Bump openexr from 3.3.5 to 3.4.3

[dependabot]

Bumps openexr from 3.3.5 to 3.4.3.

Release notes

Sourced from openexr's releases.

v3.4.3

Patch release that addresses several bugs, primarily involving properly rejecting corrupt input data.

Specifically:

• Buffer overflow in PyOpenEXR_old's channels() and channel() in legacy python, reported by Joshua Rogers (GitHub: MegaManSec).
• Use after free in PyObject_StealAttrString in legacy python, reported by Joshua Rogers (GitHub: MegaManSec).
• Use of Uninitialized Memory in openexr, reported by Aldo Ristori (GitHub: Kaldreic).
• Heap-based Buffer Overflow Remote Code Execution Vulnerability, reported by Trend Micro Zero Day Initiative.

Also:

• OSS-fuzz 456158449 Heap-buffer-overflow in generic_unpack
• OSS-fuzz 447429458 Heap-buffer-overflow in DwaCompressor_uncompress
• OSS-fuzz 439237843 Heap-buffer-overflow in internal_exr_undo_ht
• OSS-fuzz 436037111 Heap-buffer-overflow in generic_unpack
• OSS-fuzz 435779241 Heap-buffer-overflow in generic_unpack
• OSS-fuzz 420744464 Abrt in __cxxabiv1::failed_throw

Other fixes:

• Fix a bug with re-reading a scanline file with a different set of channels.
• Only populate CMAKE_DEBUG_POSTFIX with _d if it is undefined, which makes it possible to set CMAKE_DEBUG_POSTFIX="".

This version also bumps the auto-fetched version of OpenJPH to 0.24.5. OpenJPH 0.24.5 addresses these OSS-Fuzz issues:

• OSS-fuzz 456837230 Crash in ojph::local::param_cod::~param_cod
• OSS-fuzz 456248580 Null-dereference READ in ojph::local::param_cod::~param_cod
• OSS-fuzz 455374208 Floating-point-exception in ojph::local::tile::pre_alloc
• OSS-fuzz 444963190 Index-out-of-bounds in ojph::local::param_qcd::read_qcc
• OSS-fuzz 444889300 Heap-buffer-overflow in ojph::mem_infile::read
• OSS-fuzz 444878558 Segv on unknown address in ojph::local::param_qcd::~param_qcd
• OSS-fuzz 444878557 Null-dereference READ in ojph::local::param_qcd::~param_qcd

Full changelog: v3.4.2..v3.4.3

v3.4.2

Patch release that fixes a Windows build issue introduced in v3.4.1.

This version also bumps the auto-fetched Imath version to v3.2.2, which resolves a build problem with newer versions of cmake, involving duplicate library aliases.

No change in functionality.

v3.4.1

Patch release that fixes a build issue: OpenJPH headers are now included from the openjph folder, as required by OpenJPH 0.23+.

No change in functionality.

v3.4.0

OpenEXR v3.4 introduces a new, additional compression option to the OpenEXR file format for lossless compression with High Throughput JPEG-2000 (HTJ2K) encoding:

... (truncated)

Changelog

Sourced from openexr's changelog.

Version 3.4.3 (November 4, 2025)

Patch release that addresses several bugs, primarily involving properly rejecting corrupt input data.

Specifically:

• Buffer overflow in PyOpenEXR_old's channels() and channel() in legacy python, reported by Joshua Rogers (GitHub: MegaManSec).
• Use after free in PyObject_StealAttrString in legacy python, reported by Joshua Rogers (GitHub: MegaManSec).
• Use of Uninitialized Memory in openexr, reported by Aldo Ristori (GitHub: Kaldreic).
• Heap-based Buffer Overflow Remote Code Execution Vulnerability, reported by Trend Micro Zero Day Initiative.

Also:

• OSS-fuzz 456158449 Heap-buffer-overflow in generic_unpack
• OSS-fuzz 447429458 Heap-buffer-overflow in DwaCompressor_uncompress
• OSS-fuzz 439237843 Heap-buffer-overflow in internal_exr_undo_ht
• OSS-fuzz 436037111 Heap-buffer-overflow in generic_unpack
• OSS-fuzz 435779241 Heap-buffer-overflow in generic_unpack
• OSS-fuzz 420744464 Abrt in __cxxabiv1::failed_throw

Other fixes:

• Fix a bug with re-reading a scanline file with a different set of channels.
• Only populate CMAKE_DEBUG_POSTFIX with _d if it is undefined, which makes it possible to set CMAKE_DEBUG_POSTFIX="".

This version also bumps the auto-fetched version of OpenJPH to 0.24.4. OpenJPH 0.24.4 addresses these OSS-Fuzz issues:

• OSS-fuzz 455374208 Floating-point-exception in ojph::local::tile::pre_alloc
• OSS-fuzz 444963190 Index-out-of-bounds in ojph::local::param_qcd::read_qcc
• OSS-fuzz 444878558 Segv on unknown address in ojph::local::param_qcd::~param_qcd
• OSS-fuzz 444878557 Null-dereference READ in ojph::local::param_qcd::~param_qcd

Merged Pull Requests:

... (truncated)

Commits

• 042c83d bump fetched OpenJPH version to 0.24.5
• b9a36b4 update 3.4.3 release notes
• 878a0cb Fix improper use of Py_DECREF in legacy python module (#2168)
• ddac04a update v3.4.3 notes
• f7d5688 bump openjph to 0.24.4
• 9503cb8 Only define CMAKE_DEBUG_POSTFIX if it is not already defined (#2166)
• 46b1bfb Check for image size overflow in legacy python module (#2163)
• df97029 verify packed/unpacked size with uncompressed data (#2162)
• ef7e93b check storage_mode when computing chunk sizes (#2164)
• d3c9f3a bump version for v3.4.3
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[dependabot]

Superseded by #57.