80c7353016800e467ad0de923424 Mon Sep 17 00:00:00 2001 -From: Cary Phillips -Date: Tue, 31 Mar 2026 07:49:09 -0700 -Subject: [PATCH 6/6] =?UTF-8?q?Fix=20misaligned=20memory=20access=20in=20`?= - =?UTF-8?q?LossyDctDecoder=5Fexecute`=20HALF=E2=86=92FLOAT=20expansion=20(?= - =?UTF-8?q?#2324)?= -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit - -* Fix misaligned memory access in `LossyDctDecoder_execute` HALF→FLOAT expansion - -After DCT decoding, `LossyDctDecoder_execute()` expands FLOAT-type channels -from their intermediate HALF (16-bit) XDR representation back to FLOAT (32-bit) -XDR in place. The expansion was done by casting `_rows[y]` (a `uint8_t *`) -directly to `float *` and `uint16_t *`, then reading and writing through those -typed pointers. - -Because row buffers are assigned by advancing a byte pointer with no alignment -padding (`outBufferEnd += chan->width * chan->bytes_per_element` in -`internal_dwa_compressor.h`), a FLOAT channel that follows a HALF channel of -odd width receives a `_rows[y]` pointer that is 2-byte aligned but not 4-byte -aligned. Dereferencing a `float *` cast from such a pointer is undefined -behavior under the C standard: - -- On ARM, RISC-V, and MIPS (strict alignment) this crashes immediately. -- On x86 it is silently tolerated at the hardware level but remains UB: - auto-vectorizing compilers (SSE/AVX) may assume aligned access and generate - incorrect code. -- UBSan reports: `store to misaligned address ... for type 'float', which - requires 4 byte alignment` at `internal_dwa_decoder.h:749`. - -Fix: replace the cast-and-dereference pattern with the `unaligned_load16` / -`memcpy` / `unaligned_store32` helpers already used throughout the rest of -OpenEXRCore (`internal_xdr.h`, `unpack.c`, `pack.c`, `internal_pxr24.c`). -These helpers use `memcpy` internally, which the C standard guarantees is safe -for unaligned addresses and which compilers compile to a single load/store -instruction on architectures that support it. - -The byte-order handling is preserved correctly: -- `unaligned_load16` reads 2 bytes via `memcpy` and applies `one_to_native16` - (XDR → native), returning a native-endian HALF value. -- `half_to_float` converts native HALF → native float. -- `memcpy(&bits, &f, 4)` reinterprets the float's bit pattern as `uint32_t` - without numeric conversion (the correct type-pun idiom in C). -- `unaligned_store32` applies `one_from_native32` (native → XDR) and writes - 4 bytes via `memcpy`, storing the result in XDR float format. - -Made-with: Cursor -Signed-off-by: Cary Phillips - -* add TODO comment - -Signed-off-by: Cary Phillips - ---------- - -Signed-off-by: Cary Phillips ---- - .../OpenEXR/OpenEXRCore/internal_dwa_decoder.h | 17 +++++++++++++---- - 1 file changed, 13 insertions(+), 4 deletions(-) - -diff --git a/pxr/imaging/plugin/hioOpenEXR/OpenEXR/OpenEXRCore/internal_dwa_decoder.h b/pxr/imaging/plugin/hioOpenEXR/OpenEXR/OpenEXRCore/internal_dwa_decoder.h -index e289b064dac..046615ec5b8 100644 ---- a/pxr/imaging/plugin/hioOpenEXR/OpenEXR/OpenEXRCore/internal_dwa_decoder.h -+++ b/pxr/imaging/plugin/hioOpenEXR/OpenEXR/OpenEXRCore/internal_dwa_decoder.h -@@ -651,13 +651,22 @@ LossyDctDecoder_execute ( - /* process in place in reverse to avoid temporary buffer */ - for (int y = 0; y < d->_height; ++y) - { -- float* floatXdrPtr = (float*) chanData[chan]->_rows[y]; -- uint16_t* halfXdr = (uint16_t*) floatXdrPtr; -+ uint8_t* rowBytes = chanData[chan]->_rows[y]; - - for (int x = d->_width - 1; x >= 0; --x) - { -- floatXdrPtr[x] = one_from_native_float ( -- half_to_float (one_to_native16 (halfXdr[x]))); -+ // TODO: make an