From 5722eac40f872b487270186c5512ef787d0e7e52 Mon Sep 17 00:00:00 2001 From: Larry Gritz Date: Sun, 30 Aug 2026 22:11:55 -0700 Subject: [PATCH] admin: CREDITS and other staging in anticipation of release - Update CHANGES.md - Forward-port changes from SECURITY.md and mark versions fixed Signed-off-by: Larry Gritz --- .mailmap | 17 +++ CHANGES.md | 342 +++++++++++++++++++++++++++++----------------------- CREDITS.md | 15 ++- SECURITY.md | 35 +++--- 4 files changed, 243 insertions(+), 166 deletions(-) diff --git a/.mailmap b/.mailmap index 340ef3ab43..6a5aabdcc9 100644 --- a/.mailmap +++ b/.mailmap @@ -18,6 +18,8 @@ Alejandro Conty aconty Alejandro Conty Alejandro Conty +Alexy Pawlow Алексей +Alexy Pawlow Алексей Anton Dukhovnikov Anton Dukhovnikov <131838425+antond-weta@users.noreply.github.com> Brecht Van Lommel Brecht Van Lommel Brecht Van Lommel @@ -38,10 +40,14 @@ Fabien Servant <55734626+servantf@users.noreply.github.com> Fabien Servant @ TCS Frédéric Devernay Frédéric Devernay Harry Mallon Harry Mallon <1816667+hjmallon@users.noreply.github.com> Henri Fousse darkhorse64 +Jackson Sun JacksonSun-adsk +Jackson Sun JacksonSun-adsk Jesse Yurkovich Jesse Y +Jinnie Kim Jinnie Kim <71912315+jinhgkim@users.noreply.github.com> Larry Gritz Larry Gritz lgritz Leszek Godlewski Leszek Godlewski +Li Ji <146397706+lji-ilm@users.noreply.github.com> LI JI <146397706+lji-ilm@users.noreply.github.com> lmarz lmarz <37630820+lmarz@users.noreply.github.com> Mark Boorer Mark Boorer Mark Boorer Shootfast @@ -49,10 +55,16 @@ Mark Visser Mark Visser Matteo F. Vescovi Matteo F. Vescovi Matteo F. Vescovi Matteo F. Vescovi Mikael Sundell Mikael Sundell +Nathan Gray NathanGray-ChurchillNavigation Nathan Rusch Nathan Rusch Nick Black nick black Nick Black Nick Black +Oktay Comu Oktay Comu Pascal Lecocq Pascal Lecocq +Paul Franz pfranz +Paul Franz pfranz +Peter Kovář Peter Kovář <3098510+1div0@users.noreply.github.com> +Peter Kovář Peter Kovář Ramon Montoya Ramon Montoya Vozmediano Ramon Montoya rmv Ray Molenkamp Ray Molenkamp @@ -64,8 +76,13 @@ Roman Zulak marsupial Sam Richards Shane Ambler sambler Shane Ambler SAmbler +Shane Smith shanesmith-dwa Simon Boorer Simon Boorer Thiago Ize Thiago Ize +Vanessa Valderrama vvalderrv Vlad (Kuzmin) Erium Vlad (Kuzmin) Erium +Vlad (Kuzmin) Erium Vlad Erium +Vlad (Kuzmin) Erium Vlad Erium +Wayne Arnold wayne-arnold-adsk Will Rosecrans Will Yang Yang YangYangTL diff --git a/CHANGES.md b/CHANGES.md index 4f48214907..7446659d6d 100644 --- a/CHANGES.md +++ b/CHANGES.md @@ -1,29 +1,63 @@ -fmRelease 3.2 (target: Sept 2026?) -- compared to 3.1 ---------------------------------------------------- +Release 3.2 (target: Oct 1, 2026?) -- compared to 3.1 +------------------------------------------------------- +- Beta 1 (3.2.0.3-beta1): Sep 1, 2026 + +**Executive Summary / Highlights** + - JPEG support for writing Ultra-HDR images. + - FLIP perceptual image comparison via `ImageBufAlgo::flip_diff()` and + `oiiotool --flipdiff`. + - Many color management improvements: use of Color Interop Forum (CIF) + staandardized names throughout, support for CICF codes in file formats + that allow them, better ICC profile R/W support. + - Improved "thumbnail image" support by several image file formats, and via + new oiiotool commands for adding and extracting thumbnails. + - Dozens and dozens of security/bug improvements to harden the various file + format readers against corrupted or malicious image file input. + - Switch Python bindings to [nanobind](https://github.com/wjakob/nanobind) + by defalt. + - New ABI version namespacing scheme makes 3.2 fully API, ABI, and link + compatible with OpenImageIO 3.1. + +### ABI backwards-compatibility -- NO CHANGE + +Unlike previous yearly releases. OpenImageIO 3.2 is 100% backward compatible +with 3.1 releases in its API and also ABI / link compatibility. There may be +new functionality added, but any API call supported by 3.1 still exists and is +link compatible. + +This means, for example, that if you are making a large appication that +currently embeds OpenImageIO 3.1 and exposes its APIs to user-written dynamic +plugins/modules (so that they can make calls to the built-in OIIO), your app +can upgrade to OpenImageIO 3.2 without losing compatibility with those plugins +-- all the link symbols that existed before continue to exist with the same +call signatures. ### New minimum dependencies and compatibility changes: - - The deprecated icc compiler is no longer supported. (3.2.0.0) - - **fmt**: Minimum required version is now 9.0 (was 7.0). - - **LibRaw**: Minimum required version is now 0.21.0 (was 0.20.0). + - The deprecated **icc compiler** is no longer supported. (3.2.0.0) + - **CMake**: Minimum 3.18 -> 3.23. [#5394](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5394) (3.2.0.3) + - **fmt**: Minimum 7.0 -> 9.0. + - **libjpeg**: Minimum 8 -> 9. Note that libjpeg-turbo 2.1+ still satisfies this. [#5432](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5432) (3.2.0.3) + - **LibRaw**: Minimum 0.20.0 -> 0.21.0 + - **libtiff**: Minimum 4.0 -> 4.1. [#5414](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5414) (3.2.0.3) + - **DCMTK** (optional, DICOM support): Minimum 3.6.1 -> 3.6.2. [#5438](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5438) (3.2.0.3) + - **SIMD baseline**: Builds targeting x86-64 now default to an SSE4.2 instruction baseline (`USE_SIMD=sse4.2`) instead of inheriting the compiler default (often plain SSE2), so OIIO's SSE4 fast paths are used out of the box. Every x86-64 CPU since 2008 has SSE4.2. Use `USE_SIMD=0` to disable SIMD or `USE_SIMD=sse2` for the old behavior. `USE_SIMD` is also now architecture-aware, so x86 tokens no longer leak into ARM builds. [#5411](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5411) (3.2.0.3) + - **Python bindings**: The default binding backend is now nanobind rather than pybind11; configure with `-DOIIO_PYTHON_BINDINGS_BACKEND=pybind11` to keep the old backend. [#5430](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5430) (3.2.0.3) ### ⛰️ New features and public API changes: * *New image file format support:* + - *jpeg*: Support writing Ultra HDR images (previously only reading was supported). [#5335](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5335) (by @mugulmd / Loïc Vital) * *oiiotool new features and major improvements*: - `--flipdiff` computes the FLIP perceptual difference between two images, prints statistics, and leaves the error map on the image stack for further - processing or saving. Options: `hdr=1` for HDR-FLIP, `colormap=NAME` to - apply a false-color map (e.g. "magma"), `ppd=N` to override pixels-per- - degree, `tonemapper=NAME` for HDR tonemapper ("aces", "reinhard", - "hable"). [#5154](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5154) [#5171](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5171) (3.2.0.1, 3.1.13.0) - - `--experimental` enables opt-in trial features not yet part of the stable API, signaling that such behaviors may change between releases. [#5147](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5147) (3.2.0.1, 3.1.13.0) + processing or saving. [#5154](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5154) [#5171](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5171) (by @lgritz / Larry Gritz) (3.2.0.1) - `--nchannels` specifies the number of output channels, for parity with maketx. [#5198](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5198) (by @grdanny / Danny Greenstein) (3.2.0.3, 3.1.14.0) - oiiotool commands taking offsets or geometry arguments now accept commas as alternative separators (e.g., `X,Y` or `WxH,X,Y` in addition to the X11-style `+X+Y` form). This affects `--create`, `--crop`, `--cut`, `--fit`, `--fullsize`, `--origin`, `--originoffset`, `--paste`, `--pattern`, `--printstats`, `--resize`. [#5209](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5209) (3.2.0.3, 3.1.14.0) - - `--thumbnail-get` (and `-i:get_thumbnail=1`) and `--thumbnail-set` commands to extract and attach embedded thumbnails. Thumbnail support remains uneven across formats: reading is implemented for PSD, camera RAW, and TGA, but writing only for TGA. Fixed TGA postage-stamp read/write bugs uncovered along the way (wrong byte order/orientation, missing alpha association). [#5236](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5236) (by @jinhgkim / Jinnie Kim) (3.2.0.4, 3.1.16.0) + - `--experimental` enables opt-in trial features not yet part of the stable API, signaling that such behaviors may change between releases. [#5147](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5147) (3.2.0.1, 3.1.13.0) * *Command line utilities*: - *iv*: Flip, rotate and save image [#5003](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5003) (by @vangeliq / Valery Angelique) (3.2.0.0, 3.1.11.0) - *iconvert*: Allow `-o outfile` for output file designation, for parity with oiiotool syntax. [#5173](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5173) (3.2.0.3, 3.1.14.0) * *ImageBuf/ImageBufAlgo*: - - `ImageBufAlgo::FLIP()` computes the FLIP (eLearning perceptual Image + - `ImageBufAlgo::FLIP_diff()` computes the FLIP (perceptual Image difference Predictor) metric between two LDR or HDR images. The result is a single-channel float image with per-pixel FLIP error in [0,1]. A `FLIPResults` struct returns mean error, max error, and location. The @@ -33,71 +67,56 @@ fmRelease 3.2 (target: Sept 2026?) -- compared to 3.1 [#5154](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5154) [#5171](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5171) [#5331](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5331) (3.2.0.1) - `ImageBuf::localpixels_as_[writable_]byte_image_span` [#5011](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5011) (3.2.0.0, 3.1.10.0) * *ImageCache/TextureSystem*: - - *texture*: Experimental GPU texture system prototype, implemented as a standalone testsuite executable that doesn't modify the core library. It validates a proposed host/device architecture end to end -- request-driven texture lookup, residency updates, retry flow, filtering, and output generation -- to inform eventual promotion of pieces into library code. See `README.md`/`SPEC.md` in the testsuite entry for design details. [#5228](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5228) (by @aconty / Alejandro Conty) (3.2.0.4, 3.1.16.0) + - *texture*: Experimental GPU texture system prototype, implemented as a standalone testsuite executable that doesn't modify the core library. It validates a proposed host/device architecture end to end -- request-driven texture lookup, residency updates, retry flow, filtering, and output generation -- to inform eventual promotion of pieces into library code. See `README.md`/`SPEC.md` in the testsuite entry for design details. [#5228](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5228) (by @aconty / Alejandro Conty) (3.2.0.3, 3.1.16.0) * New global attribute queries via OIIO::getattribute(): - - `limits:resolution` (default: 1048576) is a new settable/queryable global - attribute that caps the maximum number of pixels along any single image - dimension. `ImageInput::check_open` rejects files exceeding it. This - complements `limits:imagesize_MB` to catch corrupt headers that are tiny - in one dimension but absurdly large in another, which can defeat the - total-pixel-memory check. - [#5297](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5297) (3.2.0.4, 3.1.16.0) + - `limits:resolution` (default: 1048576) caps the maximum number of pixels along any single image dimension. `ImageInput::check_open` rejects files exceeding it. This complements `limits:imagesize_MB` to catch corrupt headers that are tiny in one dimension but absurdly large in another, which can defeat the total-pixel-memory check. [#5297](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5297) (3.2.0.3, 3.1.16.0) * Miscellaneous API changes: - *api*: Versioned namespace to preserve ABI compatibility between minor releases [#4869](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/4869) (3.2.0.0) - *ColorConfig*: New `isData()` API method to query if a color space is a data space; fix Python `isColorSpaceLinear()`. [#5191](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5191) (3.2.0.3, 3.1.14.0) - *api*: `ImageSpec::size_t_safe()` and `ImageSpec::valid_tile_range()` are now annotated `OIIO_NODISCARD` to warn callers not to ignore their return values. [#5218](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5218) (by @zoomhunter2010 / Hunter) (3.2.0.3) - *deepdata*: Widen `merge_deep_pixels()`'s srcpixel parameter to `int64_t`, change its return type, and add `OIIO_NODISCARD_ERROR`. [#5252](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5252) [#5253](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5253) (by @luna-y-kim / Luna Kim) (3.2.0.3, 3.1.15.0) - - *python*: Unify the pybind11 and nanobind Python bindings so both backends compile from a single shared source tree (`src/python/`) instead of maintaining a separate nanobind-only copy, reducing duplicated binding code and the risk of behavior drift between backends. `ROI`, `TypeDesc`, `ImageSpec`, `ParamValue`/`ParamValueList`, and the core module helpers are migrated so far; the rest of the API (`ImageBuf`, `ImageInput`/`ImageOutput`, `ImageBufAlgo`, texture system, etc.) remains pybind11-only for now. [#5254](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5254) (by @soswow / Aleksandr Motsjonov) (3.2.0.3) - - *python*: Continue the pybind11/nanobind unification: bring the remaining Python modules onto the shared dual-backend source tree, simplify buffer/array helpers (buffer requests, `make_numpy_array` shapes, module attributes), and add `OIIO_PY_PROP_RW_NONE` for None-assignable properties. Adds regression coverage for 0-d `ImageBuf` buffers and `get_bytes_attribute` default conversion; `MIGRATION_STATUS` now reflects full dual-backend coverage. [#5310](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5310) (by @soswow / Aleksandr Motsjonov) (3.2.0.4) + - *python*: Add [nanobind](https://github.com/wjakob/nanobind) python bindings and use them as the new default. [#5084](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5084) (by @soswow / Aleksandr Motsjonov) (3.2.0.1) [#5254](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5254) (by @soswow / Aleksandr Motsjonov) (3.2.0.3) [#5310](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5310) (by @soswow / Aleksandr Motsjonov) (3.2.0.3) [#5346](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5346) [#5430](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5430) (3.2.0.3) * Color management improvements: - - Fix some legacy 'Linear' color references [#4959](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/4959) (3.2.0.0) + - Fix some legacy 'Linear' color references, use CIF names exclusively [#4959](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/4959) (3.2.0.0) - Auto convert between oiio:ColorSpace and CICP attributes in I/O [#4964](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/4964) (by @brechtvl / Brecht Van Lommel) (3.0.14.0, 3.2.0.0) - *openexr*: Write OpenEXR colorInteropID metadata based on oiio:ColorSpace [#4967](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/4967) (by @brechtvl / Brecht Van