Patch release that addresses several build and security issues, and also fixes a regression introduced in v3.3.0 that leads to excessive memory usage during write, especially with DWA compression (Issue #2791).
- Fix a configuration issue with OpenJPH 0.33.0 that caused it to silently and incorrectly fall back to the vendored version (PR #2813)
- The vendored OpenJPH is now built in a custom namespace to avoid symbol collision with other versions when built statically (2811) built statically,
- The vendored OpenJPH version is now 0.33.0.
- Fix
exrmultipart -converton tiled and deep single-part files OPENEXR_USE_INTERNAL_IMATH/OPENJPHare are now included inOpenEXRConfig.halongsideOPENEXR_USE_INTERNAL_DEFLATE/ZSTD.- 32-bit glibc builds now guarantee support for files of size 2GiB or more (2812)
This release addresses the following security vulnerabilities:
- CVE Pending (GHSA-PP92-4RV3-WFQ6) OpenEXR: a signed-int data-window-origin overflow in the OpenEXRUtil Image API turns
Imf::loadImageinto an attacker-steered out-of-bounds write - CVE Pending (GHSA-2V77-PVHX-25C3) Integer overflow in legacy OpenEXR.OutputFile.writePixels() causes heap over-read
See CHANGES.md for more details.
Contributors
