Compare commits
7 commits
| Author | SHA1 | Date | |
|---|---|---|---|
|
07ce80652a | ||
|
|
f5a3fd00e0 | ||
|
0efef3a625 | ||
|
e384650dca | ||
|
e0d1abcfac | ||
|
|
b8ae07c43d | ||
|
d7db70a14d |
14 changed files with 153 additions and 726 deletions
2
.gitignore
vendored
2
.gitignore
vendored
|
|
@ -22,3 +22,5 @@
|
|||
/OpenUSD-25.08.tar.gz
|
||||
/OpenUSD-25.11.tar.gz
|
||||
/OpenUSD-26.03.tar.gz
|
||||
/OpenUSD-26.05.tar.gz
|
||||
/OpenUSD-26.08.tar.gz
|
||||
|
|
|
|||
|
|
@ -1,4 +1,4 @@
|
|||
From 949707d0bd8ac077fac9763b3b590a016ff4eb6f Mon Sep 17 00:00:00 2001
|
||||
From ee4e9b30e14133e35c23821d3dc7aa93df354a38 Mon Sep 17 00:00:00 2001
|
||||
From: "Benjamin A. Beasley" <code@musicinmybrain.net>
|
||||
Date: Fri, 27 Oct 2023 12:56:58 -0400
|
||||
Subject: [PATCH] Downstream-only: add an SONAME version
|
||||
|
|
@ -37,11 +37,11 @@ built with -DPXR_BUILD_EXAMPLES=OFF, but it is.)
|
|||
3 files changed, 9 insertions(+)
|
||||
|
||||
diff --git a/cmake/defaults/Version.cmake b/cmake/defaults/Version.cmake
|
||||
index 1cc7fa64a..ebe531ec4 100644
|
||||
index c31b5e8d9..fabb45397 100644
|
||||
--- a/cmake/defaults/Version.cmake
|
||||
+++ b/cmake/defaults/Version.cmake
|
||||
@@ -10,3 +10,9 @@ set(PXR_MINOR_VERSION "26")
|
||||
set(PXR_PATCH_VERSION "3") # NOTE: Must not have leading 0 for single digits
|
||||
set(PXR_PATCH_VERSION "8") # NOTE: Must not have leading 0 for single digits
|
||||
|
||||
math(EXPR PXR_VERSION "${PXR_MAJOR_VERSION} * 10000 + ${PXR_MINOR_VERSION} * 100 + ${PXR_PATCH_VERSION}")
|
||||
+
|
||||
|
|
@ -51,10 +51,10 @@ index 1cc7fa64a..ebe531ec4 100644
|
|||
+ "Downstream shared object version"
|
||||
+)
|
||||
diff --git a/cmake/macros/Private.cmake b/cmake/macros/Private.cmake
|
||||
index e2dccb075..5f6913e22 100644
|
||||
index cddb4e095..5e4b4603a 100644
|
||||
--- a/cmake/macros/Private.cmake
|
||||
+++ b/cmake/macros/Private.cmake
|
||||
@@ -1346,6 +1346,7 @@ function(_pxr_library NAME)
|
||||
@@ -1355,6 +1355,7 @@ function(_pxr_library NAME)
|
||||
FOLDER "${folder}"
|
||||
POSITION_INDEPENDENT_CODE ON
|
||||
IMPORT_PREFIX "${args_PREFIX}"
|
||||
|
|
@ -63,10 +63,10 @@ index e2dccb075..5f6913e22 100644
|
|||
SUFFIX "${args_SUFFIX}"
|
||||
)
|
||||
diff --git a/cmake/macros/Public.cmake b/cmake/macros/Public.cmake
|
||||
index b51789f4a..af2f2a805 100644
|
||||
index 5f6a5456b..553b645ec 100644
|
||||
--- a/cmake/macros/Public.cmake
|
||||
+++ b/cmake/macros/Public.cmake
|
||||
@@ -414,6 +414,7 @@ function(pxr_library NAME)
|
||||
@@ -415,6 +415,7 @@ function(pxr_library NAME)
|
||||
TYPE "${args_TYPE}"
|
||||
PREFIX "${prefix}"
|
||||
SUFFIX "${suffix}"
|
||||
|
|
@ -74,7 +74,7 @@ index b51789f4a..af2f2a805 100644
|
|||
SUBDIR "${subdir}"
|
||||
CPPFILES "${args_CPPFILES};${${NAME}_CPPFILES}"
|
||||
PUBLIC_HEADERS "${args_PUBLIC_HEADERS};${${NAME}_PUBLIC_HEADERS}"
|
||||
@@ -1195,6 +1196,7 @@ function(pxr_toplevel_prologue)
|
||||
@@ -1213,6 +1214,7 @@ function(pxr_toplevel_prologue)
|
||||
PREFIX "${libPrefix}"
|
||||
IMPORT_PREFIX "${libPrefix}"
|
||||
OUTPUT_NAME ${libName}
|
||||
|
|
@ -83,5 +83,5 @@ index b51789f4a..af2f2a805 100644
|
|||
_get_install_dir("lib" libInstallPrefix)
|
||||
install(
|
||||
--
|
||||
2.53.0
|
||||
2.55.0
|
||||
|
||||
|
|
|
|||
|
|
@ -1,4 +1,4 @@
|
|||
From 15ea3b68bb15fd6338cbe76ec94eac055dc28c4e Mon Sep 17 00:00:00 2001
|
||||
From 817e23674f1b4ba62481c4e9794f0665a44d83f8 Mon Sep 17 00:00:00 2001
|
||||
From: "Benjamin A. Beasley" <code@musicinmybrain.net>
|
||||
Date: Fri, 1 Aug 2025 08:47:41 -0400
|
||||
Subject: [PATCH] Downstream-only: use Valgrind macro instead of inline
|
||||
|
|
@ -61,5 +61,5 @@ index 96dacca06..7e5625678 100644
|
|||
|
||||
Vdf_ExecutorDataVector::~Vdf_ExecutorDataVector()
|
||||
--
|
||||
2.53.0
|
||||
2.55.0
|
||||
|
||||
|
|
|
|||
|
|
@ -1,4 +1,4 @@
|
|||
From 5bc91bdebc42bb3a441c87b706288cea05fcd345 Mon Sep 17 00:00:00 2001
|
||||
From 2d851f23e912d8312f2ea6818963150a8c484138 Mon Sep 17 00:00:00 2001
|
||||
From: "Benjamin A. Beasley" <code@musicinmybrain.net>
|
||||
Date: Wed, 28 Aug 2024 10:42:48 -0400
|
||||
Subject: [PATCH 1/6] Downstream-only: use the system double-conversion library
|
||||
|
|
@ -8,7 +8,7 @@ Subject: [PATCH 1/6] Downstream-only: use the system double-conversion library
|
|||
1 file changed, 3 insertions(+), 8 deletions(-)
|
||||
|
||||
diff --git a/pxr/base/tf/CMakeLists.txt b/pxr/base/tf/CMakeLists.txt
|
||||
index 6fc9c680e..551b5a3eb 100644
|
||||
index 4294f2cb5..b45df65b8 100644
|
||||
--- a/pxr/base/tf/CMakeLists.txt
|
||||
+++ b/pxr/base/tf/CMakeLists.txt
|
||||
@@ -105,11 +105,14 @@ function(add_py_dll_link_test)
|
||||
|
|
@ -26,7 +26,7 @@ index 6fc9c680e..551b5a3eb 100644
|
|||
|
||||
PUBLIC_CLASSES
|
||||
anyUniquePtr
|
||||
@@ -272,14 +275,6 @@ pxr_library(tf
|
||||
@@ -276,14 +279,6 @@ pxr_library(tf
|
||||
|
||||
CPPFILES
|
||||
initConfig.cpp
|
||||
|
|
@ -42,5 +42,5 @@ index 6fc9c680e..551b5a3eb 100644
|
|||
|
||||
PYMODULE_CPPFILES
|
||||
--
|
||||
2.53.0
|
||||
2.55.0
|
||||
|
||||
|
|
|
|||
110
0001-Replace-PyWeakref_GetObject-with-PyWeakref_GetRef.patch
Normal file
110
0001-Replace-PyWeakref_GetObject-with-PyWeakref_GetRef.patch
Normal file
|
|
@ -0,0 +1,110 @@
|
|||
From f3e9600db6086e834c0503cdaf30b5ba7ed53ceb Mon Sep 17 00:00:00 2001
|
||||
From: Anonymous Coward <nobody@redhat.com>
|
||||
Date: Sun, 26 Jul 2026 16:13:18 +0200
|
||||
Subject: [PATCH] Replace PyWeakref_GetObject with PyWeakref_GetRef
|
||||
|
||||
PyWeakref_GetObject was removed in Python 3.15. Replace all four call
|
||||
sites with PyWeakref_GetRef, which returns a strong reference instead
|
||||
of a borrowed one, and adjust reference counting accordingly.