Lommel) (3.0.14.0, 3.2.0.0) - - *color mgmt*: For OCIO built-in configs, replace the default file rules with more sensible ones that avoid spurious matches (e.g., no longer assumes all `.exr` files use ACES2065-1 primaries). [#5194](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5194) (3.2.0.3, 3.1.14.0) + - For OCIO built-in configs, replace the default file rules with more sensible ones that avoid spurious matches (e.g., no longer assumes all `.exr` files use ACES2065-1 primaries). [#5194](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5194) (3.2.0.3, 3.1.14.0) - Add `g24_rec709_scene` interop ID (from the CIF texture color space recommendation 1.1) to PNG write, TGA, and RLA for consistency with PNG read and DPX; also fix TGA/RLA writing `g22_rec709`/`g18_rec709` without the `_scene` suffix. [#5391](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5391) (by @brechtvl / Brecht Van Lommel) - Include inactive color spaces (e.g. the display spaces in older ACES configs bundled with OCIO 2.3) when looking up or converting to a named color space; add `ColorConfig::isColorSpaceActive()` to test activity. Inactive spaces remain hidden from `iv`'s UI. [#5387](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5387) (by @brechtvl / Brecht Van Lommel) - - `srgb_rec709_display` is now a built-in color space alongside `srgb_rec709_scene`, so it's available even with an OCIO config that doesn't define it; the built-in `sRGB` name remains an alias of `srgb_rec709_scene`. [#5396](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5396) (by @brechtvl / Brecht Van Lommel) -* Other notable new feature: - - *jpeg*: Support writing Ultra HDR images (previously only reading was supported), enabling conversion of HDR images from formats like OpenEXR to the widely-supported Ultra HDR JPEG format. [#5335](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5335) (by @mugulmd / Loïc Vital) - - *testing*: New libFuzzer-based fuzzing infrastructure for image format - readers: a single dynamic-dispatch harness (`oiio_fuzz_image`) discovers - formats at runtime, so new format plugins get fuzz coverage automatically - with no harness to write. A nightly 29-format CI matrix runs, tiered by - risk, with per-format corpus caching. The shared bounded/chunked - read-and-verify loop also backs a new `oiiotool --testread` debug flag, - useful on its own for checking whether a file can be fully read without - needing pixels stored. See `docs/dev/fuzzing.md` for the local - build/run/reproduce/minimize workflow. [#5314](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5314) (3.2.0.4, 3.1.16.0) + - `srgb_rec709_display` is now a built-in color space alongside `srgb_rec709_scene`, so ite's available even with an OCIO config that doesn't define it; the built-in `sRGB` name remains an alias of `srgb_rec709_scene`. [#5396](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5396) (by @brechtvl / Brecht Van Lommel) + - Refactor color-space metadata writing to share logic across formats: new `ImageSpec` helpers `is_colorspace_srgb()`, `get_colorspace_rec709_gamma()`, `get_colorspace_icc_profile()`, and `get_colorspace_cicp()` replace logic each writer previously open-coded, and writing gamma metadata from an interop ID now works for display interop IDs too, not just scene ones. [#5390](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5390) (by @brechtvl / Brecht Van Lommel) (3.2.0.3) + - Make color interop IDs work with older OpenColorIO ACES configs by adding legacy aliases matching those in the OCIO ACES configs back to 1.0.0; previously only OCIO 2.5+ builds would correctly write color metadata in cases such as `oiiotool --ociodisplay` to an HDR or wide-gamut display space. [#4971](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/4971) (by @brechtvl / Brecht Van Lommel) (3.2.0.3) +* Improved thubnail support: + - `--thumbnail-get` (and `-i:get_thumbnail=1`) and `--thumbnail-set` commands to extract and attach embedded thumbnails (for those formats that support them). [#5236](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5236) (by @jinhgkim / Jinnie Kim) (3.2.0.3, 3.1.16.0) + - *openexr*: Read support for the OpenEXR `preview` attribute (thumbnail) per subimage, exposing a latent `ImageRec` bug since EXR was the first multi-subimage format to support thumbnails. [#5374](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5374) (by @jinhgkim / Jinnie Kim) ### 🚀 Performance improvements - *perf*: `ImageBufAlgo::resample` and `oiiotool --resample` improvements to speed up 20x or more [#4993](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/4993) (3.2.0.0, 3.1.10.0) - *perf*: Reduce redundant file re-opening attempts when a file fails to open. [#5267](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5267) (3.2.0.3) + - *perf*: `ImageBufAlgo::resample()` and `oiiotool --resample` precompute the destination-to-source pixel mapping into per-axis tables instead of recomputing it per pixel, roughly 2-3x faster for the common in-memory cases (nearest and bilinear). Also fixes nearest-mode resample incorrectly routing through the always-bilinear Highway path. [#5395](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5395) [#5393](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5393) (by @wingfiring / Jackson Sun) (3.2.0.3) + - *perf*: On ARM, speed up some SIMD operations. [#5412](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5412) (3.2.0.3, 3.1.17.0) ### 🐛 Fixes and feature enhancements - *deepdata*: Correct the Zback channel in `sort()`; change int pixel to `int64_t`. [#5241](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5241) (by @luna-y-kim / Luna Kim) (3.2.0.3, 3.1.15.0) - - *exif*: Support EXIF 3.0 tags (for all formats) [#4961](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/4961) (3.2.0.1) - - *exif*: Beef up Exif error detection: check that the blob is at least as large as a `TIFFHeader` before parsing it, and honor the `imageinput:strict` attribute (previously ignored in several places) so a corrupt Exif blob is a hard error in strict mode for the JPEG, PNG, WebP, and Heif readers, not just silently skipped. [#5322](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5322) (3.2.0.4, 3.1.16.0) - - *exif*: Harden the shared Exif decoder (used by JPEG, PNG, Raw, HEIF, PSD, and WebP) against several corrupt/malicious-input issues found during audit, including a recursive IFD directory-count overread. [#5399](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5399) - - *IBA*: IBA::compare_Yee() accessed the wrong channel [#4976](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/4976) (by @pmady / Pavan Madduri) (3.2.0.0) - - *IBA*: Handle offset data windows in fillholes_pushpull [#5105](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5105) (3.2.0.1, 3.1.12.0, 3.0.17.0) - - *IBA*: Detect `ImageBuf::ConstIterator` read errors in the orientation functions (flip, flop, rotate90/180/270, transpose), previously silently ignored. [#5355](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5355) (by @luna-y-kim / Luna Kim) - - *IBA*: `reorient()` had orientations 5 and 7 swapped (transverse and transpose). [#5350](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5350) (by @luna-y-kim / Luna Kim) - - *IBA*: `ImageBufAlgo::make_texture()` now honors "maketx:threads" hint [#5014](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5014) (3.2.0.0, 3.1.10.0) - *iinfo*: Better error handling and propagation, especially from `--hash`; fix return code when a file could not be read [#5168](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5168) (3.2.0.1, 3.1.13.0) - *ImageBuf*: Fix set_pixels bug, didn't consider roi = All [#4949](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/4949) (3.2.0.1) - *ImageBuf*: Copy ctor of an ImageCache-backed ImageBuf zeroed the bufspan strides. [#5244](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5244) (3.2.0.3, 3.1.15.0) - - *ImageBuf*: Fix a crash/abort when an error message format string was passed too few arguments. [#5343](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5343) - - *ImageBuf*: Fix a data race that could corrupt multithreaded reads: `m_pixels_valid` (and `m_spec_valid`) were set true as soon as the buffer/spec were allocated, before being fully populated, so a lock-free reader on another thread could observe the flag true and read stale or empty data. The flags (and `m_pixels_read`) are now set only once their data is fully populated, and made atomic so lock-free readers get a proper memory barrier. [#5325](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5325) (3.2.0.4, 3.1.16.0) - - *ImageBuf*: Remove redundant and dead code found while investigating an `IBA::reorient()` bug: a stray flag reset that immediately undid `m_badfile = true`, a redundant `validate_spec()` call in `orientation()` (already called by `spec()`), and an unreachable condition in `copy()`. [#5353](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5353) (by @luna-y-kim / Luna Kim) (3.2.0.4) + - *ImageBuf*: Fix a crash/abort when an error message format string was passed too few arguments. [#5343](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5343) (3.2.0.3, 3.1.17.0) + - *ImageBuf*: Fix a data race that could corrupt multithreaded reads: `m_pixels_valid` (and `m_spec_valid`) were set true as soon as the buffer/spec were allocated, before being fully populated, so a lock-free reader on another thread could observe the flag true and read stale or empty data. The flags (and `m_pixels_read`) are now set only once their data is fully populated, and made atomic so lock-free readers get a proper memory barrier. [#5325](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5325) (3.2.0.3, 3.1.16.0) + - *ImageBuf*: Remove redundant and dead code found while investigating an `IBA::reorient()` bug: a stray flag reset that immediately undid `m_badfile = true`, a redundant `validate_spec()` call in `orientation()` (already called by `spec()`), and an unreachable condition in `copy()`. [#5353](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5353) (by @luna-y-kim / Luna Kim) (3.2.0.3) + - *ImageBufAlgo*: `compare_Yee()` accessed the wrong channel [#4976](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/4976) (by @pmady / Pavan Madduri) (3.2.0.0) + - *ImageBufAlgo*: Handle offset data windows in `fillholes_pushpull()` [#5105](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5105) (3.2.0.1, 3.1.12.0, 3.0.17.0) + - *ImageBufAlgo*: Detect `ImageBuf::ConstIterator` read errors in the orientation functions (flip, flop, rotate90/180/270, transpose), previously silently ignored. [#5355](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5355) (by @luna-y-kim / Luna Kim) (3.2.0.3, 3.1.17.0) + - *ImageBufAlgo*: `reorient()` had orientations 5 and 7 swapped (transverse and transpose). [#5350](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5350) (by @luna-y-kim / Luna Kim) + - *ImageBufAlgo*: `ImageBufAlgo::make_texture()` now honors "maketx:threads" hint [#5014](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5014) (3.2.0.0, 3.1.10.0) - *ImageInput*: check_open fixes and new checks [#5087](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5087) (3.2.0.1, 3.1.12.0, 3.0.17.0) - *ImageInput*: Guarantee that a plugin left in a fresh, never-opened state (as if `close()` were called) when `open()` fails, clarifying and enforcing a previously ambiguous contract. [#5398](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5398) - - *ImageInput/ImageOutput*: Fix a per-instance error-message leak: the thread-local error map's destructor-time erase had been disabled out of caution about static destruction order, so every `ImageInput`/`ImageOutput` destroyed without its error being retrieved via `geterror()` leaked a map entry -- found via a fuzzer that opened hundreds of thousands of corrupt files and grew the map unbounded. Re-enable the erase, now guarded against the destruction-order hazard. [#5276](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5276) (3.2.0.4) - - *ImageInput*: `valid_file()` now checks the file header for magic words for more reliable format detection. [#5266](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5266) (3.2.0.3) + - *ImageInput/ImageOutput*: Fix a subtle per-instance error-message leak. [#5276](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5276) (3.2.0.3) - *ImageInput*: Ignore invalid RowsPerStrip chunking. [#5300](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5300) (by @br0nzu / Dongju Lee) (3.2.0.3) - - *ImageInput*: Consolidate the decompression-bomb guard (previously TIFF-specific) into `ImageInput::check_compression_ratio()` so it can be reused uniformly by other format readers. [#5328](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5328) (3.2.0.4, 3.1.16.0) - - *ImageInput*: Apply `check_open()` and `check_compression_ratio()` consistently across the format readers that previously lacked them (cineon, dds, dpx, fits, gif, hdr, heif, ico, iff, jpeg, null, openexr, png, pnm, rla, sgi, softimage, webp, zfile), so a small malformed file can't drive a large pixel allocation before any pixel data is read; also add a `check_open()` validity test for non-negative, non-oversized tile sizes, and a batch of new decompression-bomb/extent regression tests and fuzz corpora. [#5342](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5342) - - *ImageOutput*: Don't write `thumbnail_*` metadata to formats that can't hold a thumbnail; `iconvert` was leaking these attributes from a thumbnail-capable source into the output spec even when the destination format doesn't support thumbnails (`oiiotool` already stripped them). The stripping now lives in `ImageOutput::check_open()`. [#5357](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5357) (by @jinhgkim / Jinnie Kim) - - *ImageSpec*: `ImageSpec::default_channel_names()` now validates `nchannels` before the `reserve()`-driven allocation it performs. [#5368](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5368) + - *ImageInput*: Consolidate the decompression-bomb guard (previously TIFF-specific) into `ImageInput::check_compression_ratio()` so it can be reused uniformly by other format readers. [#5328](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5328) (3.2.0.3, 3.1.16.0) + - *ImageInput*: Apply `check_open()` and `check_compression_ratio()` consistently across the format readers that previously lacked them (cineon, dds, dpx, fits, gif, hdr, heif, ico, iff, jpeg, null, openexr, png, pnm, rla, sgi, softimage, webp, zfile), so a small malformed file can't drive a large pixel allocation before any pixel data is read; also add a `check_open()` validity test for non-negative, non-oversized tile sizes, and a batch of new decompression-bomb/extent regression tests and fuzz corpora. [#5342](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5342) (3.2.0.3, 3.1.17.0) + - *ImageOutput*: Don't write `thumbnail_*` metadata to formats that can't hold a thumbnail; `iconvert` was leaking these attributes from a thumbnail-capable source into the output spec even when the destination format doesn't support thumbnails (`oiiotool` already stripped them). The stripping now lives in `ImageOutput::check_open()`. [#5357](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5357) (by @jinhgkim / Jinnie Kim) (3.2.0.3, 3.1.17.0) + - *ImageSpec*: `ImageSpec::default_channel_names()` now validates `nchannels` before the `reserve()`-driven allocation it performs. [#5368](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5368) (3.2.0.3, 3.1.17.0) - *ImageSpec*: metadata_val improved safety [#5096](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5096) (3.2.0.1, 3.1.12.0, 3.0.17.0) - *ImageSpec*: `get_string_attribute()` now correctly converts non-string attributes to string (previously it only found attributes already stored as strings) [#5161](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5161) (3.2.0.1, 3.1.13.0, 3.0.18.0) - *oiiotool*: `--buildinfo` misreported platform on MSVS [#5027](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5027) (3.2.0.0, 3.1.11.0) @@ -106,16 +125,21 @@ fmRelease 3.2 (target: Sept 2026?) -- compared to 3.1 - *oiiotool*: Make sure `oiiotool --compression` does expression substitution [#5055](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5055) (3.2.0.0, 3.1.11.0) - *oiiotool*: Better type understanding with `-i:ch=` and other related cleanup [#5056](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5056) (3.2.0.1, 3.1.12.0) - *oiiotool*: Be more cautious about implicit promotion to float when `--autocc` is used alongside explicit color space names. [#5192](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5192) (3.2.0.3, 3.1.14.0) - - *oiiotool*: Don't dereference the `ImageSpec` of a failed read. [#5377](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5377) - - *oiiotool*: A failed read (no reader could open the file) reported a generic "file not found" even when the format reader had a more specific error; now surfaces the reader's actual message, matching what `iinfo` already reported. [#5380](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5380) - - *oiiotool*: Minor safety fix: don't pass a plain string through `Strutil::format()`. [#5401](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5401) + - *oiiotool*: Don't dereference the `ImageSpec` of a failed read. [#5377](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5377) (3.2.0.3, 3.1.17.0) + - *oiiotool*: A failed read (no reader could open the file) reported a generic "file not found" even when the format reader had a more specific error; now surfaces the reader's actual message, matching what `iinfo` already reported. [#5380](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5380) (3.2.0.3, 3.1.17.0) + - *oiiotool*: Minor safety fix: don't pass a plain string through `Strutil::format()`. [#5401](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5401) (3.2.0.3, 3.1.17.0) - *texture*: Fix texture overblur with st-blur parameters [#5071](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5071) [#5080](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5080) (by @lecocqp / Pascal Lecocq) (3.2.0.1, 3.1.12.0, 3.0.17.0) + - *exif*: Support EXIF 3.0 tags (for all formats) [#4961](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/4961) (3.2.0.1) + - *exif*: Beef up corrupted Exif block error detection: used for the JPEG, PNG, WebP, and Heif readers, not just silently skipped. [#5322](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5322) (3.2.0.3, 3.1.16.0) [#5399](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5399) (3.2.0.3, 3.1.17.0) + - *icc*: Audit of the shared ICC-profile decoder (used by jpeg, png, tiff, webp, jpeg2000, psd): fix out-of-bounds pointer formation from file-controlled offsets (check the range in 64-bit first, then form the pointer), and replace every misaligned scalar field load with `memcpy`. [#5417](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5417) (3.2.0.3, 3.1.17.0) - *xmp*: Correctly parse XMP with self-closing `` elements (previously only `` end tags were recognized) [#5106](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5106) (3.2.0.1, 3.1.13.0, 3.0.18.0) + - *xmp*: Audit of XMP decode/encode (input is file-controlled via jpeg, png, tiff, psd, heif): cap decode recursion depth at 64, budget the attribute count and total payload size to stop a crafted file burning CPU/memory, and escape encoder output so an attribute value from an untrusted file cannot forge XML. [#5405](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5405) (3.2.0.3, 3.1.17.0) + - *xmp*: Fix `encode_xmp()` for aliased metadata names such as `IPTC:Rating` / `xmp:Rating`, which were silently dropped from the XMP write path. [#5108](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5108) (by @Qi-fly) (3.2.0.2, 3.1.17.0) - *bmp*: Detect corrupt files where palette doesn't match bpp [#5030](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5030) (3.2.0.0, 3.1.11.0) - *bmp*: Use check_open to guard against corrupt resolutions [#5086](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5086) (3.2.0.1, 3.1.12.0, 3.0.17.0) - *bmp*: Correctly handle the combination of greyscale + RLE compression [#5163](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5163) (3.2.0.1, 3.1.13.0, 3.0.18.0) - *bmp*: Validate scanline file position before reading, to catch corrupt files. [#5274](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5274) (3.2.0.3) - - *bmp*: `check_compression_ratio()` rejects a tiny file with implausibly high resolutions; negate the height field in 64-bit to avoid signed-overflow UB when the attacker-controlled height is `INT32_MIN`. [#5371](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5371) + - *bmp*: `check_compression_ratio()` rejects a tiny file with implausibly high resolutions; negate the height field in 64-bit to avoid signed-overflow UB when the attacker-controlled height is `INT32_MIN`. [#5371](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5371) (3.2.0.3, 3.1.17.0) - *cineon*: More robust to invalid numbers of channels and bit depths; also fixes a channel-naming counter bug and a memory leak in `init()`. CVE-2026-59181 [#5250](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5250) (3.2.0.3, 3.1.15.0, 3.0.20.0) - *cineon*: Validate bit depth against libcineon's supported set. [#5283](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5283) (3.2.0.3) - *dds*: Corruption protection: validate resolution and guard against integer overflow [#5131](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5131) (3.2.0.1, 3.1.13.0, 3.0.18.0) @@ -125,21 +149,18 @@ fmRelease 3.2 (target: Sept 2026?) -- compared to 3.1 - *dicom*: Enforce reasonable resolution limits to guard against corrupt files. [#5167](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5167) (3.2.0.3, 3.1.14.0, 3.0.19.0) - *dicom*: Null-check `DicomImage::getInterData()`/`getOutputData()`, which can return null when a corrupt frame fails to decode. [#5364](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5364) - *dpx*: Detect corrupt userbuf size with an overflow guard. [#5271](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5271) (3.2.0.3) - - *dpx*: Fix a heap overflow in the 1-channel 10-bit filled scanline swap when less than a full group of 3 packed samples remained in bounds. [#5298](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5298) (3.2.0.4, 3.1.16.0) + - *dpx*: Fix a heap overflow in the 1-channel 10-bit filled scanline swap when less than a full group of 3 packed samples remained in bounds. [#5298](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5298) (3.2.0.3, 3.1.16.0) - *ffmpeg*: 10 bit video had wrong green channel [#4935](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/4935) (by @brechtvl / Brecht Van Lommel) (3.2.0.0, 3.1.7.0) - *ffmpeg*: Align swscale output buffers. [#5301](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5301) (by @br0nzu / Dongju Lee) (3.2.0.3) + - *ffmpeg*: Audit fixes: grayscale movies read past the end of the scanline buffer (nchannels left at 3 for a 1-plane gray frame), which also makes 16-bit gray files readable for the first time; refuse a mid-stream frame whose size or pixel format differs from the `ImageSpec`; add `check_open()`/`check_compression_ratio()` at open so a tiny file can't declare a gigabyte frame; and stop feeding an uninitialized `AVPacket` to `av_read_frame()` and looping forever on a bad stream. [#5406](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5406) (3.2.0.3, 3.1.17.0) - *fits*: Fix recursion stack overflow from too many header blocks on corrupt files; convert to an iterative loop with a safety limit. CVE-2026-59156 [#5248](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5248) (3.2.0.3, 3.1.15.0, 3.0.20.0) - - *fits*: Reject a NAXIS value outside the FITS-permitted 0-999 range before using it to size internal arrays, and fail cleanly on an unsupported BITPIX rather than proceeding with a zero-sized pixel type. [#5370](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5370) + - *fits*: Reject a NAXIS value outside the FITS-permitted 0-999 range before using it to size internal arrays, and fail cleanly on an unsupported BITPIX rather than proceeding with a zero-sized pixel type. [#5370](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5370) (3.2.0.3, 3.1.17.0) - *fits*: Fix the guessed layout for 3D color images: FITS has no formal notion of color channels, and OIIO's assumption (NAXIS1 = nchannels, interleaved) doesn't match any real-world FITS software; switch to the universal convention (NAXIS3 = nchannels, one full-resolution plane per channel). [#5385](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5385) - *gif*: Preserve RGB values of transparent-indexed pixels (previously only alpha was set, zeroing the RGB channels). [#5188](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5188) (by @adskWangl / Lumina Wang) (3.2.0.3, 3.1.14.0) - *gif*: Handle empty error string from gif_lib. [#5269](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5269) (3.2.0.3) - - *gif*: Address corrupt files with bad resolutions and integer overflow. [#5257](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5257) (3.2.0.3) - - *gif*: Avoid int32 overflow in palette-split pixel-count math. [#5292](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5292) (3.2.0.3) - - *gif*: Guard against canvas index overflow. [#5299](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5299) (by @br0nzu / Dongju Lee) (3.2.0.3) - - *gif*: Reject a graphics-control extension block that declares fewer than the 4 bytes a well-formed block carries, before reading past the giflib-provided buffer. [#5366](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5366) - - *hdr*: Make the HDR reader tolerant to CR characters in the ASCII header. [#5261](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5261) (3.2.0.3, 3.1.15.0) - - *hdr*: Validate resolution to detect corrupted files. [#5256](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5256) (3.2.0.3) - - *hdr*: Resolve a format-detection conflict between the HDR and RAW readers for `.hdr` files: the rare Hasselblad raw extension collides with Radiance HDR, and with `EMBEDPLUGINS=0` giving the raw reader first crack at `.hdr` files, older libraw versions would crash trying to open a Radiance file. Remove the rarely-used `.hdr` extension from the RAW reader's extension list; the HDR reader tries first and fails safely, then the raw reader still gets a chance via `try_all_readers`. [#5339](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5339) (3.2.0.4, 3.1.16.0) + - *gif*: Hardening against corruptions: bad resolutions and integer overflow [#5257](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5257) (3.2.0.3), int32 overflow in palette-split pixel-count math.[#5292](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5292) (3.2.0.3), canvas index overflow. [#5299](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5299) (by @br0nzu / Dongju Lee) (3.2.0.3), graphics-control extension block that declares fewer than the 4 bytes a well-formed block carries. [#5366](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5366) (3.2.0.3, 3.1.17.0) + - *hdr*: Hardening: tolerate CR characters in the ASCII header.[#5261](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5261) (3.2.0.3, 3.1.15.0), validate resolution to detect corrupted files [#5256](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5256) (3.2.0.3). + - *hdr*: Resolve a format-detection conflict between the HDR and RAW readers for `.hdr` files: the rare Hasselblad raw extension collides with Radiance HDR, and with `EMBEDPLUGINS=0` giving the raw reader first crack at `.hdr` files, older libraw versions would crash trying to open a Radiance file. Remove the rarely-used `.hdr` extension from the RAW reader's extension list; the HDR reader tries first and fails safely, then the raw reader still gets a chance via `try_all_readers`. [#5339](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5339) (3.2.0.3, 3.1.16.0) - *heif*: Add IOProxy support for both input and output [#5017](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5017) (by @brechtvl / Brecht Van Lommel) (3.2.0.0, 3.1.10.0) - *heif*: Fix: Could not output AVIF when libheif has no HEVC support [#5013](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5013) (by @brechtvl / Brecht Van Lommel) (3.2.0.0, 3.1.10.0) - *heif*: Fix error saving multiple images with different bit depths [#5018](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5018) (by @brechtvl / Brecht Van Lommel) (3.2.0.0, 3.1.10.0) @@ -152,83 +173,69 @@ fmRelease 3.2 (target: Sept 2026?) -- compared to 3.1 - *iff*: Handle non-zero origin, protect against buffer overflows [#4925](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/4925) (3.2.0.0, 3.1.7.0) - *iff*: Fix allocation bug when reading 16 bit RGBA + float z (buffer size didn't account for the z channel). CVE-2026-59956 [#5251](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5251) (3.2.0.3, 3.1.15.0, 3.0.20.0) - *iff*: Detect corrupt chunk sizes, flags, and channel configurations. [#5268](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5268) (3.2.0.3) - - *iff*: Add resolution validity checking. [#5285](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5285) (3.2.0.3) - - *iff*: Reject implausible image dimensions before allocating the tile buffer. [#5284](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5284) (3.2.0.3) + - *iff*: Reject implausible image dimensions [#5284](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5284) (3.2.0.3), [#5285](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5285) (3.2.0.3) - *jpeg*: Fix wrong pointers/crashing when decoding CMYK jpeg files [#4963](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/4963) (3.2.0.0) - *jpeg*: Improved safety and error reporting for jpeg and iptc [#5081](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5081) (3.2.0.1, 3.1.12.0) - *jpeg*: More correctly handle bounds checks for malformed APP1 Exif and APP2 ICC metadata markers. [#5174](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5174) (by @ssh4net / Vlad Erium) (3.2.0.3, 3.1.14.0) - *jpeg*: Be more flexible with corrupt IPTC blocks; use `"imageinput:strict"` mode to control whether a bad IPTC block is skipped silently or fails the whole file [#5140](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5140) (3.2.0.1, 3.1.13.0) - - *jpeg*: Move `check_open()`/`check_compression_ratio()` to run before `jpeg_start_decompress()`/`jpeg_read_coefficients()`, which is too late to catch a decompression bomb for progressive JPEGs. [#5376](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5376) - - *jpeg*: Add thumbnail read support (`get_thumbnail()`) to the JPEG reader. [#5333](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5333) (by @antond-weta / Anton Dukhovnikov) (3.2.0.4) + - *jpeg*: Move `check_open()`/`check_compression_ratio()` to run before `jpeg_start_decompress()`/`jpeg_read_coefficients()`, which is too late to catch a decompression bomb for progressive JPEGs. [#5376](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5376) (3.2.0.3, 3.1.17.0) + - *jpeg*: Add thumbnail read support (`get_thumbnail()`) to the JPEG reader. [#5333](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5333) (by @antond-weta / Anton Dukhovnikov) (3.2.0.3) - *jpeg2000*: Type warning in assertion in jpeg2000output.cpp [#4952](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/4952) (3.2.0.1) - *jpeg2000*: Guard against integer overflow in buffer size computation [#5143](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5143) (3.2.0.1, 3.1.13.0, 3.0.18.0) - - *jpeg2000*: Reject corrupt component geometry and subsampling that could inflate the derived image size past the actual decoded component buffer (a heap-buffer-overflow in `copy_scanline` on a fuzzed file), and add pre-decode guards against oversized and decompression-bomb headers so a malicious file can't force a large allocation and lengthy decode before OIIO's own checks get a chance to reject it. [#5270](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5270) [#5327](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5327) (3.2.0.4, 3.1.16.0) - - *jpeg-xl*: ICC read and write for JPEG-XL files (issue 4649) [#4905](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/4905) (by @shanesmith-dwa / Shane Smith) (3.2.0.0) + - *jpeg2000*: Reject corrupt component geometry and subsampling that could inflate the derived image size past the actual decoded component buffer (a heap-buffer-overflow in `copy_scanline` on a fuzzed file), and add pre-decode guards against oversized and decompression-bomb headers so a malicious file can't force a large allocation and lengthy decode before OIIO's own checks get a chance to reject it. [#5270](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5270) [#5327](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5327) (3.2.0.3, 3.1.16.0) + - *jpeg2000*: Extend the decompression-bomb and error-handling guards to the HTJ2K reader codepath, which previously read width/height straight from the header and allocated the whole image before any check; also stop several decode loops using never-filled data after a failed read, reject zero-component files, and close the file on the ICC strict-mode error path. [#5407](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5407) (3.2.0.3) + - *jpeg2000*: Re-enable ICC-profile writing (disabled since #1452 over an OpenJPEG assertion, fixed upstream in OpenJPEG 2.5.4); the write path is compiled only when building against OpenJPEG >= 2.5.4. [#5419](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5419) (by @luna-y-kim / Luna Kim) (3.2.0.3) - *jpeg-xl*: Correctly set Quality for JPEG XL [#4933](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/4933) (3.2.0.0, 3.1.7.0) - - *jpeg-xl*: CICP read and write support for JPEG XL [#4968](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/4968) (by @brechtvl / Brecht Van Lommel) (3.2.0.0, 3.1.9.0) - - *jpeg-xl*: Extend JXL CICP support to include P3 / color primaries 12 [#5054](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5054) (by @shanesmith-dwa / Shane Smith) (3.2.0.0, 3.1.11.0) - - *jpeg-xl*: Enforce format resolution limits for better detection of corrupt or invalid files. [#5202](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5202) (by @hkgulka / Hannah Gulka) (3.2.0.3, 3.1.14.0) - - *jpeg-xl*: Prevent reader from loading or allocating memory for arbitrarily large non-image files. [#5203](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5203) (by @maxwelliverson / Maxwell Iverson) (3.2.0.3, 3.1.14.0, 3.0.19.0) - - *jpeg-xl*: Guard against corrupt basic-info dimensions early. [#5305](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5305) (3.2.0.3) - - *jpeg-xl*: Overflow protection for the out-buffer-size sanity check (previously computed as `uint32`); check the result of `m_io->read()`, previously uncaptured, so a short read no longer hands libjxl an uninitialized buffer tail. [#5378](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5378) + - *jpeg-xl*: Add the ability to read and write ICC profiles [#4905](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/4905) (by @shanesmith-dwa / Shane Smith) (3.2.0.0), and CICP [#4968](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/4968) (by @brechtvl / Brecht Van Lommel) (3.2.0.0, 3.1.9.0) [#5054](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5054) (by @shanesmith-dwa / Shane Smith) (3.2.0.0, 3.1.11.0) + - *jpeg-xl*: Enforce format resolution and memory limits for better detection of corrupt or invalid files. [#5202](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5202) (by @hkgulka / Hannah Gulka) (3.2.0.3, 3.1.14.0) [#5203](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5203) (by @maxwelliverson / Maxwell Iverson) (3.2.0.3, 3.1.14.0, 3.0.19.0) [#5305](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5305) (3.2.0.3) + - *jpeg-xl*: Overflow protection for various operations, better eror detection [#5378](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5378) (3.2.0.3, 3.1.17.0) - *openexr*: Support for idManifest and deepImageState (experimental) [#4877](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/4877) (3.2.0.0, 3.1.7.0) - *openexr*: ACES Container hint for exr outputs [#4907](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/4907) (by @Glowies / Oktay Comu) (3.2.0.0, 3.1.7.0) - *openexr*: Write OpenEXR colorInteropID metadata based on oiio:ColorSpace [#4967](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/4967) (by @brechtvl / Brecht Van Lommel) (3.0.14.0, 3.2.0.0) - *openexr*: Improve attribute translation rules [#4946](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/4946) (3.2.0.0) - *openexr*: ACES container writes colorInteropId instead of colorInteropID [#4966](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/4966) (by @brechtvl / Brecht Van Lommel) (3.2.0.0) - *openexr*: Add `check_open` to `exrinput_c`. [#5280](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5280) (3.2.0.3) - - *openexr*: Fix an out-of-bounds write when reading partial edge tiles of a tiled EXR whose dimensions aren't a multiple of the tile size: both the Core and classic readers padded the destination row stride up to a whole number of tiles instead of using the caller's actual rectangle width, overrunning the buffer on the last (partial) tile column. CVE-2026-63422 [#5295](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5295) (3.2.0.4, 3.1.16.0, 3.0.21.0) - - *openexr*: Converting an image whose channels have differing native integer depths (e.g. a Softimage PIC with a 16-bit R and an 8-bit G channel) to OpenEXR produced garbage pixels because the source bytes were copied straight into the half channels and reinterpreted instead of rescaled. [#5340](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5340) - - *openexr*: Read support for the OpenEXR `preview` attribute (thumbnail) per subimage, exposing a latent `ImageRec` bug since EXR was the first multi-subimage format to support thumbnails. [#5374](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5374) (by @jinhgkim / Jinnie Kim) + - *openexr*: Fix an out-of-bounds write when reading partial edge tiles of a tiled EXR whose dimensions aren't a multiple of the tile size. CVE-2026-63422 [#5295](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5295) (3.2.0.3, 3.1.16.0, 3.0.21.0) + - *openexr*: Fix writing an image whose channels have differing native integer depths. [#5340](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5340) (3.2.0.3, 3.1.17.0) + - *openvdb*: Audit fixes: add a `check_open()` extent check from the grid bbox metadata, move dense-window math to 64-bit, null-check `gridPtrCast<>` and `readGrid()`, guard the OpenVDB tree walk and clamp exception-message text built from file data, and reset reader state on open failure and re-open. [#5416](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5416) (3.2.0.3) - *png*: We were not correctly suppressing hint metadata [#4983](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/4983) (3.2.0.0) - *pnm*: Prevent reader from loading or allocating memory for arbitrarily large non-image files. [#5203](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5203) (by @maxwelliverson / Maxwell Iverson) (3.2.0.3, 3.1.14.0, 3.0.19.0) - - *pnm*: Use 64-bit scanline math to avoid an integer overflow; hoist an invariant bytes-per-scanline computation out of the read loop. [#5344](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5344) + - *pnm*: Use 64-bit scanline math to avoid an integer overflow; hoist an invariant bytes-per-scanline computation out of the read loop. [#5344](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5344) (3.2.0.3, 3.1.17.0) - *psd*: Fixes against corrupt files with better validation [#5089](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5089) (3.2.0.1, 3.1.12.0, 3.0.17.0) - *psd*: Fix indexed transparency. [#5177](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5177) (by @ssh4net / Vlad Erium) (3.2.0.3, 3.1.14.0) - *psd*: Validate `color_mode` before the RawColor early return. [#5282](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5282) (3.2.0.3) - - *psd*: Detect implausibly large ICC, Exif, and XMP blocks before allocating. [#5288](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5288) (3.2.0.3) - - *psd*: Identify corruptions of layer resolutions and EOF in strings. [#5259](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5259) (3.2.0.3) - - *psd*: Guard row interleave bounds on corrupt data, failing gracefully with an error instead of risking out-of-bounds access when interleaving scanlines from malformed files. CVE-2026-63420 [#5307](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5307) (3.2.0.4, 3.1.16.0, 3.0.21.0) - - *psd*: Avoid signed overflow computing layer/mask extents on files with large or negative layer offsets (UBSan-flagged on a fuzzed file). Retype the affected rect fields as `int32_t`, matching what they actually hold, and widen to `int64_t` before subtracting so the computation can't overflow. [#5306](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5306) (3.2.0.4, 3.1.16.0) - - *psd*: Add open-time hardening: `check_open()` on the composite spec enforces the global `limits:*` policy in addition to existing per-dimension validation, and `check_compression_ratio()` rejects a tiny file that declares a huge uncompressed composite before any pixel read (decompression bomb). [#5348](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5348) - - *ptex*: More comprehensive `valid_file()` and header validation: previously there was no `PtexInput::valid_file()`, and `open()` handed off directly to the Ptex library with little validity checking, risking crashes or OOM on corrupted files. Ptex's fixed 64-byte header is now inspected up front to reject many forms of corruption before Ptex itself gets involved. [#5265](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5265) (3.2.0.4, 3.1.16.0) - - *ptex*: Null-check `PtexTexture::getData()`/`PtexFaceData::getTile()`, which can return null when the reader hits an error during lazy per-face reads (a corrupt or truncated block the header validator can't catch); previously dereferenced unchecked, crashing on such files. [#5365](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5365) + - *psd*: Guard row interleave bounds on corrupt data, failing gracefully with an error instead of risking out-of-bounds access when interleaving scanlines from malformed files. CVE-2026-63420 [#5307](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5307) (3.2.0.3, 3.1.16.0, 3.0.21.0) + - *psd*: Hardening / corrupt image handling: Detect implausibly large ICC, Exif, and XMP blocks before allocating. [#5288](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5288) (3.2.0.3), corruptions of layer resolutions and EOF in strings. [#5259](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5259) (3.2.0.3), avoid signed overflow computing layer/mask extents [#5306](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5306) (3.2.0.3, 3.1.16.0), check reasonable resolution limits and plausible compression ratio [#5348](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5348) (3.2.0.3, 3.1.17.0). + - *ptex*: More comprehensive and faster `valid_file()` and header validation. [#5265](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5265) (3.2.0.3, 3.1.16.0) + - *ptex*: Null-check `PtexTexture::getData()`/`PtexFaceData::getTile()`, which can return null when the reader hits an error. [#5365](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5365) (3.2.0.3, 3.1.17.0) - *raw*: Apply the LibRaw memory cap before unpack to prevent OOM. [#5275](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5275) (3.2.0.3) - - *raw*: Reject decompression-bomb / corrupt headers before unpack: a pre-unpack guard rejects when the declared raw data size dwarfs the actual file size by more than 10000x, plus a `check_open()` call enforcing OIIO's standard resolution/imagesize limits and LibRaw's own per-dimension and per-channel caps. [#5312](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5312) (3.2.0.4, 3.1.16.0) - - *raw*: Pass a new `raw:bad_pixels` hint (a filename of bad-pixel data) through to LibRaw. [#5323](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5323) (by @antond-weta / Anton Dukhovnikov) (3.2.0.4, 3.1.16.0) - - *raw*: Fixes and improvements to thumbnail functionality in the raw reader, including new `raw:thumbnail_index` and `raw:thumbnail_sort` hints to select a specific thumbnail when a file has more than one. [#5334](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5334) (by @antond-weta / Anton Dukhovnikov) (3.2.0.4) - - *raw*: Allow vector types in multi-value hints: white-balance multipliers can now be given as a single `float4` in addition to four floats, and cropbox/greybox as `int2` box in addition to four ints. [#5386](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5386) (by @antond-weta / Anton Dukhovnikov) - - *rla*: Lots of additional validity checking and safety [#5094](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5094) (3.2.0.1, 3.1.12.0, 3.0.17.0) - - *rla*: Harden against corrupted files: guard against RLE buffer overruns and improve seek robustness [#5153](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5153) [#5172](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5172) (3.2.0.1, 3.1.13.0, 3.0.18.0) - - *rla*: Better detection of corrupted RLE encoding: guard against a buffer overrun when the RLE count exceeds the number of encoded bytes remaining. [#5337](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5337) [#5258](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5258) (3.2.0.4, 