AIKIDO-2026-546016

TL;DR

OpenEXRCore's deep-image chunk reader caps packed and unpacked size fields at INT_MAX but omits the same cap on the sample-count table size. On 32-bit (ILP32) builds a crafted deep EXR can declare a sample-count table size at or above 2^32, so the value truncates when the scratch buffer is allocated while the full 64-bit byte count is still read into it. This yields an undersized allocation and a heap buffer overflow when the sample-count table is read. The fix rejects sample-count table sizes above INT_MAX before allocation.