|
||||
|
||||
In Tf_PyIdHandle::Ptr(), return Py_None when the referent is dead to
|
||||
match the original behaviour (previously returned NULL erroneously).
|
||||
|
||||
In Tf_PyWeakObject::GetObject(), explicitly return a Python None object
|
||||
on failure, matching the original semantics exactly.
|
||||
|
||||
Fixes: https://github.com/PixarAnimationStudios/OpenUSD/issues/3966
|
||||
|
||||
Assisted-by: Claude Opus 4.6
|
||||
Reviewed-by: OpenUSD Maintainers <usd-maintainers@fedoraproject.org>
|
||||
---
|
||||
pxr/base/tf/pyFunction.h | 13 +++++++++----
|
||||
pxr/base/tf/pyIdentity.cpp | 10 +++++++++-
|
||||
pxr/base/tf/pyWeakObject.cpp | 12 +++++++++---
|
||||
3 files changed, 27 insertions(+), 8 deletions(-)
|
||||
|
||||
diff --git a/pxr/base/tf/pyFunction.h b/pxr/base/tf/pyFunction.h
|
||||
index 85af943b2..f77b5b71b 100644
|
||||
--- a/pxr/base/tf/pyFunction.h
|
||||
+++ b/pxr/base/tf/pyFunction.h
|
||||
@@ -49,11 +49,13 @@ struct TfPyFunctionFromPython<Ret (Args...)>
|
||||
using namespace pxr_boost::python;
|
||||
// Attempt to get the referenced callable object.
|
||||
TfPyLock lock;
|
||||
- object callable(handle<>(borrowed(PyWeakref_GetObject(weak.ptr()))));
|
||||
- if (TfPyIsNone(callable)) {
|
||||
+ PyObject *rawCallable = NULL;
|
||||
+ if (PyWeakref_GetRef(weak.ptr(), &rawCallable) <= 0) {
|
||||
TF_WARN("Tried to call an expired python callback");
|
||||
return Ret();
|
||||
}
|
||||
+ // PyWeakref_GetRef returns a strong reference; handle<> steals it.
|
||||
+ object callable{handle<>(rawCallable)};
|
||||
return TfPyCall<Ret>(callable)(args...);
|
||||
}
|
||||
};
|
||||
@@ -68,12 +70,15 @@ struct TfPyFunctionFromPython<Ret (Args...)>
|
||||
// Attempt to get the referenced self parameter, then build a new
|
||||
// instance method and call it.
|
||||
TfPyLock lock;
|
||||
- PyObject *self = PyWeakref_GetObject(weakSelf.ptr());
|
||||
- if (self == Py_None) {
|
||||
+ PyObject *self = NULL;
|
||||
+ if (PyWeakref_GetRef(weakSelf.ptr(), &self) <= 0) {
|
||||
TF_WARN("Tried to call a method on an expired python instance");
|
||||
return Ret();
|
||||
}
|
||||
+ // PyWeakref_GetRef returns a strong reference to self; PyMethod_New
|
||||
+ // takes its own reference, so release ours afterward.
|
||||
object method(handle<>(PyMethod_New(func.ptr(), self)));
|
||||
+ Py_DECREF(self);
|
||||
return TfPyCall<Ret>(method)(args...);
|
||||
}
|
||||
};
|
||||
diff --git a/pxr/base/tf/pyIdentity.cpp b/pxr/base/tf/pyIdentity.cpp
|
||||
index 5389d8f25..06b7f9b0c 100644
|
||||
--- a/pxr/base/tf/pyIdentity.cpp
|
||||
+++ b/pxr/base/tf/pyIdentity.cpp
|
||||
@@ -136,7 +136,15 @@ PyObject *
|
||||
Tf_PyIdHandle::Ptr() const {
|
||||
if (_weakRef) {
|
||||
TfPyLock lock;
|
||||
- return PyWeakref_GetObject(_weakRef);
|
||||
+ PyObject *obj = NULL;
|
||||
+ if (PyWeakref_GetRef(_weakRef, &obj) > 0) {
|
||||
+ // Return a borrowed-style reference: decrement so the caller
|
||||
+ // does not need to release. Safe because the GIL is held by
|
||||
+ // all callers.
|
||||
+ Py_DECREF(obj);
|
||||
+ return obj;
|
||||
+ }
|
||||
+ return Py_None; // dead referent → match original behaviour
|
||||
}
|
||||
return 0;
|
||||
}
|
||||
diff --git a/pxr/base/tf/pyWeakObject.cpp b/pxr/base/tf/pyWeakObject.cpp
|
||||
index 8cfddc729..ecdd7f705 100644
|
||||
--- a/pxr/base/tf/pyWeakObject.cpp
|
||||
+++ b/pxr/base/tf/pyWeakObject.cpp
|
||||
@@ -115,9 +115,15 @@ Tf_PyWeakObject::GetOrCreate(pxr_boost::python::object const &obj)
|
||||
pxr_boost::python::object
|
||||
Tf_PyWeakObject::GetObject() const
|
||||
{
|
||||
- return pxr_boost::python::object
|
||||
- (pxr_boost::python::handle<>
|
||||
- (pxr_boost::python::borrowed(PyWeakref_GetObject(_weakRef.get()))));
|
||||
+ PyObject *obj = NULL;
|
||||
+ if (PyWeakref_GetRef(_weakRef.get(), &obj) > 0) {
|
||||
+ // PyWeakref_GetRef returns a strong reference; handle<> steals it.
|
||||
+ return pxr_boost::python::object(
|
||||
+ pxr_boost::python::handle<>(obj));
|
||||
+ }
|
||||
+ // Dead referent: return Py_None explicitly, as the original did.
