MFH: r521275

graphics/ilmbase,openexr: fix vulnerabilities

Uses backported patches from upstream Git repository, without the
exr2aces parts, and regenerates all openexr patches from scratch.

The openexr part looks heaviweight because it regenerates all patches.

Security:	e4d9dffb-2a32-11ea-9693-e1b3f6feec79
Security:	CVE-2018-18443
Security:	CVE-2018-18444

Approved by:	ports-secteam@ (blanket, adding security patches)

18 files changed, 456 insertions, 8 deletions

diff --git a/graphics/ilmbase/Makefile b/graphics/ilmbase/Makefile
index ad70373ee27e..d5b5f41d31f8 100644
--- a/graphics/ilmbase/Makefile
+++ b/graphics/ilmbase/Makefile
@@ -3,7 +3,7 @@
 
 PORTNAME=	ilmbase
 PORTVERSION=	2.3.0
-PORTREVISION=	3
+PORTREVISION=	4
 CATEGORIES=	graphics devel
 MASTER_SITES=	https://github.com/openexr/openexr/releases/download/v${PORTVERSION}/
 
diff --git a/graphics/ilmbase/files/patch-CVE-2018-18443 b/graphics/ilmbase/files/patch-CVE-2018-18443
new file mode 100644
index 000000000000..babaadd8daea
--- /dev/null
+++ b/graphics/ilmbase/files/patch-CVE-2018-18443
@@ -0,0 +1,30 @@
+From adbc1900cb9d25fcc4df008d4008b781cf2fa4f8 Mon Sep 17 00:00:00 2001
+From: Kimball Thurston <kdt3rd@gmail.com>
+Date: Thu, 27 Jun 2019 22:15:17 +1200
+Subject: [PATCH] Fix #350 - memory leak on exit
+
+This fixes CVE-2018-18443, the last thread pool provider set into the
+pool was not being correctly cleaned up at shutdown of the thread pool.
+
+Signed-off-by: Kimball Thurston <kdt3rd@gmail.com>
+---
+ CHANGES.md                          | 4 ++++ -- OMITTED/Matthias Andree
+ IlmBase/IlmThread/IlmThreadPool.cpp | 2 ++
+ 2 files changed, 6 insertions(+)
+
+diff --git a/IlmBase/IlmThread/IlmThreadPool.cpp b/IlmBase/IlmThread/IlmThreadPool.cpp
+index 174ab98c..24ca7395 100644
+--- ./IlmThread/IlmThreadPool.cpp~
++++ ./IlmThread/IlmThreadPool.cpp
+@@ -566,9 +566,11 @@ ThreadPool::Data::~Data()
+ {
+ #ifdef ILMBASE_FORCE_CXX03
+     provider->finish();
++    delete provider;
+ #else
+     ThreadPoolProvider *p = provider.load( std::memory_order_relaxed );
+     p->finish();
++    delete p;
+ #endif
+ }
+ 
diff --git a/graphics/openexr/Makefile b/graphics/openexr/Makefile
index 1b4c19850560..42d3728413d1 100644
--- a/graphics/openexr/Makefile
+++ b/graphics/openexr/Makefile
@@ -3,7 +3,7 @@
 
 PORTNAME=	openexr
 PORTVERSION=	2.3.0
-PORTREVISION=	2
+PORTREVISION=	3
 CATEGORIES=	graphics devel
 MASTER_SITES=	https://github.com/${PORTNAME}/${PORTNAME}/releases/download/v${PORTVERSION}/:dist \
 		LOCAL/mandree/:test
diff --git a/graphics/openexr/files/patch-IlmImfTest__main.cpp b/graphics/openexr/files/patch-IlmImfTest_main.cpp
index b22b303fa5d4..65b8592f3f0a 100644
--- a/graphics/openexr/files/patch-IlmImfTest__main.cpp
+++ b/graphics/openexr/files/patch-IlmImfTest_main.cpp
@@ -1,4 +1,4 @@
---- IlmImfTest/main.cpp.orig	2014-08-10 04:23:59 UTC
+--- IlmImfTest/main.cpp.orig	2018-08-10 01:34:59 UTC
 +++ IlmImfTest/main.cpp
 @@ -100,7 +100,7 @@
  #include <string.h>
diff --git a/graphics/openexr/files/patch-IlmImfTest_testOptimizedInterleavePatterns.cpp b/graphics/openexr/files/patch-IlmImfTest_testOptimizedInterleavePatterns.cpp
index 63cd46ad9297..f5711dc1df46 100644
--- a/graphics/openexr/files/patch-IlmImfTest_testOptimizedInterleavePatterns.cpp
+++ b/graphics/openexr/files/patch-IlmImfTest_testOptimizedInterleavePatterns.cpp
@@ -1,4 +1,4 @@