3.1.16.0) - - *rla*: RLA subimages are concatenated via each header's `NextOffset`; nothing previously required it to advance, so a file pointing it at itself or backwards supplied subimages endlessly. Require `NextOffset` to point past the current header. [#5403](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5403) + - *raw*: Reject decompression-bomb / corrupt headers before unpack. [#5312](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5312) (3.2.0.3, 3.1.16.0) + - *raw*: Pass a new `raw:bad_pixels` hint (a filename of bad-pixel data) through to LibRaw. [#5323](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5323) (by @antond-weta / Anton Dukhovnikov) (3.2.0.3, 3.1.16.0) + - *raw*: Fixes to the undebayered (`raw:Demosaic=none`) path: flip codes 1/2/4/7 fell through the mapping and returned the caller's buffer uninitialized (a heap disclosure), flip 3 disagreed with the debayered path, `raw_image` was indexed from header geometry in 32-bit; the flip mapping is now bitwise and the index is 64-bit and bounded against LibRaw's actual allocation. Also handle `raw_bps` of 0 (some Phase One headers) defeating the bomb guard. [#5415](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5415) (3.2.0.3, 3.1.17.0) + - *raw*: Fixes and improvements to thumbnail functionality in the raw reader, including new `raw:thumbnail_index` and `raw:thumbnail_sort` hints to select a specific thumbnail when a file has more than one. [#5334](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5334) (by @antond-weta / Anton Dukhovnikov) (3.2.0.3, 3.1.17.0) + - *raw*: Allow vector types in multi-value hints: white-balance multipliers can now be given as a single `float4` in addition to four floats, and cropbox/greybox as `int2` box in addition to four ints. [#5386](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5386) (by @antond-weta / Anton Dukhovnikov) (3.2.0.3, 3.1.17.0) + - *rla*: Lots of additional validity checking and safety [#5094](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5094) (3.2.0.1, 3.1.12.0, 3.0.17.0), [#5153](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5153), [#5172](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5172) (3.2.0.1, 3.1.13.0, 3.0.18.0), [#5337](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5337) [#5258](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5258) (3.2.0.3, 3.1.16.0) + - *rla*: RLA subimages are concatenated via each header's `NextOffset`; nothing previously required it to advance, so a file pointing it at itself or backwards supplied subimages endlessly. Require `NextOffset` to point past the current header. [#5403](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5403) (3.2.0.3, 3.1.17.0) - *sgi*: Implement RLE encoding support for output [#4990](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/4990) (by @jessey-git / Jesse Yurkovich) (3.2.0.0) - *sgi*: Better detection of corrupt RLE info that could overflow [#5141](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5141) (3.2.0.1, 3.1.13.0, 3.0.18.0) - *sgi*: Size RLE offset tables by spec dimensions to prevent out-of-bounds access on corrupt headers. [#5279](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5279) (3.2.0.3) - *sgi*: Prevent an oversized-allocation crash from a bogus RLE length/offset table. [#5303](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5303) (3.2.0.3) - - *sgi*: Deal with corrupt 16-bit RLE runs that have odd byte counts. [#5321](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5321) (3.2.0.4, 3.1.16.0) - - *softimage*: Multiple hardening fixes against corrupted input: prevent RLE buffer overruns [#5142](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5142), general hardening [#5155](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5155), fix malformed channel packets [#5156](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5156) (3.2.0.1, 3.1.13.0, 3.0.18.0) - - *softimage*: Fix possible small allocation leak in RLE decoder. [#5182](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5182) (3.2.0.3, 3.1.14.0) - - *softimage*: Support channel packets with differing bit depths (e.g. 16-bit R mixed with 8-bit G in one file), which previously wrote past the end of the scanline buffer. The reader now always exposes one uniform pixel format -- the widest depth among the file's packets -- and promotes narrower channels to it on read via exact bit replication. [#5309](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5309) (3.2.0.4, 3.1.16.0) - - *targa*: Protection against corrupt, mis-sized palette; fix misunderstanding of non-zero palette start index [#5165](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5165) (3.2.0.1, 3.1.13.0, 3.0.18.0) - - *targa*: Reject implausible image dimensions before allocating. [#5293](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5293) (3.2.0.3) + - *sgi*: Deal with corrupt 16-bit RLE runs that have odd byte counts. [#5321](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5321) (3.2.0.3, 3.1.16.0) + - *softimage*: Multiple hardening fixes against corrupted input: prevent RLE buffer overruns [#5142](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5142), general hardening [#5155](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5155), fix malformed channel packets [#5156](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5156) (3.2.0.1, 3.1.13.0, 3.0.18.0), small allocation leak in RLE decoder [#5182](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5182) (3.2.0.3, 3.1.14.0). + - *softimage*: Support channel packets with differing bit depths (e.g. 16-bit R mixed with 8-bit G in one file), which previously wrote past the end of the scanline buffer. The reader now always exposes one uniform pixel format -- the widest depth among the file's packets -- and promotes narrower channels to it on read via exact bit replication. [#5309](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5309) (3.2.0.3, 3.1.16.0) + - *targa*: Corruption protection against mis-sized palette; fix misunderstanding of non-zero palette start index [#5165](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5165) (3.2.0.1, 3.1.13.0, 3.0.18.0), reject implausible image dimensions before allocating. [#5293](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5293) (3.2.0.3) - *tiff*: Fix TIFF output crash for multi-count Exif metadata [#5035](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5035) (3.2.0.0, 3.1.11.0) - - *tiff*: Improve TIFF robustness for non-matching tag/metadata types [#5036](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5036) (3.2.0.0, 3.1.11.0) - *tiff*: Correctly read TIFF EXIF fields for ExifVersion and FlashPixVersion [#5045](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5045) (3.2.0.0, 3.1.11.0) - *tiff*: Support for GPS metadata fields (latitude, longitude, altitude, timestamp, and related EXIF GPS fields) when using libTIFF 4.2+. [#5050](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5050) (3.2.0.1, 3.1.12.0) - - *tiff*: Fix buffer overrun and improve error reporting [#5082](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5082), fix wrong number of values passed to `invert_photometric` [#5083](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5083), check for invalid bit depth in palette images [#5091](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5091) (3.2.0.1, 3.1.12.0) - - *tiff*: Care with missing rowsperstrip (assume whole image is one strip per spec) [#5160](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5160); guard against corrupt XMP blocks with TIFF-related tag names [#5162](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5162) (3.2.0.1, 3.1.13.0, 3.0.18.0) - *tiff*: The "tiff:half" hint was only applying to the first MIP level. [#5240](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5240) (3.2.0.3, 3.1.15.0) - - *tiff*: Avoid use-after-scope in multithreaded scanline reads. [#5294](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5294) (3.2.0.3) - - *tiff*: Fix heap overflow when unpacking sub-8-bit contiguous CMYK samples. [#5296](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5296) (3.2.0.3) - - *tiff*: Fix some int32 overflows, and guard against decompression bombs. [#5319](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5319) (3.2.0.4, 3.1.16.0) - - *tiff*: In the raw-strip read path, bail out of the strip loop when `TIFFReadRawStrip()` returns a negative size instead of running the decompress on it, matching the existing tiled-read behavior. [#5336](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5336) + - *tiff*: Hardinging / various corruption detection: non-matching tag/metadata types [#5036](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5036) (3.2.0.0, 3.1.11.0), Fix buffer overrun and improve error reporting [#5082](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5082), fix wrong number of values passed to `invert_photometric` [#5083](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5083), check for invalid bit depth in palette images [#5091](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5091) (3.2.0.1, 3.1.12.0), care with missing rowsperstrip (assume whole image is one strip per spec) [#5160](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5160); guard against corrupt XMP blocks with TIFF-related tag names [#5162](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5162) (3.2.0.1, 3.1.13.0, 3.0.18.0),aAvoid use-after-scope in multithreaded scanline reads [#5294](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5294) (3.2.0.3), heap overflow when unpacking sub-8-bit contiguous CMYK samples. [#5296](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5296) (3.2.0.3), int32 overflows fixes and guard against decompression bombs [#5319](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5319) (3.2.0.3, 3.1.16.0), negative strip size [#5336](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5336) (3.2.0.3, 3.1.17.0). - *webp*: Allow out-of-order scanlines when writing webp [#4973](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/4973) (by @pmady / Pavan Madduri) (3.2.0.0) - *webp*: Use correct resolution limits for WebpOutput::open [#5016](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5016) (by @jessey-git / Jesse Yurkovich) (3.2.0.0, 3.1.10.0) - *webp*: Fix missing oiio:UnassociatedAlpha on input [#5020](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5020) (by @brechtvl / Brecht Van Lommel) (3.2.0.0, 3.1.10.0) - *webp*: Fix bounds handling for WebP EXIF metadata chunks. [#5175](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5175) (by @ssh4net / Vlad Erium) (3.2.0.3, 3.1.14.0) - *webp*: Enforce format resolution limits for better detection of corrupt or invalid files. [#5202](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5202) (by @hkgulka / Hannah Gulka) (3.2.0.3, 3.1.14.0) - - *zfile*: Check `gzread()`'s return value when reading the header and each scanline; a truncated or corrupt gzip file was previously processed with whatever happened to be in the buffer. [#5372](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5372) + - *webp*: `valid_file()` now checks the file header for magic words for more reliable format detection. [#5266](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5266) (3.2.0.3) + - *zfile*: Check `gzread()`'s return value when reading the header and each scanline; a truncated or corrupt gzip file was previously processed with whatever happened to be in the buffer. [#5372](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5372) (3.2.0.3, 3.1.17.0) ### 🔧 Internals and developer goodies - *fix*: Several bug fixes related to internal use of image_span [#5004](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5004) (3.2.0.0, 3.1.10.0) @@ -237,17 +244,22 @@ fmRelease 3.2 (target: Sept 2026?) -- compared to 3.1 - *dassert.h*: OIIO_CONTRACT_ASSERT and other hardening improvements [#5006](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5006) (3.2.0.0) - *filesystem.h*: Speedup to detect the existence of files on Windows [#4977](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/4977) (by @wingfiring / JacksonSun-adsk) (3.2.0.0) - *filesystem.h*: Overflow-safe bounds check in `IOMemReader::pread`. [#5262](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5262) (3.2.0.3) - - *filesystem.h*: Use 64-bit file offsets (`_fseeki64`/`_ftelli64`) on all Windows builds, including MinGW, which previously fell back to `fseeko`/`ftello` with 32-bit offsets. [#5354](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5354) (by @Maxi741cv / Mixie) (3.2.0.4) + - *filesystem.h*: Use 64-bit file offsets (`_fseeki64`/`_ftelli64`) on all Windows builds, including MinGW, which previously fell back to `fseeko`/`ftello` with 32-bit offsets. [#5354](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5354) (by @Maxi741cv / Mixie) (3.2.0.3, 3.1.17.0) - *filesystem.h*: Speedup various file system operations on Windows using native APIs. [#5199](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5199) (by @adskWangl / Lumina Wang) (3.2.0.3, 3.1.14.0) - *fmath.h*: Address fmath.h warning with ispow2 [#5033](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5033) (3.2.0.0) - *fmath.h*: Fix typo in `convert_type` default argument, `min()` should have been `max()`. [#5227](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5227) (by @luna-y-kim / Luna Kim) (3.2.0.3, 3.1.15.0) - *fmath.h*: `degrees()` and `radians()` are now `constexpr`. [#5151](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5151) (3.2.0.1, 3.1.13.0) - *platform.h*: `OIIO_NODISCARD_ERROR_ENABLE` is now always on when building OIIO itself, enforcing that all annotated return values are checked [#5145](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5145) (3.2.0.1, 3.1.13.0) - *platform.h*: Additional contract-safety hardening: `OIIO_NODISCARD` on fmath.h integer and float helpers [#5221](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5221) (by @luna-y-kim / Luna Kim), extra contract asserts for `span` and `string_view` [#5224](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5224). (3.2.0.3) - - *simd.h*: Fix a NEON `vfloat4::load(values,n)` heap-buffer-overflow: the branch loaded all 4 lanes with `vld1q_f32` and then zeroed the unwanted ones, reading up to 12 bytes past the caller's buffer for `n<4`. Switch on `n` before loading, matching the (correct) SSE branch. [#5404](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5404) + - *simd.h*: Fix a NEON `vfloat4::load(values,n)` heap-buffer-overflow: the branch loaded all 4 lanes with `vld1q_f32` and then zeroed the unwanted ones, reading up to 12 bytes past the caller's buffer for `n<4`. Switch on `n` before loading, matching the (correct) SSE branch. [#5404](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5404) (3.2.0.3, 3.1.17.0) + - *simd.h*: Fill in NEON vector paths that previously fell through to scalar code on aarch64: `exp()`/`log()` (2.5x faster), narrow-integer vector loads, `ceil`/`floor`/`round`/`ifloor`, `transpose`, `vreduce_add`, and `matrix44 * vfloat4`. [#5412](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5412) (3.2.0.3, 3.1.17.0) + - *simd.h*: Treat Windows ARM64EC builds as ARM so the NEON code path is taken. [#5369](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5369) (by @wayne-arnold-adsk / Wayne Arnold) (3.2.0.3, 3.1.17.0) + - *threads.h*: Annotate `spin_mutex` and `spin_rw_mutex` for ThreadSanitizer. [#5429](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5429) (by @NathanGray-ChurchillNavigation / Nathan Gray) (3.2.0.3, 3.1.17.0) - *typedesc.h*: New TypeURational type definition is like TypeRational, but with unsigned components. [#5036](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5036) [#5057](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5057) (3.2.0.0, 3.1.11.0) - *ustring.h*: Allow freeing the ustring table via `OIIO::attribute("ustring:cleanup", 1)` or env var `OIIO_USTRING_CLEANUP=1`, useful for suppressing false positives in memory leak detection tools. [#5213](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5213) (3.2.0.3, 3.1.14.0) - *cleanup*: Remove some old files that had no remaining use. [#5234](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5234) (3.2.0.3) + - *int*: OpenColorIO exception-safety: catch `std::exception` rather than only `OCIO::Exception`, so an exception thrown by a system library beneath OCIO (not an `OCIO::Exception`) is still caught. [#5428](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5428) (3.2.0.3, 3.1.17.0) + - *int*: Minor libraw-related cleanup: rename the internal thumbnail error helper to `thumb_errorfmt`, and drop obsolete reference outputs for unsupported old LibRaw versions. [#5425](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5425) (3.2.0.3) ### 🏗 Build/test/CI and platform ports * OIIO's CMake build system and scripts: @@ -261,7 +273,6 @@ fmRelease 3.2 (target: Sept 2026?) -- compared to 3.1 - *build*: Use quote to avoid error if variable is empty [#5053](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5053) (3.2.0.0, 3.1.11.0) - *build*: Improve security by pinning auto-build dependencies by hash [#5076](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5076) (3.2.0.1, 3.1.12.0) - *build*: Include idiff in the python wheels we build [#5104](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5104) (3.2.0.1, 3.1.12.0, 3.0.17.0) - - *build*: Begin nanobind migration for Python bindings (pybind11 still works); new `OIIO_PYTHON_BINDINGS_BACKEND` CMake option controls whether to build `pybind11`, `nanobind`, or `both` [#5084](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5084) (by @soswow / Aleksandr Motsjonov) (3.2.0.1) - *build*: Makefile wrapper fix to properly quote test regex [#5146](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5146) (3.2.0.1, 3.1.13.0, 3.0.18.0); minor debugging fixes to dependency_utils [#5128](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5128) (3.2.0.1, 3.1.13.0) - *build*: Remove `-Wno-unused-result` from gcc compile options, surfacing more potential warnings. [#5214](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5214) (by @luna-y-kim / Luna Kim) (3.2.0.3, 3.1.14.0) - *build*: Add support for gcc-16 [#5225](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5225) and C++26 [#5230](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5230), each tested in CI. (3.2.0.3, 3.1.15.0) @@ -270,48 +281,40 @@ fmRelease 3.2 (target: Sept 2026?) -- compared to 3.1 - *build*: OpenJPH auto-build and better exception handling. [#5247](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5247) (3.2.0.3) - *build*: Fix certain clang varieties warning about giflib headers. [#5263](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5263) (3.2.0.3) - *build*: Support building for WebAssembly (wasm). [#5304](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5304) (by @nickdademo / Nick D'Ademo) (3.2.0.3) - - *build*: FORTIFY and sanitizer/debug builds are not compatible; don't allow enabling both together. [#5318](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5318) (3.2.0.4) - - *build*: Fix `EMBEDPLUGINS=0`, which had been broken for a long time without being caught because the CI variant meant to test it wasn't actually doing so (it tried to set it via environment variable, which didn't work until this patch). Also convert several build options from `option()` to our `set_option()`, allowing them to be overridden by environment variables of the same name, handy for CI variants. [#5272](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5272) (3.2.0.4, 3.1.16.0) - - *cmake*: Guard against a previously auto-built static libtiff package whose exported `TIFF::tiff` target references `Deflate::Deflate` without importing or defining that target, which broke configuration. [#5313](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5313) (by @zachlewis / Zach Lewis) - - *cmake*: Fix `CLANG_FORMAT_INCLUDES` targets, which had silently formatted only headers and skipped every `.cpp` file and `testsuite/` (CI wasn't affected since it runs a separate script). [#5373](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5373) (by @jinhgkim / Jinnie Kim) - - *build*: Fix a Windows unity-build declaration mismatch: `exrinput.cpp`'s forward declaration lacked `OIIO_EXPORT`, which the definition in `exrinput_c.cpp` has, causing an MSVC error when the two are combined into one translation unit. [#5360](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5360) + - *build*: FORTIFY and sanitizer/debug builds are not compatible; don't allow enabling both together. [#5318](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5318) (3.2.0.3) + - *build*: Fix `EMBEDPLUGINS=0`, which had been broken for a long time without being caught because the CI variant meant to test it wasn't actually doing so (it tried to set it via environment variable, which didn't work until this patch). Also convert several build options from `option()` to our `set_option()`, allowing them to be overridden by environment variables of the same name, handy for CI variants. [#5272](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5272) (3.2.0.3, 3.1.16.0) + - *cmake*: Guard against a previously auto-built static libtiff package whose exported `TIFF::tiff` target references `Deflate::Deflate` without importing or defining that target, which broke configuration. [#5313](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5313) (by @zachlewis / Zach Lewis) (3.2.0.3, 3.1.17.0) + - *cmake*: Fix `CLANG_FORMAT_INCLUDES` targets, which had silently formatted only headers and skipped every `.cpp` file and `testsuite/` (CI wasn't affected since it runs a separate script). [#5373](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5373) (by @jinhgkim / Jinnie Kim) (3.2.0.3, 3.1.17.0) + - *build*: Fix a Windows unity-build declaration mismatch: `exrinput.cpp`'s forward declaration lacked `OIIO_EXPORT`, which the definition in `exrinput_c.cpp` has, causing an MSVC error when the two are combined into one translation unit. [#5360](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5360) (3.2.0.3, 3.1.17.0) + - *build*: Dependency auto-build reliability fixes: clear stale find-package cache entries before the post-build re-find so a rejected too-old system package can't leak into the build [#5410](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5410); check sub-build exit codes and save/print the real compiler output (`deps/-build.log`) instead of failing silently much later, and fix a never-working local-dependency include path [#5423](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5423); and use `NO_FP_RANGE_CHECK` for nanobind so its strict exported config stops rejecting a valid version range [#5436](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5436). (3.2.0.3) + - *build*: Raised the project's clang-format standard from clang-format 17 to clang-format 22 (done just before the 3.2 branch, as every few years, so main and the release family stay in sync), reformatting the code and bringing a few previously-excluded headers (`filesystem.h`, `imagebufalgo.h`, `string_view.h`, `thread.h`) under clang-format. [#5421](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5421) [#5426](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5426) (3.2.0.3) * Dependency and platform support: - - *deps*: Additional auto-build capabilities for dependencies that are not found: GIF library [#4921](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/4921) (by @vangeliq / Valery Angelique), OpenJPEG [#4911](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/4911) (by @grdanny / Danny Greenstein) (3.2.0.0, 3.1.7.0) - - *deps*: Disable LERC in libTIFF local build script [#4957](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/4957) (by @lji-ilm / LI JI) (3.2.0.0, 3.1.8.0) - - *deps*: Test against libraw 0.21.5 [#4988](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/4988) (3.2.0.0, 3.1.9.0) + - *deps*: Several minimum dependency versions were raised: CMake 3.23 (was 3.18) [#5394](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5394), fmt 9.0 (was 7.0) [#5041](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5041), libjpeg 9 (was 8; libjpeg-turbo 2.1+ still satisfies this) [#5432](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5432), libtiff 4.1 (was 4.0) [#5414](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5414), LibRaw 0.21.0 (was 0.20.0) [#5389](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5389), PugiXML 1.11 (was 1.8) [#5246](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5246), DCMTK 3.6.2 (was 3.6.1; optional, DICOM support) [#5438](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5438), R3D SDK to 9.2.0 [#5148](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5148) (by @1div0 / Peter Kovář) (3.2.0.1, 3.1.13.0). For their security fixes, libtiff 4.5+ [#5277](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5277) and LibRaw 0.21.3+ [#5383](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5383) are recommended. (3.2.0.0-3.2.0.3) + - *deps*: Support / testing for new dependency and toolchain versions: libraw 0.21.5 [#4988](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/4988) (3.2.0.0, 3.1.9.0), Libheif 1.21, 1.22 [#4992](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/4992) [#5031](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5031) (3.2.0.0, 3.1.11.0) [#5212](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5212) (3.2.0.3, 3.1.14.0, 3.1.10.0), clang 22.1 [#5067](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5067) (3.2.0.1, 3.1.12.0, 3.0.19.0) + - *deps*: New dependency auto-build abilities added for the GIF library [#4921](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/4921) (by @vangeliq / Valery Angelique) and OpenJPEG [#4911](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/4911) (by @grdanny / Danny Greenstein) (3.2.0.0-3.2.0.3) + - *deps*: Dependency auto-build default versions were raised for OpenColorIO (2.5.1) [#5022](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5022) (by @zachlewis / Zach Lewis), pystring (1.2.0) [#5235](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5235), PugiXML's vendored copy [#5246](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5246) (3.2.0.0-3.2.0.3), libuhdr to 1.5.1 and preferring a static build when found. [#5418](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5418) (3.2.0.3) + - *deps: Support OpenCV 5 by locating it via its exported CMake config, and add a standalone header smoke test for the `imagebufalgo_opencv.h` interop, which previously had no test coverage at all. [#5326](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5326) (3.2.0.3, 3.1.16.0, 3.0.21.0) - *build/platforms*: Fix building on OpenBSD [#5001](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5001) (by @brad0 / Brad Smith) (3.2.0.0, 3.1.10.0) - - *build/deps*: Bump OCIO auto-build ver to 2.5.1 [#5022](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5022) (by @zachlewis / Zach Lewis) (3.2.0.0, 3.1.10.0) + - *deps*: Disable LERC in libTIFF local build script [#4957](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/4957) (by @lji-ilm / LI JI) (3.2.0.0, 3.1.8.0) - *build/deps*: Use libheif exported config if available [#5012](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5012) (3.2.0.0, 3.1.10.0) - - *build/deps*: Libheif 1.21 support [#4992](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/4992) (3.2.0.0, 3.1.10.0) - - *deps*: Raise minimum fmt library version to 9.0 [#5041](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5041) (3.2.0.0) - - *deps*: Test building with clang 22.1, fix warnings uncovered [#5067](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5067) (3.2.0.1, 3.1.12.0, 3.0.19.0) - *deps*: Address new pybind11 float/int auto-conversion behavior [#5058](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5058) (3.2.0.1, 3.1.12.0) - *build/win*: Embed manifest in OIIO executables to enable long path handling [#5066](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5066) (by @nrusch / Nathan Rusch) (3.2.0.1, 3.1.12.0) - - *deps*: Update R3D SDK to version 9.2.0 [#5148](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5148) (by @1div0 / Peter Kovář) (3.2.0.1, 3.1.13.0) - - *deps*: Recommend libtiff 4.5+ for its security fixes. [#5277](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5277) (3.2.0.3) - - *deps*: Auto-build pystring updated to v1.2.0. [#5235](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5235) (3.2.0.3, 3.1.14.1, 3.0.19.1) - - *deps*: New PugiXML minimum version 1.11; rely on its CMake config now, and bump the auto-build vendored version. [#5246](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5246) (3.2.0.3) - - *opencv*: Support OpenCV 5 by locating it via its exported CMake config, and add a standalone header smoke test for the `imagebufalgo_opencv.h` interop, which previously had no test coverage at all. [#5326](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5326) (3.2.0.4, 3.1.16.0, 3.0.21.0) - - deps: Raised minimum LibRaw to 0.21.0 (was 0.20.0) [#5389](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5389), recommended minimum of at least 0.21.3 for its security fixes [#5383](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5383). * Testing and Continuous integration (CI) systems: - *tests*: Image_span_test reduce benchmark load for debug and CI renders [#4951](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/4951) (3.2.0.0, 3.1.8.0) - *tests*: Add new ref image for jpeg test [#5007](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5007) (3.2.0.0, 3.1.10.0) - *tests*: Adjust test comparision thresholds for Mac ARM [#5026](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5026) (3.2.0.0, 3.1.11.0) - - *tests*: Add testsuite/heif ref output for libheif 1.21 + avif support [#5031](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5031) (3.2.0.0, 3.1.11.0) - *tests*: Imageinout_test: add benchmark of read and write speed vs tile size [#5037](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5037) (3.2.0.0, 3.1.11.0) - *tests*: New ref outputs for tiff-misc, heif no-avif, and ffmpeg 8.1 cases [#5075](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5075) [#5079](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5079) [#5099](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5099) [#5112](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5112) (3.2.0.1) - *test*: Improve Python test coverage. [#5260](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5260) (by @soswow / Aleksandr Motsjonov) (3.2.0.3) - *test*: Update the `getattribute` one-arg test for the unified Python bindings (a default type argument added by [#5254](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5254) changed the one-arg call's behavior). [#5308](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5308) (3.2.0.3) - - *tests*: New ref image for libheif 1.22. [#5212](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5212) (3.2.0.3, 3.1.14.0) - *ci*: Python wheel building improvements: use ccache [#4924](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/4924) (by @lgritz / Larry Gritz), unbreak wheel release + other enhancements pt 1 [#4937](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/4937) (by @zachlewis / Zach Lewis) (3.2.0.0, 3.1.7.0) + - *ci*: Try python 3.13 to fix Mac breakage on CI [#4970](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/4970) (3.2.0.0) + - *ci*: Don't run non-wheel workflows when only pyproject.toml changes [#4997](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/4997) (3.2.0.0, 3.1.10.0) + - *ci*: Windows runners switched which python version they had [#5010](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5010) (3.2.0.0, 3.1.10.0) - *ci*: Simplify ci workflow by using build-steps for old aswf containers, too [#4932](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/4932) (3.2.0.0, 3.1.7.0) - *ci*: We were not correctly setting fmt version from job options [#4939](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/4939) (3.2.0.0, 3.1.7.0) - *ci*: Emergency fix change deprecated sonarqube action [#4969](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/4969) (3.2.0.0) - - *ci*: Try python 3.13 to fix Mac breakage on CI [#4970](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/4970) (3.2.0.0) - - *ci*: Freetype adjustments [#4999](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/4999) (3.2.0.0) - *ci*: Speed up macos15 intel variant by not installing Qt [#4998](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/4998) (3.2.0.0, 3.1.10.0) - - *ci*: Don't run non-wheel workflows when only pyproject.toml changes [#4997](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/4997) (3.2.0.0, 3.1.10.0) - - *ci*: Windows runners switched which python version they had [#5010](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5010) (3.2.0.0, 3.1.10.0) - *ci*: Test against libraw 0.22 for 'latest' test variants [#5009](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5009) (3.2.0.0, 3.1.10.0) - *ci*: Lock bleeding edge to pybind11 latest version [#5024](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5024) (3.2.0.0, 3.1.10.0) - *ci*: Don't install OpenCV on Mac Intel job variant [#5032](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5032) (3.2.0.0, 3.1.11.0) @@ -330,10 +333,10 @@ fmRelease 3.2 (target: Sept 2026?) -- compared to 3.1 - *ci*: Fix broken CI by locking down aswf container for 2023 [#5200](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5200); remove deprecated windows-2025 runner [#5189](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5189) (3.2.0.3, 3.1.14.0, 3.0.19.0) - *ci*: Fixes to build_opencolorio.bash script [#5219](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5219); upgrade 'latest' CI tests to OpenEXR v3.4.14, fmt 12.2, PugiXML v1.16 [#5245](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5245). (3.2.0.3, 3.1.15.0) - *ci*: Add vfx2027 container tests. [#5302](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5302) (3.2.0.3) - - *testing*: New libFuzzer-based fuzzing infrastructure and nightly CI matrix for image format readers -- see the "Other notable new feature" entry above for details. [#5314](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5314) (3.2.0.4, 3.1.16.0) - - *ci*: Test against and document the latest dependency versions. [#5330](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5330) (3.2.0.4, 3.1.16.0) - - *ci*: Update all GHA actions to the latest versions. [#5381](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5381) - - *ci*: A collection of build/testing odds and ends needed to fully enable the nanobind Python backend across CI: build and test both pybind11 and nanobind backends (except on Windows, where only nanobind is tested for build-time reasons). [#5346](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5346) + - *testing*: New libFuzzer-based fuzzing infrastructure and nightly CI matrix for image format readers -- see the "Other notable new feature" entry above for details. [#5314](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5314) (3.2.0.3, 3.1.16.0) + - *ci*: Test against and document the latest dependency versions. [#5330](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5330) (3.2.0.3, 3.1.16.0) + - *ci*: Bump the "latest releases" CI test versions (libpng 1.6.58, FreeType 2.14.3, OpenJPH 0.31.0); no change to minimum requirements. [#5434](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5434) (3.2.0.3) + - *ci*: Update all GHA actions to the latest versions. [#5381](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5381) (3.2.0.3, 3.1.17.0) - *tests*: Change fuzz corpus seeding to gather a broader, less-biased sample per format instead of just the 5 smallest files, which favored degenerate inputs (decompression bombs, truncated headers) over larger valid files as mutation seeds. [#5338](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5338) - *tests*: Fix brittle behavior of tests that build their own executable (e.g. cmake-consumer, imagebufalgo-opencv, openexr-partialtile) and need `find_package(OpenImageIO)`; this only worked in CI by accident via `OpenImageIO_ROOT`. [#5359](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5359) @@ -349,12 +352,12 @@ fmRelease 3.2 (target: Sept 2026?) -- compared to 3.1 - *docs*: Clarify plugin.h explanations by noting their Unix-like equivalents. [#5226](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5226) (3.2.0.3, 3.1.15.0) - *docs*: Fix typos and update a reference link in deepdata comments. [#5238](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5238) (by @luna-y-kim / Luna Kim) (3.2.0.3, 3.1.15.0) - *docs*: Fix typo in bitcast docs. [#5255](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5255) (3.2.0.3, 3.1.15.0) - - *docs*: Fix typos. [#5349](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5349) (by @jinhgkim / Jinnie Kim) (3.2.0.4, 3.1.16.0) - - *docs*: Update the ImageCache docs now that IC is fully de-virtualized, remove leftover docs for the old ImageBufAlgo header API, and fix minor typos found along the way. [#5352](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5352) (by @luna-y-kim / Luna Kim) (3.2.0.4, 3.1.16.0) - - *docs*: Fix vcpkg install command syntax in INSTALL.md (`vcpkg install openimageio[tools]`, no space). [#5332](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5332) (by @BrianHanke / Brian R Hanke) (3.2.0.4, 3.1.16.0) + - *docs*: Fix typos. [#5349](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5349) (by @jinhgkim / Jinnie Kim) (3.2.0.3, 3.1.16.0) + - *docs*: Update the ImageCache docs now that IC is fully de-virtualized, remove leftover docs for the old ImageBufAlgo header API, and fix minor typos found along the way. [#5352](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5352) (by @luna-y-kim / Luna Kim) (3.2.0.3, 3.1.16.0) + - *docs*: Fix vcpkg install command syntax in INSTALL.md (`vcpkg install openimageio[tools]`, no space). [#5332](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5332) (by @BrianHanke / Brian R Hanke) (3.2.0.3, 3.1.16.0) - *docs*: Convert the ImageCache chapter's doc example from hardcoded text into compiling C++ and Python tests, referenced from the docs via `literalinclude`. [#5341](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5341) (by @FaisalXL / Faisal) - *docs*: Update color-space, display, and view names left over from older SPI/ACES configs to use the current color interop IDs and views. [#5388](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5388) (by @brechtvl / Brecht Van Lommel) - - *docs*: Correct Doxygen-style comments in IOProxy. [#5347](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5347) + - *docs*: Correct Doxygen-style comments in IOProxy. [#5347](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5347) (3.2.0.3, 3.1.17.0) - *docs*: `OIIO_DEPRECATED_EXTERNAL`'s alias had never actually been defined. [#5345](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5345) ### 🏢 Project Administration @@ -364,19 +367,62 @@ fmRelease 3.2 (target: Sept 2026?) -- compared to 3.1 - *admin*: Add CVE-2024-55194 (long since fixed) to security alerts. [#5216](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5216) (3.2.0.3, 3.1.14.0) - *admin*: Update security alerts and clarify security policy to explain what qualifies as a vulnerability. [#5232](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5232) (3.2.0.3, 3.1.14.1, 3.0.19.1) - *admin*: Misc administrative docs fixups. [#5233](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5233) (3.2.0.3, 3.1.14.1) - - *admin*: Minor fixes to README & SECURITY, and update SECURITY with new CVE assignments. [#5320](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5320) [#5329](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5329) (3.2.0.4, 3.1.16.0, 3.0.21.0) + - *admin*: Minor fixes to README & SECURITY, and update SECURITY with new CVE assignments. [#5320](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5320) [#5329](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5329) (3.2.0.3, 3.1.16.0, 3.0.21.0) ### 🤝 Contributors - First-time contributors since the 3.1 major release (3.2 will be the first major release to credit them): Aamir Raza, Brad Smith, Brian R Hanke, Dongju Lee, Faisal, Hannah Gulka, Hunter, Jackson Sun, Jinnie Kim, Lumina - Wang, Luna Kim, Mixie, Nathan Rusch, Nick D'Ademo, Shane Smith, Valery + Wang, Luna Kim, Mixie, Nathan Gray, Nathan Rusch, Nick D'Ademo, Qi-fly, Shane Smith, Valery Angelique, Wayne Arnold. --- --- +Release 3.1.17.0 (Sep 1, 2026) -- compared to 3.1.16.0 +--------------------------------------------------------- + - *raw*: Add `raw:thumbnail_index` and `raw:thumbnail_sort` hints to select a specific embedded thumbnail, plus assorted thumbnail fixes and unit tests. [#5334](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5334) (by @antond-weta / Anton Dukhovnikov) + - *raw*: Allow vector types in multi-value hints (white balance as a float4, cropbox/greybox as int2 boxes). [#5386](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5386) (by @antond-weta / Anton Dukhovnikov) + - *raw*: Fix undebayered flip mapping, buffer bounds, and overflow issues. [#5415](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5415) + - *exr*: Convert mixed-native-integer-depth channels through proper rescaling instead of reinterpreting bytes when writing OpenEXR (also fixes `copy_image` and `iconvert` native fast paths). [#5340](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5340) (by @lgritz / Larry Gritz) + - *oiiotool*: More robust handling of failed reads: preserve the reader's specific error message instead of a generic "file not found", don't dereference specs of a failed read, and safer error message marshalling. [#5380](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5380) [#5377](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5377) [#5401](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5401) (by @lgritz / Larry Gritz) + - *IBA*: Detect iterator read errors in orientation functions (flip, flop, rotate90/180/270, transpose). [#5355](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5355) (by @luna-y-kim / Luna Kim) + - *writers*: Don't write `thumbnail_*` metadata to formats that can't hold a thumbnail. [#5357](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5357) (by @jinhgkim / Jinnie Kim) + - *readers*: Use `check_open()` and `check_compression_ratio()` in all readers that lacked them, guarding against decompression bombs and implausible header dimensions. [#5342](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5342) (by @lgritz / Larry Gritz) + - *bmp*: Decompression-bomb guard, UB-safe height negation, and scanline bounds checks. [#5371](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5371) (by @lgritz / Larry Gritz) + - *exif*: Harden the shared Exif decoder against malformed input (affects all formats that embed Exif). [#5399](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5399) (by @lgritz / Larry Gritz) + - *ffmpeg*: Fix heap bounds, bad packet handling, add checks at open, and other fixes. [#5406](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5406) (by @lgritz / Larry Gritz) + - *fits*: Validate the NAXIS count against the permitted 0-999 range. [#5370](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5370) (by @lgritz / Larry Gritz) + - *gif*: Reject a short graphics-control extension block. [#5366](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5366) (by @lgritz / Larry Gritz) + - *icc*: Fix out-of-bounds pointer formation, use alignment-safe reads, and 64-bit tag bounds in the shared ICC profile decoder (jpeg, png, tiff, webp, jpeg2000, psd). [#5417](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5417) (by @lgritz / Larry Gritz) + - *jpeg*: More detection of corrupt files. [#5376](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5376) (by @lgritz / Larry Gritz) + - *jpegxl*: Harden against corrupt input. [#5378](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5378) (by @lgritz / Larry Gritz) + - *pnm*: Use 64-bit scanline math to avoid integer overflow. [#5344](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5344) (by @lgritz / Larry Gritz) + - *psd*: Harden reader against oversized/bomb headers and ZIP-layer buffer overflow. [#5348](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5348) (by @lgritz / Larry Gritz) + - *ptex*: Guard null face-data returns; add malformed-header tests. [#5365](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5365) (by @lgritz / Larry Gritz) + - *rla*: Terminate the subimage chain and bounds-check the offset table. [#5403](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5403) (by @lgritz / Larry Gritz) + - *tiff*: Hardening: prevent OOB read on failed raw-strip reads, 64-bit overflow protection. [#5336](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5336) (by @lgritz / Larry Gritz) + - *xmp*: Fix `encode_xmp()` for aliased metadata names such as `IPTC:Rating` / `xmp:Rating`. [#5108](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5108) (by @Qi-fly) + - *zfile*: Check `gzread` returns for truncated or corrupt input. [#5372](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5372) + - *fix*: When reading xmp, bound decode recursion and growth, escape encoder output. [#5405](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5405) (by @lgritz / Larry Gritz) + - *fix*: Fix ImageBuf error message with too few format arguments aborting. [#5343](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5343) + - *fix*: OpenColorIO exception safety improvements. [#5428](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5428) + - *fix*: Improve `ImageSpec::default_channel_names` nchannels