|
||||
+ return pxr_boost::python::object(
|
||||
+ pxr_boost::python::handle<>(pxr_boost::python::borrowed(Py_None)));
|
||||
}
|
||||
|
||||
void
|
||||
--
|
||||
2.55.0
|
||||
|
||||
|
|
@ -1,4 +1,4 @@
|
|||
From 0caa009abce9d66d441cd548f45ca8fef8d4846d Mon Sep 17 00:00:00 2001
|
||||
From 9fd6089b3e95bb882199ee359fbba83f7c4bb410 Mon Sep 17 00:00:00 2001
|
||||
From: "Benjamin A. Beasley" <code@musicinmybrain.net>
|
||||
Date: Thu, 29 Aug 2024 13:30:18 -0400
|
||||
Subject: [PATCH 2/6] Downstream-only: use the system lz4 library
|
||||
|
|
@ -8,7 +8,7 @@ Subject: [PATCH 2/6] Downstream-only: use the system lz4 library
|
|||
1 file changed, 6 insertions(+), 1 deletion(-)
|
||||
|
||||
diff --git a/pxr/base/tf/CMakeLists.txt b/pxr/base/tf/CMakeLists.txt
|
||||
index 551b5a3eb..772524a19 100644
|
||||
index b45df65b8..5e6de96da 100644
|
||||
--- a/pxr/base/tf/CMakeLists.txt
|
||||
+++ b/pxr/base/tf/CMakeLists.txt
|
||||
@@ -106,6 +106,8 @@ function(add_py_dll_link_test)
|
||||
|
|
@ -31,7 +31,7 @@ index 551b5a3eb..772524a19 100644
|
|||
|
||||
PUBLIC_CLASSES
|
||||
anyUniquePtr
|
||||
@@ -275,7 +281,6 @@ pxr_library(tf
|
||||
@@ -279,7 +285,6 @@ pxr_library(tf
|
||||
|
||||
CPPFILES
|
||||
initConfig.cpp
|
||||
|
|
@ -40,5 +40,5 @@ index 551b5a3eb..772524a19 100644
|
|||
PYMODULE_CPPFILES
|
||||
module.cpp
|
||||
--
|
||||
2.53.0
|
||||
2.55.0
|
||||
|
||||
|
|
|
|||
|
|
@ -1,4 +1,4 @@
|
|||
From d1e032128f9c41a763d9e0535c408ffa6642ae03 Mon Sep 17 00:00:00 2001
|
||||
From 73637a9bf67b3f7afe5070e5d56b07524e14a073 Mon Sep 17 00:00:00 2001
|
||||
From: "Benjamin A. Beasley" <code@musicinmybrain.net>
|
||||
Date: Fri, 30 Aug 2024 09:32:08 -0400
|
||||
Subject: [PATCH 3/6] Downstream-only: use the system pugixml library
|
||||
|
|
@ -35,5 +35,5 @@ index 244f27aa8..1e00413c4 100644
|
|||
PRIVATE_HEADERS
|
||||
api.h
|
||||
--
|
||||
2.53.0
|
||||
2.55.0
|
||||
|
||||
|
|
|
|||
|
|
@ -1,4 +1,4 @@
|
|||
From 8fc7363878d1917d5b3f3513b16d54293463c297 Mon Sep 17 00:00:00 2001
|
||||
From f331a476a66e41e93d83b7a2e438d3ee7f12ea32 Mon Sep 17 00:00:00 2001
|
||||
From: "Benjamin A. Beasley" <code@musicinmybrain.net>
|
||||
Date: Sat, 31 Aug 2024 11:08:18 -0400
|
||||
Subject: [PATCH 4/6] Downstream-only: use the system rapidjson library
|
||||
|
|
@ -59,5 +59,5 @@ index 8cbda8c52..ec8f3c249 100644
|
|||
overview.dox
|
||||
)
|
||||
--
|
||||
2.53.0
|
||||
2.55.0
|
||||
|
||||
|
|
|
|||
|
|
@ -1,4 +1,4 @@
|
|||
From 30b0460635b46ce71f22586273afb370075d7db8 Mon Sep 17 00:00:00 2001
|
||||
From a537b44edabe942380d2e87ea7069bdf32b93dbc Mon Sep 17 00:00:00 2001
|
||||
From: "Benjamin A. Beasley" <code@musicinmybrain.net>
|
||||
Date: Sun, 1 Sep 2024 21:30:11 -0400
|
||||
Subject: [PATCH 5/6] Downstream-only: use the system libdeflate
|
||||
|
|
@ -72,5 +72,5 @@ index 7481a346e..71bdde9cc 100644
|
|||
|
||||
#include "OpenEXRCore/attributes.c"
|
||||
--
|
||||
2.53.0
|
||||
2.55.0
|
||||
|
||||
|
|
|
|||
|
|
@ -1,4 +1,4 @@
|
|||
From c6639b8f1a8c57b02071426400daa349eed14501 Mon Sep 17 00:00:00 2001
|
||||
From f2a3615238a691e11a4029c33498e7f21a34fff9 Mon Sep 17 00:00:00 2001
|
||||
From: "Benjamin A. Beasley" <code@musicinmybrain.net>
|
||||
Date: Wed, 4 Sep 2024 11:09:47 -0400
|
||||
Subject: [PATCH 6/6] Downstream-only: use the system libavif
|
||||
|
|
@ -237,5 +237,5 @@ index 1ac2683f6..7d583c137 100644
|
|||
|
||||
RESOURCE_FILES
|
||||
--
|
||||
2.53.0
|
||||
2.55.0
|
||||
|
||||
|
|
|
|||
71
4028.patch
71
4028.patch
|
|
@ -1,71 +0,0 @@
|
|||
From 83c6cdfa63ad61accec35575f503b629f94dc4af Mon Sep 17 00:00:00 2001
|
||||
From: Cary Phillips <cary@ilm.com>
|
||||
Date: Thu, 19 Mar 2026 14:22:40 -0700
|
||||
Subject: [PATCH] Fix B44/B44A integer overflow: use uint64_t for row offset
|
||||
(#2312)
|
||||
|
||||
The B44 and B44A decoder and encoder use channel width (`nx`) and
|
||||
height (`ny`) in row pointer math. `nx` and `ny` are `int`; the
|
||||
scratch buffer is correctly sized with `(uint64_t)ny * (uint64_t)nx *
|
||||
bytes_per_element`, but row bases were computed as:
|
||||
|
||||
```
|
||||
row0 = (uint16_t*)scratch;
|
||||
row0 += y * nx; // int * int -> signed overflow when y*nx > INT_MAX
|
||||
```
|
||||
|
||||
For large `nx` (e.g. 268435456), `y*nx` overflows, so `row0`/`row1`/`row2`/`row3`
|
||||
point before the scratch buffer.
|
||||
|
||||
Fix: compute the row offset in `uint64_t` before pointer arithmetic in both
|
||||
`uncompress_b44_impl` (decoder) and `compress_b44_impl` (encoder).
|
||||
|
||||
Analysis and solution with the help of Curor / Claude Opus 4.5
|
||||
|
||||
Signed-off-by: Cary Phillips <cary@ilm.com>
|
||||
---
|
||||
.../OpenEXR/OpenEXRCore/internal_b44.c | 23 ++++++++++---------
|
||||
1 file changed, 12 insertions(+), 11 deletions(-)
|
||||
|
||||
diff --git a/pxr/imaging/plugin/hioOpenEXR/OpenEXR/OpenEXRCore/internal_b44.c b/pxr/imaging/plugin/hioOpenEXR/OpenEXR/OpenEXRCore/internal_b44.c
|
||||
index 8d0c257e658..93279ff2ed5 100644
|
||||
--- a/pxr/imaging/plugin/hioOpenEXR/OpenEXR/OpenEXRCore/internal_b44.c
|
||||
+++ b/pxr/imaging/plugin/hioOpenEXR/OpenEXR/OpenEXRCore/internal_b44.c
|
||||
@@ -390,13 +390,13 @@ compress_b44_impl (exr_encode_pipeline_t* encode, int flat_field)
|
||||
// rightmost column and the bottom row.
|
||||
//
|
||||
uint16_t *row0, *row1, *row2, *row3;
|
||||
+ /* row offset in elements: use uint64_t so y*nx cannot overflow int */
|
||||
+ uint64_t row_off = (uint64_t) (y) * (uint64_t) (nx);
|
||||
|
||||
- row0 = (uint16_t*) scratch;
|
||||
- row0 += y * nx;
|
||||
-
|
||||
- row1 = row0 + nx;
|
||||
- row2 = row1 + nx;
|
||||
- row3 = row2 + nx;
|
||||
+ row0 = (uint16_t*) scratch + row_off;
|
||||
+ row1 = row0 + (uint64_t) nx;
|
||||
+ row2 = row1 + (uint64_t) nx;
|
||||
+ row3 = row2 + (uint64_t) nx;
|
||||
|
||||
if (y + 3 >= ny)
|
||||
{
|
||||
@@ -512,11 +512,12 @@ uncompress_b44_impl (
|
||||
|
||||
for (int y = 0; y < ny; y += 4)
|
||||
{
|
||||
- row0 = (uint16_t*) scratch;
|
||||
- row0 += y * nx;
|
||||
- row1 = row0 + nx;
|
||||
- row2 = row1 + nx;
|
||||
- row3 = row2 + nx;
|
||||
+ /* row offset in elements: use uint64_t so y*nx cannot overflow int */
|
||||
+ uint64_t row_off = (uint64_t) (y) * (uint64_t) (nx);
|
||||
+ row0 = (uint16_t*) scratch + row_off;
|
||||
+ row1 = row0 + (uint64_t) nx;
|
||||
+ row2 = row1 + (uint64_t) nx;
|
||||
+ row3 = row2 + (uint64_t) nx;
|
||||
for (int x = 0; x < nx; x += 4)
|
||||
{
|
||||
if (bIn + 3 > comp_buf_size) return EXR_ERR_OUT_OF_MEMORY;
|
||||
612
4030.patch
612
4030.patch
|
|
@ -1,612 +0,0 @@
|
|||
From 4f03fb0f488d8f528bdc0f9ecac07eea8f7b63ac Mon Sep 17 00:00:00 2001
|
||||
From: Christoph Gohlke <cgohlke@cgohlke.com>
|
||||
Date: Tue, 17 Mar 2026 20:56:39 -0700
|
||||
Subject: [PATCH 1/6] Fix comparison operator for buffer size check (#2307)
|
||||
|
||||
Signed-off-by: Christoph Gohlke <cgohlke@cgohlke.com>
|
||||
---
|
||||
.../plugin/hioOpenEXR/OpenEXR/OpenEXRCore/internal_zip.c | 2 +-
|
||||
1 file changed, 1 insertion(+), 1 deletion(-)
|
||||
|
||||
diff --git a/pxr/imaging/plugin/hioOpenEXR/OpenEXR/OpenEXRCore/internal_zip.c b/pxr/imaging/plugin/hioOpenEXR/OpenEXR/OpenEXRCore/internal_zip.c
|
||||
index 628438c5c01..56df6a49c2f 100644
|
||||
--- a/pxr/imaging/plugin/hioOpenEXR/OpenEXR/OpenEXRCore/internal_zip.c
|
||||
+++ b/pxr/imaging/plugin/hioOpenEXR/OpenEXR/OpenEXRCore/internal_zip.c
|
||||
@@ -367,7 +367,7 @@ apply_zip_impl (exr_encode_pipeline_t* encode)
|
||||
|
||||
if (rv == EXR_ERR_SUCCESS)
|
||||
{
|
||||
- if (compbufsz > encode->packed_bytes)
|
||||
+ if (compbufsz >= encode->packed_bytes)
|
||||
{
|
||||
memcpy (
|
||||
encode->compressed_buffer,
|
||||
|
||||
From 0512b6c41b95e5c0ac9e01b2f87b56acd437d8e9 Mon Sep 17 00:00:00 2001
|
||||
From: Cary Phillips <cary@ilm.com>
|
||||
Date: Thu, 26 Mar 2026 16:35:49 -0700
|
||||
Subject: [PATCH 2/6] Fix integer overflow in `srcbuffer` pointer arithmetic in
|
||||
`unpack_*` (#2321)
|
||||
|
||||
Pointer arithmetic involving `srcbuffer` in the `unpack_*` functions
|
||||
can overflow for very wide images.
