Skip to content

fix(dpx): ignore end-of-line padding when writing - #5472

Merged
lgritz merged 1 commit into
AcademySoftwareFoundation:mainfrom
lgritz:lg-dpxwrite
Sep 21, 2026
Merged

lgritz merged 1 commit into
AcademySoftwareFoundation:mainfrom
lgritz:lg-dpxwrite

Conversation

@lgritz

@lgritz lgritz commented Sep 14, 2026

Copy link
Copy Markdown
Collaborator

The libdpx writer strides the caller's pixel buffer by the declared end-of-line padding, but our scanline buffer is always tightly packed. Since the value was passed through from an input file's header, a crafted DPX made the writer read far past the end of the buffer during dpx-to-dpx conversion. Declare zero padding instead.

Fixes #1861

Assisted-by: Claude Code / Claude Opus 5

The libdpx writer strides the caller's pixel buffer by the declared
end-of-line padding, but our scanline buffer is always tightly packed.
Since the value was passed through from an input file's header, a
crafted DPX made the writer read far past the end of the buffer during
dpx-to-dpx conversion. Declare zero padding instead; we can never supply
a padded buffer, so the pass-through could not have produced a correct
file anyway.

Fixes 1861

Assisted-by: Claude Code / Claude Opus 5

Signed-off-by: Larry Gritz <lg@larrygritz.com>
@lgritz

lgritz commented Sep 19, 2026

Copy link
Copy Markdown
Collaborator Author

Comments?

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Copilot review overview

🟡 Changes recommended

Preserve end-of-image padding while zeroing only end-of-line padding.

Get a fresh assessment by requesting another Copilot review.

Review effort: Lite
Findings: 1 Medium severity

Open (1)
What changed in this PR

Fixes a DPX writer buffer over-read by ignoring inherited end-of-line padding for tightly packed buffers.

Changes:

  • Adds regression coverage for padded metadata.
  • Updates expected DPX output metadata.
  • Requires preserving end-of-image padding while forcing only end-of-line padding to zero.
File Summary
testsuite/​dpx/​run.py Adds regression coverage for nonzero padding attributes.
testsuite/​dpx/​ref/​out.txt Updates expected output metadata.
src/​dpx.imageio/​dpxoutput.cpp Prevents unsafe end-of-line strides; preserve the documented end-of-image padding attribute.

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

Comment thread src/dpx.imageio/dpxoutput.cpp
@lgritz

lgritz commented Sep 21, 2026

Copy link
Copy Markdown
Collaborator Author

No comments for a week -> merging

@lgritz
lgritz merged commit 9d60029 into AcademySoftwareFoundation:main Sep 21, 2026
32 checks passed
@lgritz
lgritz deleted the lg-dpxwrite branch September 21, 2026 03:56
lgritz added a commit to lgritz/OpenImageIO that referenced this pull request Sep 21, 2026
…ndation#5472)

The libdpx writer strides the caller's pixel buffer by the declared
end-of-line padding, but our scanline buffer is always tightly packed.
Since the value was passed through from an input file's header, a
crafted DPX made the writer read far past the end of the buffer during
dpx-to-dpx conversion. Declare zero padding instead.

Fixes AcademySoftwareFoundation#1861

Assisted-by: Claude Code / Claude Opus 5

Signed-off-by: Larry Gritz <lg@larrygritz.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

heap-buffer-overflow in dpx::WriteBuffer

2 participants