safety. [#5368](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5368) + - *simd.h*: Fix NEON `vfloat4::load(values,n)` reading past the end of the buffer. [#5404](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5404) + - *simd.h*: Fill in missing NEON paths in simd.h. [#5412](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5412) + - *simd.h*: Treat Windows ARM64EC builds as ARM so the NEON path is taken. [#5369](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5369) (by @wayne-arnold-adsk / Wayne Arnold) + - *filesystem.h*: Use 64-bit file offsets on Windows. [#5354](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5354) (by @Maxi741cv / Mixie) + - *threads.h*: Annotate `spin_mutex` and `spin_rw_mutex` for ThreadSanitizer. [#5429](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5429) (by @NathanGray-ChurchillNavigation / Nathan Gray) + - *build*: Fix declaration mismatch for unity builds on Windows. [#5360](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5360) + - *build*: Guard libtiff's missing Deflate target. [#5313](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5313) (by @zachlewis / Zach Lewis) + - *build*: Fix `CLANG_FORMAT_INCLUDES` targets. [#5373](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5373) (by @jinhgkim / Jinnie Kim) + - *deps*: Raise LibRaw recommended minimum to 0.21.3 (hard minimum still 0.20.0). [#5383](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5383) + - *ci*: Update all GHA actions to the latest versions. [#5381](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5381) + - *docs*: Correct Doxygen style comments in IOProxy. [#5347](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5347) + - *Contributors*: First-time contributors to this release: Mixie, Nathan Gray, Qi-fly. + + Release 3.1.16.0 (Aug 1, 2026) -- compared to 3.1.15.0 --------------------------------------------------------- - *oiiotool*: Add thumbnail get/set commands and fix TGA thumbnail I/O. [#5236](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5236) (by @jinhgkim / Jinnie Kim) diff --git a/CREDITS.md b/CREDITS.md index 93620e1e79..c48c5f7132 100644 --- a/CREDITS.md +++ b/CREDITS.md @@ -1,8 +1,8 @@ This is a list of all the contributors to OpenImageIO, sorted alphabetically by first name. -If you know of somebody that I missed or have corrections, please email: -lg@openimageio.org +If you know of somebody that I missed or have corrections, please contact +the project. * Aamir Raza * Aaron Colwell @@ -34,6 +34,7 @@ lg@openimageio.org * Anthony Nemoff * Aras Pranckevičius * Arkady Shapkin +* Asish Kumar * Basile Fraboni * Basileios Anastasatos * Bastien Montagne @@ -87,6 +88,7 @@ lg@openimageio.org * Dominik Wójt * Don Olmstead * Dongju Lee +* Doug Walker * Duncan Chan * Dustin Rodrigues * Edgar Velazquez-Armendariz @@ -95,6 +97,7 @@ lg@openimageio.org * Emil Dohne * Fabien Castan * Fabien Servant +* Faisal * Fredrik Averpil * Frédéric Devernay * Gaurav Bansal @@ -111,6 +114,7 @@ lg@openimageio.org * Heiko Becker * Henri Fousse * Hugh Macdonald +* Hunter * Imarz * Irena Damsky * Ismael Cortes @@ -141,6 +145,7 @@ lg@openimageio.org * Justina Mikonyte * Kaarrot * Kazuki Takahashi +* Ken McGaugh * Kevin Brightwell * Kimball Thurston * Konrad Kleine @@ -150,6 +155,7 @@ lg@openimageio.org * Leonid Onokhov * Leszek Godlewski * Li Ji +* Loïc Vital * Lucas Panian * Lucille Caillaud * Lukas Schrangl @@ -169,9 +175,11 @@ lg@openimageio.org * Mark Boorer * Mark Visser * Massimo Paladin +* Matt Van Horn * Matteo F. Vescovi * Matthew E. Levine * Max Liani +* Mixie / Maxi741cv * Maxwell Iverson * Mel Massadian * Merwan Achibet @@ -183,6 +191,7 @@ lg@openimageio.org * Mike Root * Morteza Ramezanali * Nandan Dubey +* Nathan Gray * Nathan Rusch * Nicholas Yue * Nick Black @@ -211,6 +220,7 @@ lg@openimageio.org * Pino Toscano * Povilas Kanapickas * Puneet Jain +* Qi-fly * Radu Arjocu * Ramon Montoya * Ray Molenkamp @@ -219,6 +229,7 @@ lg@openimageio.org * Robert Matusewicz * Roeland Schoukens * Roman Zulak +* rose413 * Rui Chen * Rui Li * Russell Greene diff --git a/SECURITY.md b/SECURITY.md index 9feaa82a54..ef15a373c6 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -8,9 +8,10 @@ security vulnerabilities. | Version / branch | Supported | | ----------------- | ---------------------------------------------------- | | main | :white_check_mark: :construction: ALL fixes immediately, but this is a branch under development with a frequently unstable ABI and occasionally unstable API. | -| 3.1.x | :white_check_mark: All fixes that can be backported without breaking ABI compatibility. New tagged releases monthly. | -| 3.0.x | :warning: Important fixes that can be easily backported without breaking ABI compatibility. New tagged releases as needed, and becoming less frequent over time. | -| <= 2.5.x | :x: No longer receiving patches of any kind. | +| 3.2.x | :white_check_mark: All fixes that can be backported without breaking ABI compatibility. New tagged releases monthly. | +| 3.1.x | :warning: All fixes that can be backported easily and without breaking ABI compatibility (less will be backported than to 3.2, because it has diverged for longer). New tagged releases monthly at first, but possibly becoming less frequent with time. | +| 3.0.x | :warning: :warning: Only the most critical bugs will be backported, only if it's very easy. Releases are sporadic now and support should be expected to end soon. | +| <= 2.5.x | :x: No longer receiving patches of any kind. | ## Reporting a Vulnerability @@ -96,19 +97,21 @@ None known Most recent fixes listed first, more or less: -- CVE-2026-63638: Cineon invalid bit depth heap out-of-bounds write [advisory](https://github.com/AcademySoftwareFoundation/OpenImageIO/security/advisories/GHSA-9hxv-jvgr-3x8g) / [Fix: PR #5283](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5283) (fixed in 3.1.16.0) -- CVE-2026-63635: PSD RawColor invalid color mode causes global out-of-bounds read and allocation DoS [advisory](https://github.com/AcademySoftwareFoundation/OpenImageIO/security/advisories/GHSA-3c8w-9xvm-r6gf) / [Fix: PR #5282](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5282) (fixed in 3.1.16.0) -- CVE-2026-63635: PSD RawColor invalid color mode causes global out-of-bounds read and allocation DoS [advisory](https://github.com/AcademySoftwareFoundation/OpenImageIO/security/advisories/GHSA-3c8w-9xvm-r6gf) / [Fix: PR #5282, 3.1.16.0](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5282) (fixed in 3.1.16.0) -- CVE-2026-63422 OpenEXR plugin partial edge tile heap out-of-bounds write [advisory](https://github.com/AcademySoftwareFoundation/OpenImageIO/security/advisories/GHSA-xh5r-whph-qmc5) / [Fix: PR #5295](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5295) (fixed in 3.1.16.0) -- CVE-2026-63420: PSD RawColor indexed image out-of-bounds read in `interleave_row` [advisory](https://github.com/AcademySoftwareFoundation/OpenImageIO/security/advisories/GHSA-x877-h4xx-5m5j) / [Fix: PR #5307](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5307) (fixed in 3.1.16.0) -- CVE-2026-63419: OpenImageIO IFF ZBUFFER tile read writes past caller tile buffer [advisory](https://github.com/AcademySoftwareFoundation/OpenImageIO/security/advisories/GHSA-w6wc-gcf4-5pj2) / [Fix: PR #5268](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5268) (fixed in 3.1.16.0) -- CVE-2026-59956: Heap-buffer-overread in IffInput::readimg() when ZBUFFER flag is set [advisory](https://github.com/AcademySoftwareFoundation/OpenImageIO/security/advisories/GHSA-hjfv-gvxc-qgvh) / [Fix: PR #5251](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5251) (fixed in 3.0.20.0, 3.1.15.0) -- CVE-2026-59181: Stack buffer overflow in OpenImageIO Cineon reader via unchecked numberOfElements [advisory](https://github.com/AcademySoftwareFoundation/OpenImageIO/security/advisories/GHSA-xh8r-vmqq-56pp) / [Fix: PR #5250](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5250) (fixed in 3.0.20.0, 3.1.15.0) -- CVE-2026-59156: Unbounded recursion in FITS header parser leads to stack overflow [advisory](https://github.com/AcademySoftwareFoundation/OpenImageIO/security/advisories/GHSA-xvwr-x6ch-v2fq) / [Fix: PR #5248](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5248) (fixed in 3.0.20.0, >= 3.1.15.0) -- CVE-2026-50291: Segmentation Fault in BmpInput::read_native_scanline / [advisory](https://github.com/AcademySoftwareFoundation/OpenImageIO/security/advisories/GHSA-q3c7-3225-66h7) / [Fix: PR #5030](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5030) (Fixed in 3.0.16.0, 3.1.11.0) -- CVE-2026-43909: Signed integer overflow in SwapRGBABytes loop index leads to out-of-bounds read/write in DPX ABGR decoder / [advisory](https://github.com/AcademySoftwareFoundation/OpenImageIO/security/advisories/GHSA-g267-j53j-5258) / [Fix: PR5170](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5170) (Fixed in 3.0.18.1, 3.1.13.1) -- CVE-2026-43908: Signed integer overflow in ConvertCbYCrYToRGB leads to heap out-of-bounds write in DPX 4:2:2 decoder / [advisory](https://github.com/AcademySoftwareFoundation/OpenImageIO/security/advisories/GHSA-2jr5-q49v-3858) / [Fix: PR5170](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5170) (Fixed in 3.0.18.1, 3.1.13.1) -- CVE-2026-43907: Integer overflow in QueryRGBBufferSizeInternal leads to heap out-of-bounds write in DPX decoder (kCbYCr and kABGR) / [advisory](https://github.com/AcademySoftwareFoundation/OpenImageIO/security/advisories/GHSA-cq46-hp4h-cvfr) / [Fix: PR5170](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5170) (Fixed in 3.0.18.1, 3.1.13.1) +- CVE-2026-67549: TIFF 1-bit CMYK bit conversion heap out-of-bounds write [advisory](https://github.com/AcademySoftwareFoundation/OpenImageIO/security/advisories/GHSA-3wxw-rqhw-j2w4) / [Fix: PR #5296](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5296) (fixed in 3.2.0.3, 3.1.16.0) +- CVE-2026-65970: TIFF multithreaded scanline read use-after-scope in `TIFFInput::read_native_scanlines` [advisory](https://github.com/AcademySoftwareFoundation/OpenImageIO/security/advisories/GHSA-v278-gpwr-r836) / [Fix: PR #5294](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5294) (fixed in 3.2.0.3, 3.1.16.0) +- CVE-2026-65969: TGA-to-GIF palette split signed overflow causes SIGSEGV [advisory](https://github.com/AcademySoftwareFoundation/OpenImageIO/security/advisories/GHSA-9mwc-fjgj-8wmq) / Fix: [PR #5292](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5292) [PR #5293](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5293) (fixed in 3.2.0.3, 3.1.16.0, 3.0.21.0) +- CVE-2026-63638: Cineon invalid bit depth heap out-of-bounds write [advisory](https://github.com/AcademySoftwareFoundation/OpenImageIO/security/advisories/GHSA-9hxv-jvgr-3x8g) / [Fix: PR #5283](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5283) (fixed in 3.2.0.3, 3.1.16.0, 3.0.21.0) +- CVE-2026-63635: PSD RawColor invalid color mode causes global out-of-bounds read and allocation DoS [advisory](https://github.com/AcademySoftwareFoundation/OpenImageIO/security/advisories/GHSA-3c8w-9xvm-r6gf) / [Fix: PR #5282](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5282) (fixed in 3.2.0.3, 3.1.16.0, 3.0.21.0) +- CVE-2026-63422: OpenEXR plugin partial edge tile heap out-of-bounds write [advisory](https://github.com/AcademySoftwareFoundation/OpenImageIO/security/advisories/GHSA-xh5r-whph-qmc5) / [Fix: PR #5295](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5295) (fixed in 3.2.0.3, 3.1.16.0, 3.0.21.0) +- CVE-2026-63420: PSD RawColor indexed image out-of-bounds read in `interleave_row` [advisory](https://github.com/AcademySoftwareFoundation/OpenImageIO/security/advisories/GHSA-x877-h4xx-5m5j) / [Fix: PR #5307](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5307) (fixed in 3.2.0.3, 3.1.16.0, 3.0.21.0) +- CVE-2026-63419: OpenImageIO IFF ZBUFFER tile read writes past caller tile buffer [advisory](https://github.com/AcademySoftwareFoundation/OpenImageIO/security/advisories/GHSA-w6wc-gcf4-5pj2) / [Fix: PR #5268](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5268) (fixed in 3.2.0.3, 3.1.16.0, 3.0.21.0) +- CVE-2026-59956: Heap-buffer-overread in IffInput::readimg() when ZBUFFER flag is set [advisory](https://github.com/AcademySoftwareFoundation/OpenImageIO/security/advisories/GHSA-hjfv-gvxc-qgvh) / [Fix: PR #5251](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5251) (fixed in 3.2.0.3, 3.1.15.0, 3.0.20.0) +- CVE-2026-59181: Stack buffer overflow in OpenImageIO Cineon reader via unchecked numberOfElements [advisory](https://github.com/AcademySoftwareFoundation/OpenImageIO/security/advisories/GHSA-xh8r-vmqq-56pp) / [Fix: PR #5250](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5250) (fixed in 3.2.0.3, 3.1.15.0, 3.0.20.0) +- CVE-2026-59156: Unbounded recursion in FITS header parser leads to stack overflow [advisory](https://github.com/AcademySoftwareFoundation/OpenImageIO/security/advisories/GHSA-xvwr-x6ch-v2fq) / [Fix: PR #5248](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5248) (fixed in 3.2.0.3, >= 3.1.15.0, 3.0.20.0) +- CVE-2026-50291: Segmentation Fault in BmpInput::read_native_scanline / [advisory](https://github.com/AcademySoftwareFoundation/OpenImageIO/security/advisories/GHSA-q3c7-3225-66h7) / [Fix: PR #5030](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5030) (Fixed in 3.2.0.0, 3.1.11.0, 3.0.16.0) +- CVE-2026-43909: Signed integer overflow in SwapRGBABytes loop index leads to out-of-bounds read/write in DPX ABGR decoder / [advisory](https://github.com/AcademySoftwareFoundation/OpenImageIO/security/advisories/GHSA-g267-j53j-5258) / [Fix: PR5170](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5170) (Fixed in 3.2.0.1, 3.1.13.1, 3.0.18.1) +- CVE-2026-43908: Signed integer overflow in ConvertCbYCrYToRGB leads to heap out-of-bounds write in DPX 4:2:2 decoder / [advisory](https://github.com/AcademySoftwareFoundation/OpenImageIO/security/advisories/GHSA-2jr5-q49v-3858) / [Fix: PR5170](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5170) (Fixed in 3.2.0.1, 3.1.13.1, 3.0.18.1) +- CVE-2026-43907: Integer overflow in QueryRGBBufferSizeInternal leads to heap out-of-bounds write in DPX decoder (kCbYCr and kABGR) / [advisory](https://github.com/AcademySoftwareFoundation/OpenImageIO/security/advisories/GHSA-cq46-hp4h-cvfr) / [Fix: PR5170](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5170) (Fixed in 3.2.0.1, 3.1.13.1, 3.0.18.1) - CVE-2026-43996: Integer wraparound in bounds check of decode_pixel leads to out-of-bounds read in TGA paletted image decoder / [advisory](https://github.com/AcademySoftwareFoundation/OpenImageIO/security/advisories/GHSA-mq8j-73c4-cr55) / [Fix: PR5165](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5165) (Fixed in 3.2.0.1, 3.1.13.0, 3.0.18.0) - CVE-2026-43906: HEIF Heap overflow / [advisory](https://github.com/AcademySoftwareFoundation/OpenImageIO/security/advisories/GHSA-gmrp-x952-3m66) / [Fix: PR5166](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5166) (Fixed in 3.2.0.1, 3.1.13.0, 3.0.18.0) - CVE-2026-43905: JPEG2000 (OpenJPH) signed integer overflow in buffer allocation / [advisory](https://github.com/AcademySoftwareFoundation/OpenImageIO/security/advisories/GHSA-pj45-cf3g-28gq) / [Fix: PR5143](https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5143) (Fixed in 3.2.0.1, 3.1.13.0, 3.0.18.0)