|
||||
|
||||
Multiplying `int w` by a bytes-per-element constant (2, 4, 6, or 8) in
|
||||
`srcbuffer +=` expressions causes signed integer overflow when the
|
||||
image width is large.
|
||||
|
||||
Promote the leading operand to `int64_t` at every affected multiplication
|
||||
so pointer arithmetic is performed in 64-bit signed arithmetic throughout,
|
||||
eliminating the undefined behavior without imposing any image size limit.
|
||||
|
||||
Affected sites: `generic_unpack`, `unpack_16bit`, `unpack_32bit`, and
|
||||
all 3- and 4-channel interleave/planar specializations.
|
||||
|
||||
Made-with: Cursor
|
||||
|
||||
Signed-off-by: Cary Phillips <cary@ilm.com>
|
||||
---
|
||||
.../hioOpenEXR/OpenEXR/OpenEXRCore/unpack.c | 38 +++++++++----------
|
||||
1 file changed, 19 insertions(+), 19 deletions(-)
|
||||
|
||||
diff --git a/pxr/imaging/plugin/hioOpenEXR/OpenEXR/OpenEXRCore/unpack.c b/pxr/imaging/plugin/hioOpenEXR/OpenEXR/OpenEXRCore/unpack.c
|
||||
index 1324508c5b4..8765bfa50d6 100644
|
||||
--- a/pxr/imaging/plugin/hioOpenEXR/OpenEXR/OpenEXRCore/unpack.c
|
||||
+++ b/pxr/imaging/plugin/hioOpenEXR/OpenEXR/OpenEXRCore/unpack.c
|
||||
@@ -229,7 +229,7 @@ unpack_16bit_3chan_interleave (exr_decode_pipeline_t* decode)
|
||||
in1 = in0 + w;
|
||||
in2 = in1 + w;
|
||||
|
||||
- srcbuffer += w * 6; // 3 * sizeof(uint16_t), avoid type conversion
|
||||
+ srcbuffer += (int64_t) w * 6; // 3 * sizeof(uint16_t), avoid type conversion
|
||||
for (int x = 0; x < w; ++x)
|
||||
{
|
||||
out[0] = one_to_native16 (in0[x]);
|
||||
@@ -269,7 +269,7 @@ unpack_16bit_3chan_interleave_rev (exr_decode_pipeline_t* decode)
|
||||
in1 = in0 + w; // G
|
||||
in2 = in1 + w; // R
|
||||
|
||||
- srcbuffer += w * 6; // 3 * sizeof(uint16_t), avoid type conversion
|
||||
+ srcbuffer += (int64_t) w * 6; // 3 * sizeof(uint16_t), avoid type conversion
|
||||
for (int x = 0; x < w; ++x)
|
||||
{
|
||||
out[0] = one_to_native16 (in2[x]);
|
||||
@@ -309,7 +309,7 @@ unpack_half_to_float_3chan_interleave (exr_decode_pipeline_t* decode)
|
||||
in1 = in0 + w;
|
||||
in2 = in1 + w;
|
||||
|
||||
- srcbuffer += w * 6; // 3 * sizeof(uint16_t), avoid type conversion
|
||||
+ srcbuffer += (int64_t) w * 6; // 3 * sizeof(uint16_t), avoid type conversion
|
||||
for (int x = 0; x < w; ++x)
|
||||
{
|
||||
out[0] = half_to_float (one_to_native16 (in0[x]));
|
||||
@@ -349,7 +349,7 @@ unpack_half_to_float_3chan_interleave_rev (exr_decode_pipeline_t* decode)
|
||||
in1 = in0 + w;
|
||||
in2 = in1 + w;
|
||||
|
||||
- srcbuffer += w * 6; // 3 * sizeof(uint16_t), avoid type conversion
|
||||
+ srcbuffer += (int64_t) w * 6; // 3 * sizeof(uint16_t), avoid type conversion
|
||||
for (int x = 0; x < w; ++x)
|
||||
{
|
||||
out[0] = half_to_float (one_to_native16 (in2[x]));
|
||||
@@ -390,7 +390,7 @@ unpack_16bit_3chan_planar (exr_decode_pipeline_t* decode)
|
||||
in0 = (const uint16_t*) srcbuffer;
|
||||
in1 = in0 + w;
|
||||
in2 = in1 + w;
|
||||
- srcbuffer += w * 6; // 3 * sizeof(uint16_t), avoid type conversion
|
||||
+ srcbuffer += (int64_t) w * 6; // 3 * sizeof(uint16_t), avoid type conversion
|
||||
/* specialise to memcpy if we can */
|
||||
#if EXR_HOST_IS_NOT_LITTLE_ENDIAN
|
||||
for (int x = 0; x < w; ++x)
|
||||
@@ -440,7 +440,7 @@ unpack_half_to_float_3chan_planar (exr_decode_pipeline_t* decode)
|
||||
in0 = (const uint16_t*) srcbuffer;
|
||||
in1 = in0 + w;
|
||||
in2 = in1 + w;
|
||||
- srcbuffer += w * 6; // 3 * sizeof(uint16_t), avoid type conversion
|
||||
+ srcbuffer += (int64_t) w * 6; // 3 * sizeof(uint16_t), avoid type conversion
|
||||
/* specialise to memcpy if we can */
|
||||
half_to_float_buffer ((float*) out0, in0, w);
|
||||
half_to_float_buffer ((float*) out1, in1, w);
|
||||
@@ -485,7 +485,7 @@ unpack_16bit_3chan (exr_decode_pipeline_t* decode)
|
||||
in0 = (const uint16_t*) srcbuffer;
|
||||
in1 = in0 + w;
|
||||
in2 = in1 + w;
|
||||
- srcbuffer += w * 6; // 3 * sizeof(uint16_t), avoid type conversion
|
||||
+ srcbuffer += (int64_t) w * 6; // 3 * sizeof(uint16_t), avoid type conversion
|
||||
for (int x = 0; x < w; ++x)
|
||||
*((uint16_t*) (out0 + x * inc0)) = one_to_native16 (in0[x]);
|
||||
for (int x = 0; x < w; ++x)
|
||||
@@ -539,7 +539,7 @@ unpack_16bit_4chan_interleave (exr_decode_pipeline_t* decode)
|
||||
in2 = in1 + w;
|
||||
in3 = in2 + w;
|
||||
|
||||
- srcbuffer += w * 8; // 4 * sizeof(uint16_t), avoid type conversion
|
||||
+ srcbuffer += (int64_t) w * 8; // 4 * sizeof(uint16_t), avoid type conversion
|
||||
for (int x = 0; x < w; ++x)
|
||||
{
|
||||
combined.a = one_to_native16 (in0[x]);
|
||||
@@ -592,7 +592,7 @@ unpack_16bit_4chan_interleave_rev (exr_decode_pipeline_t* decode)
|
||||
in2 = in1 + w;
|
||||
in3 = in2 + w;
|
||||
|
||||
- srcbuffer += w * 8; // 4 * sizeof(uint16_t), avoid type conversion
