@@ -163,6 +163,32 @@ library. Malformed images could caused issues such as heap buffer
163163overflows, out-of-memory faults, or segmentation faults that could be
164164exploitable as denial-of-service attacks.
165165
166+ ### Image Size Limits and Out-of-Memory Failures
167+
168+ The OpenEXR file format places no fixed limit on image size, except
169+ that image width and height are represented by signed 32-bit integers
170+ and therefore technically limited to a maximum of 2,147,483,647.
171+
172+ Memory allocation failures caused by large image dimensions declared
173+ in file headers are not considered security vulnerabilities when the
174+ allocation size is proportional to the declared image dimensions. EXR
175+ files can legitimately describe very large images, and the memory
176+ required to decode them is inherently proportional to their pixel
177+ count. Exhausting available memory on a given machine is a system
178+ resource constraint, not a library defect — the same file that
179+ triggers an out-of-memory error on one machine may load successfully
180+ on another with more memory.
181+
182+ The OpenEXR library provides
183+ ` Imf::Header::setMaxImageSize(int maxWidth,int maxHeight) ` and
184+ ` Imf::Header:"setMaxTileSize(int maxWidth,int maxHeight) ` (and
185+ ` exr_set_default_maximum_image_size() ` and
186+ ` exr_set_default_maximum_tile_size() ` in OpenEXRCore) to allow
187+ applications to reject files with dimensions exceeding a configurable
188+ limit before any large allocation occurs. Applications processing
189+ untrusted EXR files should set these limits to values appropriate for
190+ their deployment environment.
191+
166192### Hardening
167193
168194#### Testing
0 commit comments