unaligned_store32f that takes the float and -+ // packages up a one_from_native_float and calls memcpy -+ // instead of the two memcpy. We should look at the metrics -+ // for dwa and see if there's a performance difference to do -+ // so at some point. See: -+ // https://github.com/AcademySoftwareFoundation/openexr/pull/2324 -+ -+ uint16_t h = unaligned_load16 (rowBytes + x * sizeof (uint16_t)); -+ float f = half_to_float (h); -+ uint32_t bits; -+ memcpy (&bits, &f, sizeof (bits)); -+ unaligned_store32 (rowBytes + x * sizeof (float), bits); - } - } - } diff --git a/sources b/sources index d2dbf60..695949f 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (OpenUSD-26.03.tar.gz) = 3d5dae46c7ae096501dc51b373ba05c8603a1cf16e5054728d41d0c2970b59ce3ee5ec83e1c575b92482bc8cf2c59643df093a9e7aa82bcdd53dada05292720d +SHA512 (OpenUSD-26.08.tar.gz) = 82f7bb4f77b295be79cd36f591f242276d36c0d589b0fca383344c27e70daf7e29151bf587528bb2fc2b2a8b974387a253993ace3caf5f79ae70f9ebbc71cf1a diff --git a/usd.spec b/usd.spec index e2186c4..05bcd6e 100644 --- a/usd.spec +++ b/usd.spec @@ -2,7 +2,7 @@ # package version, as a reminder of the need to rebuild dependent packages on # every update. See additional notes near the downstream ABI versioning patch. # It should be 0.MAJOR.MINOR without leading zeros, e.g. 22.03 → 0.22.3. -%global downstream_so_version 0.26.3 +%global downstream_so_version 0.26.8 %bcond alembic 1 %bcond draco 1 @@ -25,7 +25,7 @@ %bcond test 0 Name: usd -Version: 26.03 +Version: 26.08 Release: %autorelease Summary: 3D VFX pipeline interchange file format @@ -151,18 +151,14 @@ Patch: 0006-Downstream-only-use-the-system-libavif.patch # Backport fixes for CVE-2025-64181 etc. in OpenEXRCore # https://github.com/PixarAnimationStudios/OpenUSD/pull/3903 Patch: %{forgeurl}/pull/3903.patch -# Backport fix for CVE-2026-34544 in OpenEXRCore -# https://github.com/PixarAnimationStudios/OpenUSD/pull/4028 -Patch: %{forgeurl}/pull/4028.patch -# Backport several OpenEXRCore security fixes -# https://github.com/PixarAnimationStudios/OpenUSD/pull/4030 -# Fixes: -# - CVE-2026-34378 / GHSA-v76p-4qvv-vh4g / RHBZ#2455493 -# - CVE-2026-34380 / GHSA-q3v8-hw4m-59w5 / RHBZ#2455534 -# - CVE-2026-34588 / GHSA-588r-cr5c-w6hf / RHBZ#2455505 -# - CVE-2026-34589 / GHSA-p8xc-w3q4-h64x / RHBZ#2455501 -# - CVE-2026-34379 / GHSA-w88v-vqhq-5p24 / RHBZ#2455497 -Patch: %{forgeurl}/pull/4030.patch + +# Replace PyWeakref_GetObject with PyWeakref_GetRef +# Fixes RHBZ#2433881. This patch is LLM-generated and needs expert human +# review, but it at least builds. See discussion in +# https://bugzilla.redhat.com/show_bug.cgi?id=2433881. +# Mentioned upstream in +# https://github.com/PixarAnimationStudios/OpenUSD/issues/3966#issuecomment-5128542913. +Patch: 0001-Replace-PyWeakref_GetObject-with-PyWeakref_GetRef.patch # Base BuildRequires: gcc-c++ @@ -242,7 +238,7 @@ BuildRequires: openvdb-devel %endif %if %{with ptex} -BuildRequires: pkgconfig(ptex) +BuildRequires: cmake(ptex) %endif # Header-only library: -static is for tracking per guidelines @@ -726,6 +722,7 @@ desktop-file-validate %{buildroot}%{_datadir}/applications/org.openusd.usdview.d %{_bindir}/usdstitch %{_bindir}/usdstitchclips %{_bindir}/usdtree +%{_bindir}/usdupdatecrate %{_bindir}/usdzip %if %{with usdview} %{_datadir}/applications/org.openusd.usdview.desktop @@ -757,6 +754,7 @@ desktop-file-validate %{buildroot}%{_datadir}/applications/org.openusd.usdview.d %{_mandir}/man1/usdstitch.1* %{_mandir}/man1/usdstitchclips.1* %{_mandir}/man1/usdtree.1* +%{_mandir}/man1/usdupdatecrate.1* %{_mandir}/man1/usdzip.1* %if %{with usdview} %{_mandir}/man1/testusdview.1*