|
||||
+ srcbuffer += (int64_t) w * 8; // 4 * sizeof(uint16_t), avoid type conversion
|
||||
for (int x = 0; x < w; ++x)
|
||||
{
|
||||
combined.a = one_to_native16 (in0[x]);
|
||||
@@ -633,7 +633,7 @@ unpack_half_to_float_4chan_interleave (exr_decode_pipeline_t* decode)
|
||||
in2 = in1 + w;
|
||||
in3 = in2 + w;
|
||||
|
||||
- srcbuffer += w * 8; // 4 * sizeof(uint16_t), avoid type conversion
|
||||
+ srcbuffer += (int64_t) w * 8; // 4 * sizeof(uint16_t), avoid type conversion
|
||||
for (int x = 0; x < w; ++x)
|
||||
{
|
||||
out[0] = half_to_float (one_to_native16 (in3[x]));
|
||||
@@ -674,7 +674,7 @@ unpack_half_to_float_4chan_interleave_rev (exr_decode_pipeline_t* decode)
|
||||
in2 = in1 + w;
|
||||
in3 = in2 + w;
|
||||
|
||||
- srcbuffer += w * 8; // 4 * sizeof(uint16_t), avoid type conversion
|
||||
+ srcbuffer += (int64_t) w * 8; // 4 * sizeof(uint16_t), avoid type conversion
|
||||
for (int x = 0; x < w; ++x)
|
||||
{
|
||||
out[0] = half_to_float (one_to_native16 (in0[x]));
|
||||
@@ -719,7 +719,7 @@ unpack_16bit_4chan_planar (exr_decode_pipeline_t* decode)
|
||||
in1 = in0 + w;
|
||||
in2 = in1 + w;
|
||||
in3 = in2 + w;
|
||||
- srcbuffer += w * 8; // 4 * sizeof(uint16_t), avoid type conversion
|
||||
+ srcbuffer += (int64_t) w * 8; // 4 * sizeof(uint16_t), avoid type conversion
|
||||
/* specialize to memcpy if we can */
|
||||
#if EXR_HOST_IS_NOT_LITTLE_ENDIAN
|
||||
for (int x = 0; x < w; ++x)
|
||||
@@ -775,7 +775,7 @@ unpack_half_to_float_4chan_planar (exr_decode_pipeline_t* decode)
|
||||
in1 = in0 + w;
|
||||
in2 = in1 + w;
|
||||
in3 = in2 + w;
|
||||
- srcbuffer += w * 8; // 4 * sizeof(uint16_t), avoid type conversion
|
||||
+ srcbuffer += (int64_t) w * 8; // 4 * sizeof(uint16_t), avoid type conversion
|
||||
|
||||
half_to_float_buffer ((float*) out0, in0, w);
|
||||
half_to_float_buffer ((float*) out1, in1, w);
|
||||
@@ -825,7 +825,7 @@ unpack_16bit_4chan (exr_decode_pipeline_t* decode)
|
||||
in1 = in0 + w;
|
||||
in2 = in1 + w;
|
||||
in3 = in2 + w;
|
||||
- srcbuffer += w * 8; // 4 * sizeof(uint16_t), avoid type conversion
|
||||
+ srcbuffer += (int64_t) w * 8; // 4 * sizeof(uint16_t), avoid type conversion
|
||||
for (int x = 0; x < w; ++x)
|
||||
*((uint16_t*) (out0 + x * inc0)) = one_to_native16 (in0[x]);
|
||||
for (int x = 0; x < w; ++x)
|
||||
@@ -898,7 +898,7 @@ unpack_16bit (exr_decode_pipeline_t* decode)
|
||||
}
|
||||
}
|
||||
#endif
|
||||
- srcbuffer += w * 2;
|
||||
+ srcbuffer += (int64_t) w * 2;
|
||||
}
|
||||
}
|
||||
return EXR_ERR_SUCCESS;
|
||||
@@ -963,7 +963,7 @@ unpack_32bit (exr_decode_pipeline_t* decode)
|
||||
}
|
||||
}
|
||||
#endif
|
||||
- srcbuffer += w * 4;
|
||||
+ srcbuffer += (int64_t) w * 4;
|
||||
}
|
||||
}
|
||||
return EXR_ERR_SUCCESS;
|
||||
@@ -1118,7 +1118,7 @@ generic_unpack (exr_decode_pipeline_t* decode)
|
||||
(uint64_t) decc->user_line_stride);
|
||||
else
|
||||
{
|
||||
- srcbuffer += w * bpc;
|
||||
+ srcbuffer += (int64_t) w * bpc;
|
||||
continue;
|
||||
}
|
||||
}
|
||||
@@ -1128,12 +1128,12 @@ generic_unpack (exr_decode_pipeline_t* decode)
|
||||
}
|
||||
else
|
||||
{
|
||||
- srcbuffer += w * bpc;
|
||||
+ srcbuffer += (int64_t) w * bpc;
|
||||
continue;
|
||||
}
|
||||
|
||||
UNPACK_SAMPLES (w)
|
||||
- srcbuffer += w * bpc;
|
||||
+ srcbuffer += (int64_t) w * bpc;
|
||||
}
|
||||
}
|
||||
return EXR_ERR_SUCCESS;
|
||||
|
||||
From f5f7f32d5761b8d28d61e391e9daf68bd62bc9e5 Mon Sep 17 00:00:00 2001
|
||||
From: Cary Phillips <cary@ilm.com>
|
||||
Date: Sun, 29 Mar 2026 19:19:12 -0700
|
||||
Subject: [PATCH 3/6] Security: fix signed integer overflow in
|
||||
`undo_pxr24_impl()` (PXR24 decoder) (#2323)
|
||||
|
||||
In the `EXR_PIXEL_FLOAT` branch of `undo_pxr24_impl()`, the expressions
|
||||
|
||||
(uint64_t)(w * 3)
|
||||
|
||||
compute the signed 32-bit product `w * 3` before the cast to `uint64_t`.
|
||||
When `w` is large this is undefined behavior under the C standard; on
|
||||
two's-complement builds without sanitizers the result wraps to a small
|
||||
positive value, which can cause the bounds check
|
||||
|
||||
if (nDec + (uint64_t)(w * 3) > outSize)
|
||||
|
||||
to pass incorrectly. If the check is bypassed the decode loop proceeds
|
||||
to write `4*w` bytes through `dout`, potentially far beyond the allocated
|
||||
output buffer.
|
||||
|
||||
Fix: cast `w` to `uint64_t` before multiplying so that both the bounds
|
||||
check and the counter update are performed entirely in 64-bit unsigned
|
||||
arithmetic:
|
||||
|
||||
(uint64_t)w * 3 (cast before multiply, not after)
|
||||
|
||||
The `EXR_PIXEL_UINT` and `EXR_PIXEL_HALF` decode branches are unaffected:
|
||||
they reuse the pre-computed `nBytes` variable, which is already formed as
|
||||
`(uint64_t)(w) * (uint64_t)(bytes_per_element)`.