---- IlmImfTest/testOptimizedInterleavePatterns.cpp.orig	2014-08-10 02:03:49 UTC
+--- IlmImfTest/testOptimizedInterleavePatterns.cpp.orig	2018-08-10 01:34:59 UTC
 +++ IlmImfTest/testOptimizedInterleavePatterns.cpp
 @@ -226,7 +226,8 @@ bool compare(const FrameBuffer& asRead,
                      writtenHalf=half(i.slice().fillValue);
diff --git a/graphics/openexr/files/patch-IlmImfUtilTest_main.cpp b/graphics/openexr/files/patch-IlmImfUtilTest_main.cpp
index 1b3147705c70..0ee02fdb1aa0 100644
--- a/graphics/openexr/files/patch-IlmImfUtilTest_main.cpp
+++ b/graphics/openexr/files/patch-IlmImfUtilTest_main.cpp
@@ -1,4 +1,4 @@
---- IlmImfUtilTest/main.cpp.orig	2014-08-10 04:24:00 UTC
+--- IlmImfUtilTest/main.cpp.orig	2018-08-10 01:34:59 UTC
 +++ IlmImfUtilTest/main.cpp
 @@ -46,7 +46,7 @@
  #include <cstring>
diff --git a/graphics/openexr/files/patch-IlmImf_ImfFrameBuffer.cpp b/graphics/openexr/files/patch-IlmImf_ImfFrameBuffer.cpp
new file mode 100644
index 000000000000..95bfd885699a
--- /dev/null
+++ b/graphics/openexr/files/patch-IlmImf_ImfFrameBuffer.cpp
@@ -0,0 +1,91 @@
+--- IlmImf/ImfFrameBuffer.cpp.orig	2018-08-10 01:34:58 UTC
++++ IlmImf/ImfFrameBuffer.cpp
+@@ -74,6 +74,88 @@ Slice::Slice (PixelType t,
+     // empty
+ }
+ 
++Slice
++Slice::Make (
++    PixelType                   type,
++    const void*                 ptr,
++    const IMATH_NAMESPACE::V2i& origin,
++    int64_t                     w,
++    int64_t                     h,
++    size_t                      xStride,
++    size_t                      yStride,
++    int                         xSampling,
++    int                         ySampling,
++    double                      fillValue,
++    bool                        xTileCoords,
++    bool                        yTileCoords)
++{
++    char* base = reinterpret_cast<char*> (const_cast<void *> (ptr));
++    if (xStride == 0)
++    {
++        switch (type)
++        {
++            case UINT: xStride = sizeof (uint32_t); break;
++            case HALF: xStride = sizeof (uint16_t); break;
++            case FLOAT: xStride = sizeof (float); break;
++            case NUM_PIXELTYPES:
++                THROW (IEX_NAMESPACE::ArgExc, "Invalid pixel type.");
++        }
++    }
++    if (yStride == 0)
++        yStride = static_cast<size_t> (w / xSampling) * xStride;
++
++    // data window is an int, so force promote to higher type to avoid
++    // overflow for off y (degenerate size checks should be in
++    // ImfHeader::sanityCheck, but offset can be large-ish)
++    int64_t offx = (static_cast<int64_t> (origin.x) /
++                    static_cast<int64_t> (xSampling));
++    offx *= static_cast<int64_t> (xStride);
++
++    int64_t offy = (static_cast<int64_t> (origin.y) /
++                    static_cast<int64_t> (ySampling));
++    offy *= static_cast<int64_t> (yStride);
++
++    return Slice (
++        type,
++        base - offx - offy,
++        xStride,
++        yStride,
++        xSampling,
++        ySampling,
++        fillValue,
++        xTileCoords,
++        yTileCoords);
++}
++
++Slice
++Slice::Make (
++    PixelType                     type,
++    const void*                   ptr,
++    const IMATH_NAMESPACE::Box2i& dataWindow,
++    size_t                        xStride,
++    size_t                        yStride,
++    int                           xSampling,
