CVE-2026-43909 OpenImageIO 整数溢出越界读写漏洞

#include <iostream> #include <cstdint> // Reproduction of the integer overflow logic in SwapRGBABytes void simulate_vulnerability(int32_t width, int32_t height) { // Calculate total pixels int64_t total_pixels = (int64_t)width * height; std::cout << "Processing image dimensions: " << width << "x" << height << std::endl; for (int32_t i = 0; i < total_pixels; i++) { // VULNERABILITY: Signed 32-bit integer overflow in i * 4 // If i is large enough (> 536,870,911), i * 4 wraps to a negative number int32_t offset = i * 4; if (offset < 0) { std::cout << "[!] Integer Overflow detected at index i=" << i << std::endl; std::cout << "[!] Calculated offset: " << offset << " (Negative)" << std::endl; std::cout << "[!] This would cause an Out-of-Bounds Read/Write." << std::endl; return; } } std::cout << "[+] No overflow detected with these dimensions." << std::endl; } int main() { // Set dimensions large enough to trigger i * 4 > INT_MAX // INT_MAX is 2,147,483,647. We need i > 536,870,911. int32_t width = 600000000; int32_t height = 1; simulate_vulnerability(width, height); return 0; }