|
||||
|
||||
Also fix the symmetric issue in `apply_pxr24_impl()` (the encoder):
|
||||
lastIn += w * 4
|
||||
advances a pointer by a signed 32-bit product; corrected to
|
||||
lastIn += (uint64_t)w * 4
|
||||
|
||||
Made-with: Cursor
|
||||
|
||||
Signed-off-by: Cary Phillips <cary@ilm.com>
|
||||
---
|
||||
.../plugin/hioOpenEXR/OpenEXR/OpenEXRCore/internal_pxr24.c | 6 +++---
|
||||
1 file changed, 3 insertions(+), 3 deletions(-)
|
||||
|
||||
diff --git a/pxr/imaging/plugin/hioOpenEXR/OpenEXR/OpenEXRCore/internal_pxr24.c b/pxr/imaging/plugin/hioOpenEXR/OpenEXR/OpenEXRCore/internal_pxr24.c
|
||||
index 43e52c982cf..30f71f4f846 100644
|
||||
--- a/pxr/imaging/plugin/hioOpenEXR/OpenEXR/OpenEXRCore/internal_pxr24.c
|
||||
+++ b/pxr/imaging/plugin/hioOpenEXR/OpenEXR/OpenEXRCore/internal_pxr24.c
|
||||
@@ -182,7 +182,7 @@ apply_pxr24_impl (exr_encode_pipeline_t* encode)
|
||||
if (nOut + nBytes > encode->scratch_alloc_size_1)
|
||||
return EXR_ERR_OUT_OF_MEMORY;
|
||||
nOut += nBytes;
|
||||
- lastIn += w * 4;
|
||||
+ lastIn += (uint64_t) w * 4;
|
||||
|
||||
ptr[0] = out;
|
||||
out += w;
|
||||
@@ -371,7 +371,7 @@ undo_pxr24_impl (
|
||||
ptr[2] = lastIn;
|
||||
lastIn += w;
|
||||
|
||||
- if (nDec + (uint64_t) (w * 3) > outSize)
|
||||
+ if (nDec + (uint64_t) w * 3 > outSize)
|
||||
return EXR_ERR_CORRUPT_CHUNK;
|
||||
|
||||
for (int x = 0; x < w; ++x)
|
||||
@@ -384,7 +384,7 @@ undo_pxr24_impl (
|
||||
unaligned_store32 (dout, pixel);
|
||||
++dout;
|
||||
}
|
||||
- nDec += (uint64_t) (w * 3);
|
||||
+ nDec += (uint64_t) w * 3;
|
||||
break;
|
||||
}
|
||||
default: return EXR_ERR_INVALID_ARGUMENT;
|
||||
|
||||
From d578381a503add330b3b96b30cf6a49461989f08 Mon Sep 17 00:00:00 2001
|
||||
From: Cary Phillips <cary@ilm.com>
|
||||
Date: Sun, 29 Mar 2026 19:19:49 -0700
|
||||
Subject: [PATCH 4/6] fix integer overflow in PIZ wavelet buffer arithmetic
|
||||
(#2328)
|
||||
MIME-Version: 1.0
|
||||
Content-Type: text/plain; charset=UTF-8
|
||||
Content-Transfer-Encoding: 8bit
|
||||
|
||||
Three classes of signed integer overflow in the PIZ codec path, all
|
||||
reachable from corrupt `dataWindow` dimensions in the EXR file header.
|
||||
|
||||
**`wav_2D_encode` / `wav_2D_decode` — wavelet loop pointer arithmetic**
|
||||
|
||||
`oy` is passed as `int` (value `wcount * nx`, at most ~INT32_MAX after
|
||||
the guard below). Inside the hierarchical wavelet loop the expressions
|
||||
|
||||
ey = in + oy * (ny - p2) // pointer end-of-row sentinel
|
||||
oy1 = oy * p // row stride at level p
|
||||
oy2 = oy * p2 // row stride at level p2
|
||||
|
||||
multiply two values that can each approach INT32_MAX, producing a
|
||||
signed 32-bit product that wraps to a small or negative value. The
|
||||
wrapped value is used as a pointer offset, causing reads and writes
|
||||
through `px` / `py` to land outside the allocated wavelet buffer.
|
||||
|
||||
Fix: widen by introducing `int64_t oy64 = oy` and using it for all
|
||||
three expressions; `oy1` and `oy2` are also declared `int64_t`.
|
||||
|
||||
**`wavbuf += nx * ny * wcount` — per-channel buffer advance**
|
||||
|
||||
`nx`, `ny`, and `wcount` are all `int`. Their triple product overflows
|
||||
int32 for moderately large images, causing subsequent channels to be
|
||||
processed at an incorrect (too-small) offset into the wavelet buffer,
|
||||
corrupting both encode and decode output.
|
||||
|
||||
Fix: cast to `(uint64_t)` before multiplying.
|
||||
|
||||
**`wcount * nx` — call-site argument overflow**
|
||||
|
||||
The fifth argument to `wav_2D_encode` / `wav_2D_decode` is `wcount * nx`
|
||||
(`oy` = y-stride = elements per row). `wcount` is 1 or 2
|
||||
(`bytes_per_element / 2`); for `wcount = 2` the product overflows int32
|
||||
when `nx > INT32_MAX / 2`.
|
||||
|
||||
Fix: add an early bounds check `if (wcount > 0 && nx > INT_MAX / wcount)`
|
||||
that rejects such input as `EXR_ERR_CORRUPT_CHUNK` before any arithmetic
|
||||
is performed. This also keeps `wcount * nx` within int32 range at the
|
||||
call site, ensuring `oy` arrives in the wavelet functions with a valid
|
||||
non-overflowed value.
|
||||
|
||||
Made-with: Cursor
|
||||
|
||||
Signed-off-by: Cary Phillips <cary@ilm.com>
|
||||
---
|
||||
.../OpenEXR/OpenEXRCore/internal_piz.c | 39 +++++++++++--------
|
||||
1 file changed, 23 insertions(+), 16 deletions(-)
|
||||
|
||||
diff --git a/pxr/imaging/plugin/hioOpenEXR/OpenEXR/OpenEXRCore/internal_piz.c b/pxr/imaging/plugin/hioOpenEXR/OpenEXR/OpenEXRCore/internal_piz.c
|
||||
index 6c2750b166f..787d2752c61 100644
|
||||
--- a/pxr/imaging/plugin/hioOpenEXR/OpenEXR/OpenEXRCore/internal_piz.c
|
||||
+++ b/pxr/imaging/plugin/hioOpenEXR/OpenEXR/OpenEXRCore/internal_piz.c
|
||||
@@ -10,6 +10,7 @@
|
||||
#include "internal_huf.h"
|
||||
#include "internal_xdr.h"
|
||||
|
||||
+#include <limits.h>
|
||||
#include <string.h>
|
||||
|
||||
/**************************************/
|
||||
@@ -171,10 +172,11 @@ wdec16 (uint16_t l, uint16_t h, uint16_t* a, uint16_t* b)
|
||||
static void
|
||||
wav_2D_encode (uint16_t* in, int nx, int ox, int ny, int oy, uint16_t mx)
|
||||
{
|
||||
- int w14 = (mx < (1 << 14)) ? 1 : 0;
|
||||
- int n = (nx > ny) ? ny : nx;
|
||||
- int p = 1; // == 1 << level
|
||||
- int p2 = 2; // == 1 << (level+1)
|
||||
+ int w14 = (mx < (1 << 14)) ? 1 : 0;
|
||||
+ int n = (nx > ny) ? ny : nx;
|
||||
+ int p = 1; // == 1 << level
|
||||
+ int p2 = 2; // == 1 << (level+1)
|
||||
+ int64_t oy64 = oy;
|
||||
|
||||
//
|
||||
// Hierarchical loop on smaller dimension n
|
||||
@@ -183,9 +185,9 @@ wav_2D_encode (uint16_t* in, int nx, int ox, int ny, int oy, uint16_t mx)
|
||||
while (p2 <= n)
|
||||
{
|
||||
uint16_t* py = in;
|
||||
- uint16_t* ey = in + oy * (ny - p2);
|
||||
- int oy1 = oy * p;
|
||||
- int oy2 = oy * p2;
|
||||
+ uint16_t* ey = in + oy64 * (ny - p2);
|
||||
+ int64_t oy1 = oy64 * p;
|
||||
+ int64_t oy2 = oy64 * p2;
|
||||
int ox1 = ox * p;
|
||||
int ox2 = ox * p2;
|
||||
uint16_t i00, i01, i10, i11;
|
||||
@@ -284,10 +286,11 @@ wav_2D_decode (
|
||||
int oy, // i : y offset
|
||||
uint16_t mx) // i : maximum in[x][y] value
|
||||
{
|
||||
- int w14 = (mx < (1 << 14)) ? 1 : 0;
|
||||
- int n = (nx > ny) ? ny : nx;
|
||||
- int p = 1;
|
||||
- int p2;
|
||||
+ int w14 = (mx < (1 << 14)) ? 1 : 0;
|
||||
+ int n = (nx > ny) ? ny : nx;
|
||||
+ int p = 1;
|
||||
+ int p2;
|
||||
+ int64_t oy64 = oy;
|
||||
|
||||
//
|
||||
// Search max level
|
||||
@@ -307,9 +310,9 @@ wav_2D_decode (
|
||||
while (p >= 1)
|
||||
{
|
||||
uint16_t* py = in;
|
||||
- uint16_t* ey = in + oy * (ny - p2);
|
||||
- int oy1 = oy * p;
