Attendance:

  • Cary Phillips
  • Christina Tempelaar-Lietz
  • John Mertic
  • Joseph Goldstone
  • Kimball Thurston
  • Larry Gritz
  • Nick Porcino
  • Peter Hillman
  • Rod Bogart

Guests:

  • Li Ji, ILM
  • Christian Wieberg-Nielsen, Colorist, Storyline

Discussion:

  • Deep CVE bug fix - OIIO test suite issues are failing 
    • Larry will verify further
    • Peter & Nick had discussed possible change to core so every exception can be caught so you can capture the true source of an error.
  • Christian
    • interested in how to get metadata from the camera into OpenEXR
  • GitHub security vulnerability reporting
    • Cary: anyone have any insight? People who filed the CVE had a blocked address so we did not receive the message, email not as reliable for CVE reports.
    • You have to be an administrator to accept a draft and turn it into a CVE, Cary will look into it further.
    • Need multiple administrators
    • fuzz reports go to openexr.org, but cve reports go to openexr.com ?
    • Cary made it all consistent a while back except for the fuzz reports. Should test if the openexr.org address is working.
  • Deep CVE bug
    • Peter is getting a repro, Kimball was able to repro
    • Kimball needs to update the checkfile test to catch the break reported by OIIO
    • As a repro, this fails:
      • iinfo -v --hash --stats testsuite/iinfo/src/tinydeep.exr
    • Kimball: Pointer unpack is causing this issue
    • OpenSUSE already cherry picked the fix into their next release but caught it in their tests before releasing
    • Deep file limits 2.5 gb
    • Peter: amplification attacks could be a risk if you can allocated a lot of memory for loading
  • PR 1616 - automate compression method detection - Phillipe lePrince
    • Kimball: shouldn't have automated detection
    • Peter: compile time trick, wouldn't have implemented it this way because it's a little difficult to reason about
    • Not built every time you build library, only when a new compression type added, done at cmake time but only if you ask it too.
    • Doesn't need to work for everybody
    • Kimball: went away from having float tables auto built. do that for configuration but we should be against such a mechanism if it something that doesn't change very often.
    • Peter: could do it with the CI , generate the files and inject back into system
    • But added 1000 lines of code to save writing 5 lines of code when adding new compression types.
    • cmake changes are large
    • Peter: could ask to take out the automation, leaving files as is and modifying them by hand
    • Would need to add a comment to cpp file as to what needs updating when adding compression type
    • Kimball: Add static assert in compression.cpp or compression.c to check the length of the enum against the compression types.
    • Peter: old c interface uses #define's instead of an enum so difficult to check
    • Peter: should be able to catch that in the test suite
    • Cary: what about std compression in the PR?
    • Peter: scanline implementation breaks with deep, single scanline would solve, compression step is just given raw data doesn't know which datatype it is dealing with (on C++ side, it's different on the C side). maybe special case handling of compression type just in the core then forward it.
    • Kimball: we already did that with ... (missed this) , handled in core then forwarded.
    • Blosc library performs differently when it knows if it has 4-byte vs 3-byte data.
    • Z-standard or LZMA have discrete chunk vs streaming mode, can keep a little bit of state around that helps the streaming.  should make sure we are taking advantage of these capabilities.


  • No labels