CVE-2021-45942

An attacker crafts a malicious OpenEXR file with sample count table data, packed data, or unpacked data sizes exceeding `INT_MAX`. When the library reads the sample count table, the missing size checks allow a heap-based buffer overflow [CWE-122]. The overflow is triggered during file parsing without authentication, making it remotely exploitable via any application that opens the crafted file.

The heap-based buffer overflow occurs in `Imf_3_1::LineCompositeTask::execute`, called from `IlmThread_3_1::NullThreadPoolProvider::addTask` and `IlmThread_3_1::ThreadPool::addGlobalTask`. The patch in `db217f2` addresses the root cause in `readSampleCountForLineBlock` by adding missing size checks for `packedDataSize` and `unpackedDataSize` against `compressorMaxDataSize` before reading sample count data.

The patch adds two additional size comparisons — `packedDataSize > compressorMaxDataSize` and `unpackedDataSize > compressorMaxDataSize` — alongside the existing `sampleCountTableDataSize` check. Previously only `sampleCountTableDataSize` was validated, allowing oversized packed/unpacked sizes to bypass the guard and cause a heap overflow when the data is later read into a buffer sized by `compressorMaxDataSize`. The fix also changes `compressorMaxDataSize` from `int` to `uint64_t` to avoid implicit truncation.