#183 CVE-2024-28562/28563/28564/28569: replace bundled OpenEXR 2.2 with 3.3.13

[Daniel Rosser]

Applies to FreeImage SVN trunk r1911 (also 3.19.0 [r1909]).

CVE-2024-28562 / CVE-2024-28563 / CVE-2024-28564 / CVE-2024-28569 live in bundled OpenEXR 2.2 (Imf_2_2::copyIntoFrameBuffer, DwaCompressor::Classifier, CharPtrIO::readChars, Xdr::read). OpenEXR 3.x rewrote that namespace; 3.3.13 is the tree this GitHub fork ships.

This replacement:

• Source/OpenEXR 2.2.0 -> 3.3.13 (adds OpenEXRCore)
• adds Source/Imath (split out of OpenEXR 2.x)
• adds Source/LibDeflate (OpenEXR 3 DEFLATE codec; zlib is no longer an option upstream)
• PluginEXR.cpp: Imath::Int64 -> uint64_t
• Makefile.srcs source list + include path
• Makefile.gnu: -std=c++17 and -D_GNU_SOURCE (OpenEXRCore uses O_CLOEXEC; IlmImf uses std::any)

NVD:
https://nvd.nist.gov/vuln/detail/CVE-2024-28562
https://nvd.nist.gov/vuln/detail/CVE-2024-28563
https://nvd.nist.gov/vuln/detail/CVE-2024-28564
https://nvd.nist.gov/vuln/detail/CVE-2024-28569

GitHub: https://github.com/danoli3/FreeImage/commit/248c6c9 (PR https://github.com/danoli3/FreeImage/pull/69)

Apply AFTER the OpenJPEG vendor patch (#182), from the FreeImage tree root:

gzip -dc CVE-2024-28562.patch.gz | patch -p0

The unified diff is ~15MB uncompressed / ~1.9MB gzipped.

Alternative: link system OpenEXR 3.x + Imath (-DUSE_SYSTEM_OPENEXR on the GitHub CMake build).

[Daniel Rosser]

Apply AFTER the OpenJPEG vendor patch #182 (CVE-2024-28574/28575/28576). From the FreeImage tree root:

gzip -dc CVE-2024-28574.patch.gz | patch -p0
gzip -dc CVE-2024-28562.patch.gz | patch -p0

https://sourceforge.net/p/freeimage/patches/182/