|
||||
- int oy2 = oy * p2;
|
||||
+ uint16_t* ey = in + oy64 * (ny - p2);
|
||||
+ int64_t oy1 = oy64 * p;
|
||||
+ int64_t oy2 = oy64 * p2;
|
||||
int ox1 = ox * p;
|
||||
int ox2 = ox * p2;
|
||||
uint16_t i00, i01, i10, i11;
|
||||
@@ -502,11 +505,13 @@ internal_exr_apply_piz (exr_encode_pipeline_t* encode)
|
||||
nx = curc->width;
|
||||
ny = curc->height;
|
||||
wcount = (int) (curc->bytes_per_element / 2);
|
||||
+ if (wcount > 0 && nx > INT_MAX / wcount)
|
||||
+ return EXR_ERR_CORRUPT_CHUNK;
|
||||
for (int j = 0; j < wcount; ++j)
|
||||
{
|
||||
wav_2D_encode (wavbuf + j, nx, wcount, ny, wcount * nx, maxValue);
|
||||
}
|
||||
- wavbuf += nx * ny * wcount;
|
||||
+ wavbuf += (uint64_t) nx * ny * wcount;
|
||||
}
|
||||
|
||||
nBytes = 0;
|
||||
@@ -655,11 +660,13 @@ internal_exr_undo_piz (
|
||||
nx = curc->width;
|
||||
ny = curc->height;
|
||||
wcount = (int) (curc->bytes_per_element / 2);
|
||||
+ if (wcount > 0 && nx > INT_MAX / wcount)
|
||||
+ return EXR_ERR_CORRUPT_CHUNK;
|
||||
for (int j = 0; j < wcount; ++j)
|
||||
{
|
||||
wav_2D_decode (wavbuf + j, nx, wcount, ny, wcount * nx, maxValue);
|
||||
}
|
||||
- wavbuf += nx * ny * wcount;
|
||||
+ wavbuf += (uint64_t) nx * ny * wcount;
|
||||
}
|
||||
|
||||
//
|
||||
|
||||
From a76474285ddc24e9956b5e12fab658b908912ed4 Mon Sep 17 00:00:00 2001
|
||||
From: Cary Phillips <cary@ilm.com>
|
||||
Date: Sun, 29 Mar 2026 19:20:52 -0700
|
||||
Subject: [PATCH 5/6] Fix signed integer overflow in
|
||||
`LossyDctDecoder_execute()` pointer arithmetic (#2329)
|
||||
|
||||
`numBlocksX` and `numBlocksY` are declared as `int`. Two pointer-offset
|
||||
expressions in `LossyDctDecoder_execute()` multiplied them as signed
|
||||
32-bit integers before using the result as a pointer offset:
|
||||
|
||||
rowBlock[comp] = rowBlock[comp - 1] + numBlocksX * 64;
|
||||
currDcComp[comp] = currDcComp[comp - 1] + numBlocksX * numBlocksY;
|
||||
|
||||
`dataWindow.max.x` is a signed 32-bit value in the EXR file format, so
|
||||
`numBlocksX` can reach `(INT32_MAX + 7) / 8 = 268,435,456`. At that
|
||||
point `numBlocksX * 64 = 17,179,869,184` overflows `int32`, and
|
||||
`numBlocksX * numBlocksY` overflows even sooner. The wraparound
|
||||
produces a small or negative pointer offset, causing `rowBlock[comp]`
|
||||
and `currDcComp[comp]` to point into already-used or pre-buffer memory
|
||||
rather than the intended component stride.
|
||||
|
||||
Fix: cast `numBlocksX` to `size_t` before multiplying so the
|
||||
arithmetic is performed in pointer-sized unsigned arithmetic:
|
||||
|
||||
rowBlock[comp] = rowBlock[comp - 1] + (size_t) numBlocksX * 64;
|
||||
currDcComp[comp] = currDcComp[comp - 1] + (size_t) numBlocksX * numBlocksY;
|
||||
|
||||
This is consistent with the allocation on the line above, which already
|
||||
uses `(size_t) numComp * (size_t) numBlocksX * 64 * sizeof(uint16_t)`,
|
||||
and with the packed-DC count check, which uses explicit `uint64_t` casts.
|
||||
|
||||
Made-with: Cursor
|
||||
|
||||
Signed-off-by: Cary Phillips <cary@ilm.com>
|
||||
---
|
||||
.../hioOpenEXR/OpenEXR/OpenEXRCore/internal_dwa_decoder.h | 4 ++--
|
||||
1 file changed, 2 insertions(+), 2 deletions(-)
|
||||
|
||||
diff --git a/pxr/imaging/plugin/hioOpenEXR/OpenEXR/OpenEXRCore/internal_dwa_decoder.h b/pxr/imaging/plugin/hioOpenEXR/OpenEXR/OpenEXRCore/internal_dwa_decoder.h
|
||||
index bcdebd985f9..e289b064dac 100644
|
||||
--- a/pxr/imaging/plugin/hioOpenEXR/OpenEXR/OpenEXRCore/internal_dwa_decoder.h
|
||||
+++ b/pxr/imaging/plugin/hioOpenEXR/OpenEXR/OpenEXRCore/internal_dwa_decoder.h
|
||||
@@ -265,7 +265,7 @@ LossyDctDecoder_execute (
|
||||
}
|
||||
|
||||
for (int comp = 1; comp < numComp; ++comp)
|
||||
- rowBlock[comp] = rowBlock[comp - 1] + numBlocksX * 64;
|
||||
+ rowBlock[comp] = rowBlock[comp - 1] + (size_t) numBlocksX * 64;
|
||||
|
||||
//
|
||||
// Pack DC components together by common plane, so we can get
|
||||
@@ -275,7 +275,7 @@ LossyDctDecoder_execute (
|
||||
|
||||
currDcComp[0] = (uint16_t*) d->_packedDc;
|
||||
for (int comp = 1; comp < numComp; ++comp)
|
||||
- currDcComp[comp] = currDcComp[comp - 1] + numBlocksX * numBlocksY;
|
||||
+ currDcComp[comp] = currDcComp[comp - 1] + (size_t) numBlocksX * numBlocksY;
|
||||
|
||||
for (int blocky = 0; blocky < numBlocksY; ++blocky)
|
||||
{
|
||||
|
||||
From 219a0870506f80c7353016800e467ad0de923424 Mon Sep 17 00:00:00 2001
|
||||
From: Cary Phillips <cary@ilm.com>
|
||||
Date: Tue, 31 Mar 2026 07:49:09 -0700
|
||||
Subject: [PATCH 6/6] =?UTF-8?q?Fix=20misaligned=20memory=20access=20in=20`?=
|
||||
=?UTF-8?q?LossyDctDecoder=5Fexecute`=20HALF=E2=86=92FLOAT=20expansion=20(?=
|
||||
=?UTF-8?q?#2324)?=
|
||||
MIME-Version: 1.0
|
||||
Content-Type: text/plain; charset=UTF-8
|
||||
Content-Transfer-Encoding: 8bit
|
||||
|
||||
* Fix misaligned memory access in `LossyDctDecoder_execute` HALF→FLOAT expansion
|
||||
|
||||
After DCT decoding, `LossyDctDecoder_execute()` expands FLOAT-type channels
|
||||
from their intermediate HALF (16-bit) XDR representation back to FLOAT (32-bit)
|
||||
XDR in place. The expansion was done by casting `_rows[y]` (a `uint8_t *`)
|
||||
directly to `float *` and `uint16_t *`, then reading and writing through those
|
||||
typed pointers.
|
||||
|
||||
Because row buffers are assigned by advancing a byte pointer with no alignment
|
||||
padding (`outBufferEnd += chan->width * chan->bytes_per_element` in
|
||||
`internal_dwa_compressor.h`), a FLOAT channel that follows a HALF channel of
|
||||
odd width receives a `_rows[y]` pointer that is 2-byte aligned but not 4-byte
|
||||
aligned. Dereferencing a `float *` cast from such a pointer is undefined
|
||||
behavior under the C standard:
|
||||
|
||||
- On ARM, RISC-V, and MIPS (strict alignment) this crashes immediately.
|
||||
- On x86 it is silently tolerated at the hardware level but remains UB:
|
||||
auto-vectorizing compilers (SSE/AVX) may assume aligned access and generate
|
||||
incorrect code.
|
||||
- UBSan reports: `store to misaligned address ... for type 'float', which
|
||||
requires 4 byte alignment` at `internal_dwa_decoder.h:749`.
|
||||
|
||||
Fix: replace the cast-and-dereference pattern with the `unaligned_load16` /
|
||||
`memcpy` / `unaligned_store32` helpers already used throughout the rest of
|
||||
OpenEXRCore (`internal_xdr.h`, `unpack.c`, `pack.c`, `internal_pxr24.c`).
|
||||
These helpers use `memcpy` internally, which the C standard guarantees is safe
|
||||
for unaligned addresses and which compilers compile to a single load/store
|
||||
instruction on architectures that support it.
