# OpenEXR: integer overflow to OOB write in uncompress_b44_impl()

B44 decoder computes row pointer offset y*nx in int, overflowing for wide channels and causing memcpy OOB write before the scratch buffer.

- Payout: Research
- Severity: high
- Program: OpenEXR
- Found by: nicoppida
- Disclosed: 2026-04-03
- CVE: CVE-2026-34544
- Write-up quality: 7/10
- Original: https://github.com/advisories/GHSA-h762-rhv3-h25v
- Library page: http://bugbountylibrary.com/r/ghsa%3AGHSA-h762-rhv3-h25v
- Tags: area:oss domain:oss impact:dos impact:integrity kind:research platform:ghsa sev:high tech:linux technique:source-review vuln:dos vuln:memory-corruption

**Target:** B44/B44A decompression path in libOpenEXRCore (internal_b44.c)
**Root cause:** Row pointer offset y*nx is computed in plain int while the scratch buffer size is computed in uint64_t, so large nx overflows the int product and wraps row0 before the buffer start.
**Steps:**
1. Craft a B44 scanline EXR with width 268435456 and height 9, single HALF channel.
2. Write a scanline chunk with packed B44 blocks (blocks = W/4*2+1, 3 bytes each).
3. Read back and initialize decoding pipeline via exr_decoding_run().
4. In uncompress_b44_impl, y=8 and nx=268435456 make `row0 += y * nx` overflow int, displacing row0 before scratch.
5. Subsequent `memcpy(row0, &s[0], n)` writes to invalid address, crashing (ASAN SEGV WRITE).
**How found:** Code review of the B44 decoder: noticed nx/ny declared as int while the allocation path promotes to uint64_t, then traced the row pointer arithmetic `y * nx` as the only int-width multiplication left.
**Exploitation:** Attacker supplies a crafted B44/B44A EXR file; any app decoding it via exr_decoding_run() triggers the OOB write, typically crashing and potentially corrupting adjacent heap allocations depending on layout.
**Insight:** When a size/allocation path is hardened with uint64_t casts, check every other arithmetic use of the same dimensions — pointer-offset math like `y * nx` is a common leftover int overflow that bypasses the allocation guard.