++    int                           ySampling,
++    double                        fillValue,
++    bool                          xTileCoords,
++    bool                          yTileCoords)
++{
++    return Make (
++        type,
++        ptr,
++        dataWindow.min,
++        static_cast<int64_t> (dataWindow.max.x) -
++            static_cast<int64_t> (dataWindow.min.x) + 1,
++        static_cast<int64_t> (dataWindow.max.y) -
++            static_cast<int64_t> (dataWindow.min.y) + 1,
++        xStride,
++        yStride,
++        xSampling,
++        ySampling,
++        fillValue,
++        xTileCoords,
++        yTileCoords);
++}
+ 
+ void
+ FrameBuffer::insert (const char name[], const Slice &slice)
diff --git a/graphics/openexr/files/patch-IlmImf_ImfFrameBuffer.h b/graphics/openexr/files/patch-IlmImf_ImfFrameBuffer.h
new file mode 100644
index 000000000000..0a7e9264464a
--- /dev/null
+++ b/graphics/openexr/files/patch-IlmImf_ImfFrameBuffer.h
@@ -0,0 +1,56 @@
+--- IlmImf/ImfFrameBuffer.h.orig	2018-08-10 01:34:58 UTC
++++ IlmImf/ImfFrameBuffer.h
+@@ -48,14 +48,15 @@
+ #include "ImfPixelType.h"
+ #include "ImfExport.h"
+ #include "ImfNamespace.h"
++#include "ImathBox.h"
+ 
+ #include <map>
+ #include <string>
++#include <cstdint>
+ 
+ 
+ OPENEXR_IMF_INTERNAL_NAMESPACE_HEADER_ENTER
+ 
+-
+ //-------------------------------------------------------
+ // Description of a single slice of the frame buffer:
+ //
+@@ -148,6 +149,36 @@ struct Slice
+            double fillValue = 0.0,
+            bool xTileCoords = false,
+            bool yTileCoords = false);
++
++    // Does the heavy lifting of computing the base pointer for a slice,
++    // avoiding overflow issues with large origin offsets
++    //
++    // if xStride == 0, assumes sizeof(pixeltype)
++    // if yStride == 0, assumes xStride * ( w / xSampling )
++    static Slice Make(PixelType type,
++                      const void *ptr,
++                      const IMATH_NAMESPACE::V2i &origin,
++                      int64_t w,
++                      int64_t h,
++                      size_t xStride = 0,
++                      size_t yStride = 0,
++                      int xSampling = 1,
++                      int ySampling = 1,
++                      double fillValue = 0.0,
++                      bool xTileCoords = false,
++                      bool yTileCoords = false);
++    // same as above, just computes w and h for you
++    // from a data window
++    static Slice Make(PixelType type,
++                      const void *ptr,
++                      const IMATH_NAMESPACE::Box2i &dataWindow,
++                      size_t xStride = 0,
++                      size_t yStride = 0,
++                      int xSampling = 1,
++                      int ySampling = 1,
++                      double fillValue = 0.0,
++                      bool xTileCoords = false,
++                      bool yTileCoords = false);
+ };
+ 
+ 
diff --git a/graphics/openexr/files/patch-IlmImf_ImfHeader.cpp b/graphics/openexr/files/patch-IlmImf_ImfHeader.cpp
new file mode 100644
index 000000000000..f93473fc7ae4
--- /dev/null
+++ b/graphics/openexr/files/patch-IlmImf_ImfHeader.cpp
@@ -0,0 +1,64 @@
+--- IlmImf/ImfHeader.cpp.orig	2018-08-10 01:34:58 UTC
++++ IlmImf/ImfHeader.cpp
+@@ -785,30 +785,46 @@ Header::sanityCheck (bool isTiled, bool isMultipartFil
+ 	throw IEX_NAMESPACE::ArgExc ("Invalid data window in image header.");
+     }
+ 
+-    if (maxImageWidth > 0 &&
+-        maxImageWidth < (dataWindow.max.x - dataWindow.min.x + 1))
++    int w = (dataWindow.max.x - dataWindow.min.x + 1);
++    if (maxImageWidth > 0 && maxImageWidth < w)
+     {
+ 	THROW (IEX_NAMESPACE::ArgExc, "The width of the data window exceeds the "
+ 			    "maximum width of " << maxImageWidth << "pixels.");
+     }
+ 
+-    if (maxImageHeight > 0 &&
+-	maxImageHeight < dataWindow.max.y - dataWindow.min.y + 1)
++    int h = (dataWindow.max.y - dataWindow.min.y + 1);
++    if (maxImageHeight > 0 && maxImageHeight < h)
+     {
+-	THROW (IEX_NAMESPACE::ArgExc, "The width of the data window exceeds the "
+-			    "maximum width of " << maxImageHeight << "pixels.");
++	THROW (IEX_NAMESPACE::ArgExc, "The height of the data window exceeds the "
++			    "maximum height of " << maxImageHeight << "pixels.");
+     }
+ 
+-   // chunk table must be smaller than the maximum image area
+-   // (only reachable for unknown types or damaged files: will have thrown earlier
+-   //  for regular image types)
+-   if( maxImageHeight>0 && maxImageWidth>0 && 
+-       hasChunkCount() && chunkCount()>Int64(maxImageWidth)*Int64(maxImageHeight))
+-   {
+-       THROW (IEX_NAMESPACE::ArgExc, "chunkCount exceeds maximum area of "
+-       << Int64(maxImageWidth)*Int64(maxImageHeight) << " pixels." );
++    // make sure to avoid simple math overflow for large offsets
++    // we know we're at a positive width because of checks above
++    long long bigW = static_cast<long long>( w );
++    long long absOffY = std::abs ( dataWindow.min.y );
++    long long absOffX = std::abs ( dataWindow.min.x );
++    long long offX = static_cast<long long>( INT_MAX ) - absOffX;
++    long long offsetCount = absOffY * bigW;
++    long long bytesLeftPerLine = static_cast<long long>( INT_MAX ) / bigW;
++    if (bytesLeftPerLine < absOffY || offX < offsetCount)
++    {
++	THROW (IEX_NAMESPACE::ArgExc, "Data window [ (" << dataWindow.min.x
++	       << ", " << dataWindow.min.x << ") - (" << dataWindow.max.x
++	       << ", " << dataWindow.max.x
++	       << ") ] offset / size will overflow pointer calculations");
++    }
++
++    // chunk table must be smaller than the maximum image area
++    // (only reachable for unknown types or damaged files: will have thrown earlier
++    //  for regular image types)
++    if( maxImageHeight>0 && maxImageWidth>0 && 
++	hasChunkCount() && chunkCount()>Int64(maxImageWidth)*Int64(maxImageHeight))
++    {
++	THROW (IEX_NAMESPACE::ArgExc, "chunkCount exceeds maximum area of "
++	       << Int64(maxImageWidth)*Int64(maxImageHeight) << " pixels." );
+        
+-   }
++    }
+ 
+ 
+     //
diff --git a/graphics/openexr/files/patch-IlmImf_ImfRgbaFile.h b/graphics/openexr/files/patch-IlmImf_ImfRgbaFile.h
new file mode 100644
index 000000000000..8c9469aef1f9
--- /dev/null
+++ b/graphics/openexr/files/patch-IlmImf_ImfRgbaFile.h
@@ -0,0 +1,68 @@
+--- IlmImf/ImfRgbaFile.h.orig	2018-08-10 01:34:58 UTC
++++ IlmImf/ImfRgbaFile.h
+@@ -60,6 +60,65 @@
+ 
+ OPENEXR_IMF_INTERNAL_NAMESPACE_HEADER_ENTER
+ 
++//-------------------------------------------------------
++// Utility to compute the origin-based pointer address
++//
++// With large offsets for the data window, the naive code
++// can wrap around, especially on 32-bit machines.
++// This can be used to avoid that
++//-------------------------------------------------------
++
++inline const Rgba *
++ComputeBasePointer (
++    const Rgba*                 ptr,
++    const IMATH_NAMESPACE::V2i& origin,
++    int64_t                     w,
++    size_t                      xStride = 1,
++    size_t                      yStride = 0)
++{
++    if (yStride == 0)
++        yStride = w;
++    int64_t offx = static_cast<int64_t> (origin.x);
++    offx *= xStride;
++    int64_t offy = static_cast<int64_t> (origin.y);
++    offy *= yStride;
++    return ptr - offx - offy;
++}
++
++inline const Rgba *
++ComputeBasePointer (const Rgba* ptr, const IMATH_NAMESPACE::Box2i& dataWindow)
++{
++    return ComputeBasePointer (ptr, dataWindow.min,
++                         static_cast<int64_t> (dataWindow.max.x) -
++                          static_cast<int64_t> (dataWindow.min.x) + 1);
++}
++
++inline Rgba*
++ComputeBasePointer (
++    Rgba*                       ptr,
++    const IMATH_NAMESPACE::V2i& origin,
++    int64_t                     w,
++    size_t                      xStride = 1,
++    size_t                      yStride = 0)
++{
++    if (yStride == 0)
++        yStride = w;
++    int64_t offx = static_cast<int64_t> (origin.x);
++    offx *= xStride;
++    int64_t offy = static_cast<int64_t> (origin.y);
++    offy *= yStride;
++    return ptr - offx - offy;
++}
++
++inline Rgba*
++ComputeBasePointer (Rgba* ptr, const IMATH_NAMESPACE::Box2i& dataWindow)
++{
++    return ComputeBasePointer (
++        ptr,
++        dataWindow.min,
++        static_cast<int64_t> (dataWindow.max.x) -
++            static_cast<int64_t> (dataWindow.min.x) + 1);
++}
+ 
+ //
+ // RGBA output file.
diff --git a/graphics/openexr/files/patch-IlmImf_ImfScanLineInputFile.cpp b/graphics/openexr/files/patch-IlmImf_ImfScanLineInputFile.cpp
new file mode 100644
index 000000000000..20f30dcd6966
--- /dev/null
+++ b/graphics/openexr/files/patch-IlmImf_ImfScanLineInputFile.cpp
@@ -0,0 +1,52 @@
+--- IlmImf/ImfScanLineInputFile.cpp.orig	2018-08-10 01:34:58 UTC
++++ IlmImf/ImfScanLineInputFile.cpp
+@@ -524,14 +524,14 @@ LineBufferTask::execute ()
+     
+         if (_lineBuffer->uncompressedData == 0)
+         {
+-            int uncompressedSize = 0;
++            size_t uncompressedSize = 0;
+             int maxY = min (_lineBuffer->maxY, _ifd->maxY);
+     
+             for (int i = _lineBuffer->minY - _ifd->minY;
+                  i <= maxY - _ifd->minY;
+ 		 ++i)
+ 	    {
+-                uncompressedSize += (int) _ifd->bytesPerLine[i];
++                uncompressedSize += _ifd->bytesPerLine[i];
+ 	    }
+     
+             if (_lineBuffer->compressor &&
+@@ -628,11 +628,11 @@ LineBufferTask::execute ()
+                     //
+     
+                     char *linePtr  = slice.base +
+-                                        divp (y, slice.ySampling) *
+-                                        slice.yStride;
++                                        intptr_t( divp (y, slice.ySampling) ) *
++                                        intptr_t( slice.yStride );
+     
+-                    char *writePtr = linePtr + dMinX * slice.xStride;
+-                    char *endPtr   = linePtr + dMaxX * slice.xStride;
++                    char *writePtr = linePtr + intptr_t( dMinX ) * intptr_t( slice.xStride );
++                    char *endPtr   = linePtr + intptr_t( dMaxX ) * intptr_t( slice.xStride );
+                     
+                     copyIntoFrameBuffer (readPtr, writePtr, endPtr,
+                                          slice.xStride, slice.fill,
+@@ -838,14 +838,14 @@ LineBufferTaskIIF::execute()
+         
+         if (_lineBuffer->uncompressedData == 0)
+         {
+-            int uncompressedSize = 0;
++            size_t uncompressedSize = 0;
+             int maxY = min (_lineBuffer->maxY, _ifd->maxY);
+             
+             for (int i = _lineBuffer->minY - _ifd->minY;
+             i <= maxY - _ifd->minY;
+             ++i)
+             {
+-                uncompressedSize += (int) _ifd->bytesPerLine[i];
++                uncompressedSize += _ifd->bytesPerLine[i];
+             }
+             
+             if (_lineBuffer->compressor &&
diff --git a/graphics/openexr/files/patch-IlmImf__ImfSystemSpecific.cpp b/graphics/openexr/files/patch-IlmImf_ImfSystemSpecific.cpp
index 74e5054a3175..fb41a812614b 100644
--- a/graphics/openexr/files/patch-IlmImf__ImfSystemSpecific.cpp
+++ b/graphics/openexr/files/patch-IlmImf_ImfSystemSpecific.cpp
@@ -1,4 +1,4 @@
---- IlmImf/ImfSystemSpecific.cpp.orig	2017-11-17 23:00:24 UTC
+--- IlmImf/ImfSystemSpecific.cpp.orig	2018-08-10 01:34:58 UTC
 +++ IlmImf/ImfSystemSpecific.cpp
 @@ -44,11 +44,23 @@ namespace {
      // Helper functions for gcc + SSE enabled
diff --git a/graphics/openexr/files/patch-exrenvmap__main.cpp b/graphics/openexr/files/patch-exrenvmap_main.cpp
index 77cab6dfc684..5c6c30d4b7cb 100644
--- a/graphics/openexr/files/patch-exrenvmap__main.cpp
+++ b/graphics/openexr/files/patch-exrenvmap_main.cpp
@@ -1,4 +1,4 @@
---- exrenvmap/main.cpp.orig	2014-08-10 04:24:00 UTC
+--- exrenvmap/main.cpp.orig	2018-08-10 01:35:00 UTC
 +++ exrenvmap/main.cpp
 @@ -47,6 +47,7 @@
  #include <ImfHeader.h>
diff --git a/graphics/openexr/files/patch-exrenvmap_readInputImage.cpp b/graphics/openexr/files/patch-exrenvmap_readInputImage.cpp
new file mode 100644
index 000000000000..4e09ed86a59b
--- /dev/null
+++ b/graphics/openexr/files/patch-exrenvmap_readInputImage.cpp
@@ -0,0 +1,11 @@
+--- exrenvmap/readInputImage.cpp.orig	2018-08-10 01:35:00 UTC
++++ exrenvmap/readInputImage.cpp
+@@ -194,7 +194,7 @@ readSixImages (const char inFileName[],
+                    "from the data window of other cube faces.");
+         }
+ 
+-        in.setFrameBuffer (pixels - dw.min.x - dw.min.y * w, 1, w);
++        in.setFrameBuffer (ComputeBasePointer (pixels, dw), 1, w);
+         in.readPixels (dw.min.y, dw.max.y);
+ 
+         pixels += w * h;
diff --git a/graphics/openexr/files/patch-exrmakepreview_makePreview.cpp b/graphics/openexr/files/patch-exrmakepreview_makePreview.cpp
new file mode 100644
index 000000000000..1654923d7465
--- /dev/null
+++ b/graphics/openexr/files/patch-exrmakepreview_makePreview.cpp
@@ -0,0 +1,11 @@
+--- exrmakepreview/makePreview.cpp.orig	2018-08-10 01:35:00 UTC
++++ exrmakepreview/makePreview.cpp
+@@ -110,7 +110,7 @@ generatePreview (const char inFileName[],
+     int h = dw.max.y - dw.min.y + 1;
+ 
+     Array2D <Rgba> pixels (h, w);
+-    in.setFrameBuffer (&pixels[0][0] - dw.min.y * w - dw.min.x, 1, w);
++    in.setFrameBuffer (ComputeBasePointer (&pixels[0][0], dw), 1, w);
+     in.readPixels (dw.min.y, dw.max.y);
+ 
+     //
diff --git a/graphics/openexr/files/patch-exrmaketiled_Image.h b/graphics/openexr/files/patch-exrmaketiled_Image.h
new file mode 100644
index 000000000000..21aef45d0335
--- /dev/null
+++ b/graphics/openexr/files/patch-exrmaketiled_Image.h
@@ -0,0 +1,20 @@
+--- exrmaketiled/Image.h.orig	2018-08-10 01:35:00 UTC
++++ exrmaketiled/Image.h
+@@ -190,12 +190,12 @@ OPENEXR_IMF_INTERNAL_NAMESPACE::Slice
+ TypedImageChannel<T>::slice () const
+ {
+     const IMATH_NAMESPACE::Box2i &dw = image().dataWindow();
+-    int w = dw.max.x - dw.min.x + 1;
+ 
+-    return OPENEXR_IMF_INTERNAL_NAMESPACE::Slice (pixelType(),
+-		       (char *) (&_pixels[0][0] - dw.min.y * w - dw.min.x),
+-		       sizeof (T),
+-		       w * sizeof (T));
++    return OPENEXR_IMF_INTERNAL_NAMESPACE::Slice::Make (
++        pixelType(),
++        &_pixels[0][0],
++        dw,
++        sizeof (T));
+ }
+ 
+ 
diff --git a/graphics/openexr/files/patch-exrmaketiled__main.cpp b/graphics/openexr/files/patch-exrmaketiled_main.cpp
index 7b83c1a5a5a1..857ff8a6268d 100644
--- a/graphics/openexr/files/patch-exrmaketiled__main.cpp
+++ b/graphics/openexr/files/patch-exrmaketiled_main.cpp
@@ -1,4 +1,4 @@
---- exrmaketiled/main.cpp.orig	2014-08-10 04:24:00 UTC
+--- exrmaketiled/main.cpp.orig	2018-08-10 01:35:00 UTC
 +++ exrmaketiled/main.cpp
 @@ -43,6 +43,7 @@
  #include "makeTiled.h"
diff --git a/graphics/openexr/files/patch-exrmultiview_Image.h b/graphics/openexr/files/patch-exrmultiview_Image.h
new file mode 100644
index 000000000000..6fe137edef07
--- /dev/null
+++ b/graphics/openexr/files/patch-exrmultiview_Image.h
@@ -0,0 +1,45 @@
+--- exrmultiview/Image.h.orig	2018-08-10 01:35:00 UTC
++++ exrmultiview/Image.h
+@@ -159,6 +159,8 @@ TypedImageChannel<T>::TypedImageChannel
+     _ySampling (ySampling),
+     _pixels (0, 0)
+ {
++    if ( _xSampling < 1 || _ySampling < 1 )
++        throw IEX_NAMESPACE::ArgExc ("Invalid x/y sampling values");
+     resize();
+ }
+ 
+@@ -201,14 +203,14 @@ TypedImageChannel<T>::slice () const
+     const IMATH_NAMESPACE::Box2i &dw = image().dataWindow();
+     int w = dw.max.x - dw.min.x + 1;
+ 
+-    return IMF::Slice (pixelType(),
+-		       (char *) (&_pixels[0][0] -
+-				 dw.min.y / _ySampling * (w / _xSampling) -
+-				 dw.min.x / _xSampling),
+-		       sizeof (T),
+-		       (w / _xSampling) * sizeof (T),
+-		       _xSampling,
+-		       _ySampling);
++    return IMF::Slice::Make (
++        pixelType(),
++        &_pixels[0][0],
++        dw,
++        sizeof(T),
++        (w / _xSampling) * sizeof (T),
++        _xSampling,
++        _ySampling);
+ }
+ 
+ 
+@@ -227,7 +229,9 @@ template <class T>
+ void
+ TypedImageChannel<T>::black ()
+ {
+-    memset(&_pixels[0][0],0,image().width()/_xSampling*image().height()/_ySampling*sizeof(T));
++    size_t nx = static_cast<size_t>( image().width() ) / static_cast<size_t>( _xSampling );
++    size_t ny = static_cast<size_t>( image().height() ) / static_cast<size_t>( _ySampling );
++    memset(&_pixels[0][0],0,nx*ny*sizeof(T));
+ }
+ 
+