|
||||
|
||||
The byte-order handling is preserved correctly:
|
||||
- `unaligned_load16` reads 2 bytes via `memcpy` and applies `one_to_native16`
|
||||
(XDR → native), returning a native-endian HALF value.
|
||||
- `half_to_float` converts native HALF → native float.
|
||||
- `memcpy(&bits, &f, 4)` reinterprets the float's bit pattern as `uint32_t`
|
||||
without numeric conversion (the correct type-pun idiom in C).
|
||||
- `unaligned_store32` applies `one_from_native32` (native → XDR) and writes
|
||||
4 bytes via `memcpy`, storing the result in XDR float format.
|
||||
|
||||
Made-with: Cursor
|
||||
Signed-off-by: Cary Phillips <cary@ilm.com>
|
||||
|
||||
* add TODO comment
|
||||
|
||||
Signed-off-by: Cary Phillips <cary@ilm.com>
|
||||
|
||||
---------
|
||||
|
||||
Signed-off-by: Cary Phillips <cary@ilm.com>
|
||||
---
|
||||
.../OpenEXR/OpenEXRCore/internal_dwa_decoder.h | 17 +++++++++++++----
|
||||
1 file changed, 13 insertions(+), 4 deletions(-)
|
||||
|
||||
diff --git a/pxr/imaging/plugin/hioOpenEXR/OpenEXR/OpenEXRCore/internal_dwa_decoder.h b/pxr/imaging/plugin/hioOpenEXR/OpenEXR/OpenEXRCore/internal_dwa_decoder.h
|
||||
index e289b064dac..046615ec5b8 100644
|
||||
--- a/pxr/imaging/plugin/hioOpenEXR/OpenEXR/OpenEXRCore/internal_dwa_decoder.h
|
||||
+++ b/pxr/imaging/plugin/hioOpenEXR/OpenEXR/OpenEXRCore/internal_dwa_decoder.h
|
||||
@@ -651,13 +651,22 @@ LossyDctDecoder_execute (
|
||||
/* process in place in reverse to avoid temporary buffer */
|
||||
for (int y = 0; y < d->_height; ++y)
|
||||
{
|
||||
- float* floatXdrPtr = (float*) chanData[chan]->_rows[y];
|
||||
- uint16_t* halfXdr = (uint16_t*) floatXdrPtr;
|
||||
+ uint8_t* rowBytes = chanData[chan]->_rows[y];
|
||||
|
||||
for (int x = d->_width - 1; x >= 0; --x)
|
||||
{
|
||||
- floatXdrPtr[x] = one_from_native_float (
|
||||
- half_to_float (one_to_native16 (halfXdr[x])));
|
||||
+ // TODO: make an unaligned_store32f that takes the float and
|
||||
+ // packages up a one_from_native_float and calls memcpy
|
||||
+ // instead of the two memcpy. We should look at the metrics
|
||||
+ // for dwa and see if there's a performance difference to do
|
||||
+ // so at some point. See:
|
||||
+ // https://github.com/AcademySoftwareFoundation/openexr/pull/2324
|
||||
+
|
||||
+ uint16_t h = unaligned_load16 (rowBytes + x * sizeof (uint16_t));
|
||||
+ float f = half_to_float (h);
|
||||
+ uint32_t bits;
|
||||
+ memcpy (&bits, &f, sizeof (bits));
|
||||
+ unaligned_store32 (rowBytes + x * sizeof (float), bits);
|
||||
}
|
||||
}
|
||||
}
|
||||
2
sources
2
sources
|
|
@ -1 +1 @@
|
|||
SHA512 (OpenUSD-26.03.tar.gz) = 3d5dae46c7ae096501dc51b373ba05c8603a1cf16e5054728d41d0c2970b59ce3ee5ec83e1c575b92482bc8cf2c59643df093a9e7aa82bcdd53dada05292720d
|
||||
SHA512 (OpenUSD-26.08.tar.gz) = 82f7bb4f77b295be79cd36f591f242276d36c0d589b0fca383344c27e70daf7e29151bf587528bb2fc2b2a8b974387a253993ace3caf5f79ae70f9ebbc71cf1a
|
||||
|
|
|
|||
28
usd.spec
28
usd.spec
|
|
@ -2,7 +2,7 @@
|
|||
# package version, as a reminder of the need to rebuild dependent packages on
|
||||
# every update. See additional notes near the downstream ABI versioning patch.
|
||||
# It should be 0.MAJOR.MINOR without leading zeros, e.g. 22.03 → 0.22.3.
|
||||
%global downstream_so_version 0.26.3
|
||||
%global downstream_so_version 0.26.8
|
||||
|
||||
%bcond alembic 1
|
||||
%bcond draco 1
|
||||
|
|
@ -25,7 +25,7 @@
|
|||
%bcond test 0
|
||||
|
||||
Name: usd
|
||||
Version: 26.03
|
||||
Version: 26.08
|
||||
Release: %autorelease
|
||||
Summary: 3D VFX pipeline interchange file format
|
||||
|
||||
|
|
@ -151,18 +151,14 @@ Patch: 0006-Downstream-only-use-the-system-libavif.patch
|
|||
# Backport fixes for CVE-2025-64181 etc. in OpenEXRCore
|
||||
# https://github.com/PixarAnimationStudios/OpenUSD/pull/3903
|
||||
Patch: %{forgeurl}/pull/3903.patch
|
||||
# Backport fix for CVE-2026-34544 in OpenEXRCore
|
||||
# https://github.com/PixarAnimationStudios/OpenUSD/pull/4028
|
||||
Patch: %{forgeurl}/pull/4028.patch
|
||||
# Backport several OpenEXRCore security fixes
|
||||
# https://github.com/PixarAnimationStudios/OpenUSD/pull/4030
|
||||
# Fixes:
|
||||
# - CVE-2026-34378 / GHSA-v76p-4qvv-vh4g / RHBZ#2455493
|
||||
# - CVE-2026-34380 / GHSA-q3v8-hw4m-59w5 / RHBZ#2455534
|
||||
# - CVE-2026-34588 / GHSA-588r-cr5c-w6hf / RHBZ#2455505
|
||||
# - CVE-2026-34589 / GHSA-p8xc-w3q4-h64x / RHBZ#2455501
|
||||
# - CVE-2026-34379 / GHSA-w88v-vqhq-5p24 / RHBZ#2455497
|
||||
Patch: %{forgeurl}/pull/4030.patch
|
||||
|
||||
# Replace PyWeakref_GetObject with PyWeakref_GetRef
|
||||
# Fixes RHBZ#2433881. This patch is LLM-generated and needs expert human
|
||||
# review, but it at least builds. See discussion in
|
||||
# https://bugzilla.redhat.com/show_bug.cgi?id=2433881.
|
||||
# Mentioned upstream in
|
||||
# https://github.com/PixarAnimationStudios/OpenUSD/issues/3966#issuecomment-5128542913.
|
||||
Patch: 0001-Replace-PyWeakref_GetObject-with-PyWeakref_GetRef.patch
|
||||
|
||||
# Base
|
||||
BuildRequires: gcc-c++
|
||||
|
|
@ -242,7 +238,7 @@ BuildRequires: openvdb-devel
|
|||
%endif
|
||||
|
||||
%if %{with ptex}
|
||||
BuildRequires: pkgconfig(ptex)
|
||||
BuildRequires: cmake(ptex)
|
||||
%endif
|
||||
|
||||
# Header-only library: -static is for tracking per guidelines
|
||||
|
|
@ -726,6 +722,7 @@ desktop-file-validate %{buildroot}%{_datadir}/applications/org.openusd.usdview.d
|
|||
%{_bindir}/usdstitch
|
||||
%{_bindir}/usdstitchclips
|
||||
%{_bindir}/usdtree
|
||||
%{_bindir}/usdupdatecrate
|
||||
%{_bindir}/usdzip
|
||||
%if %{with usdview}
|
||||
%{_datadir}/applications/org.openusd.usdview.desktop
|
||||
|
|
@ -757,6 +754,7 @@ desktop-file-validate %{buildroot}%{_datadir}/applications/org.openusd.usdview.d
|
|||
%{_mandir}/man1/usdstitch.1*
|
||||
%{_mandir}/man1/usdstitchclips.1*
|
||||
%{_mandir}/man1/usdtree.1*
|
||||
%{_mandir}/man1/usdupdatecrate.1*
|
||||
%{_mandir}/man1/usdzip.1*
|
||||
%if %{with usdview}
|
||||
%{_mandir}/man1/testusdview.1*
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue