Index: openexr-1.6.1/IlmImf/ImfHeader.cpp
===================================================================
--- openexr-1.6.1.orig/IlmImf/ImfHeader.cpp	2020-04-22 11:01:09.325125427 +0200
+++ openexr-1.6.1/IlmImf/ImfHeader.cpp	2020-04-22 11:03:10.657745445 +0200
@@ -620,7 +620,7 @@ Header::sanityCheck (bool isTiled) const
 
 	const TileDescription &tileDesc = tileDescription();
 
-	if (tileDesc.xSize <= 0 || tileDesc.ySize <= 0)
+	if (tileDesc.xSize <= 0 || tileDesc.ySize <= 0 || tileDesc.xSize > INT_MAX || tileDesc.ySize > INT_MAX )
 	    throw Iex::ArgExc ("Invalid tile size in image header.");
 
 	if (maxTileWidth > 0 &&
Index: openexr-1.6.1/IlmImf/ImfHuf.cpp
===================================================================
--- openexr-1.6.1.orig/IlmImf/ImfHuf.cpp	2020-04-22 11:01:09.293125263 +0200
+++ openexr-1.6.1/IlmImf/ImfHuf.cpp	2020-04-22 11:01:09.325125427 +0200
@@ -1030,7 +1030,10 @@ hufUncompress (const char compressed[],
 	       unsigned short raw[],
 	       int nRaw)
 {
-    if (nCompressed == 0)
+    //
+    // need at least 20 bytes for header
+    //
+    if (nCompressed < 20 )
     {
 	if (nRaw != 0)
 	    notEnoughData();
@@ -1048,6 +1051,12 @@ hufUncompress (const char compressed[],
 
     const char *ptr = compressed + 20;
 
+    if ( ptr + (nBits+7 )/8 > compressed+nCompressed)
+    {
+        notEnoughData();
+        return;
+    }
+
     AutoArray <Int64, HUF_ENCSIZE> freq;
     AutoArray <HufDec, HUF_DECSIZE> hdec;
 
Index: openexr-1.6.1/IlmImf/ImfMisc.cpp
===================================================================
--- openexr-1.6.1.orig/IlmImf/ImfMisc.cpp	2006-08-09 02:24:35.000000000 +0200
+++ openexr-1.6.1/IlmImf/ImfMisc.cpp	2020-04-22 11:01:09.325125427 +0200
@@ -110,9 +110,9 @@ bytesPerLineTable (const Header &header,
 	 c != channels.end();
 	 ++c)
     {
-	int nBytes = pixelTypeSize (c.channel().type) *
-		     (dataWindow.max.x - dataWindow.min.x + 1) /
-		     c.channel().xSampling;
+	size_t nBytes = size_t(pixelTypeSize (c.channel().type)) *
+		     size_t(dataWindow.max.x - dataWindow.min.x + 1) /
+		     size_t(c.channel().xSampling);
 
 	for (int y = dataWindow.min.y, i = 0; y <= dataWindow.max.y; ++y, ++i)
 	    if (modp (y, c.channel().ySampling) == 0)
Index: openexr-1.6.1/IlmImf/ImfPizCompressor.cpp
===================================================================
--- openexr-1.6.1.orig/IlmImf/ImfPizCompressor.cpp	2020-04-22 11:01:09.293125263 +0200
+++ openexr-1.6.1/IlmImf/ImfPizCompressor.cpp	2020-04-22 11:01:09.329125447 +0200
@@ -484,7 +484,9 @@ PizCompressor::uncompress (const char *i
     // This is the cunompress function which is used by both the tiled and
     // scanline decompression routines.
     //
-    
+
+    const char* inputEnd=inPtr+inSize;
+
     //
     // Special case - empty input buffer
     //
@@ -495,6 +497,7 @@ PizCompressor::uncompress (const char *i
 	return 0;
     }
 
+
     //
     // Determine the layout of the compressed pixel data
     //
@@ -541,6 +544,12 @@ PizCompressor::uncompress (const char *i
     AutoArray <unsigned char, BITMAP_SIZE> bitmap;
     memset (bitmap, 0, sizeof (unsigned char) * BITMAP_SIZE);
 
+
+    if(inPtr + sizeof(unsigned short)*2 > inputEnd)
+    {
+   	   throw InputExc ("PIZ compressed data too short");
+    }
+
     Xdr::read <CharPtrIO> (inPtr, minNonZero);
     Xdr::read <CharPtrIO> (inPtr, maxNonZero);
 
@@ -552,8 +561,14 @@ PizCompressor::uncompress (const char *i
 
     if (minNonZero <= maxNonZero)
     {
-	Xdr::read <CharPtrIO> (inPtr, (char *) &bitmap[0] + minNonZero,
-			       maxNonZero - minNonZero + 1);
+        size_t bytesToRead = maxNonZero - minNonZero + 1;
+	    if(inPtr + bytesToRead > inputEnd)
+        {
+   	      throw InputExc ("PIZ compressed data too short");
+        }
+
+Xdr::read <CharPtrIO> (inPtr, (char *) &bitmap[0] + minNonZero,
+			       bytesToRead);
     }
 
     AutoArray <unsigned short, USHORT_RANGE> lut;
@@ -562,6 +577,11 @@ PizCompressor::uncompress (const char *i
     //
     // Huffman decoding
     //
+   if(inPtr + sizeof(int)> inputEnd)
+   {
+       throw InputExc ("PIZ compressed data too short");
+   }
+
 
     int length;
     Xdr::read <CharPtrIO> (inPtr, length);
Index: openexr-1.6.1/IlmImf/ImfRleCompressor.cpp
===================================================================
--- openexr-1.6.1.orig/IlmImf/ImfRleCompressor.cpp	2020-04-22 11:01:09.277125181 +0200
+++ openexr-1.6.1/IlmImf/ImfRleCompressor.cpp	2020-04-22 11:01:09.329125447 +0200
@@ -135,6 +135,11 @@ rleUncompress (int inLength, int maxLeng
 	    if (0 > (maxLength -= count))
 		return 0;
 
+	    // check the input buffer is big enough to contain
+	    // 'count' bytes of remaining data
+	    if (inLength < 0)
+		return 0;
+
 	    while (count-- > 0)
 		*out++ = *(char *) (in++);
 	}
Index: openexr-1.6.1/IlmImf/ImfScanLineInputFile.cpp
===================================================================
--- openexr-1.6.1.orig/IlmImf/ImfScanLineInputFile.cpp	2007-09-21 06:15:33.000000000 +0200
+++ openexr-1.6.1/IlmImf/ImfScanLineInputFile.cpp	2020-04-22 11:01:09.329125447 +0200
@@ -668,6 +668,12 @@ ScanLineInputFile::ScanLineInputFile
 	size_t maxBytesPerLine = bytesPerLineTable (_data->header,
                                                     _data->bytesPerLine);
 
+        if(maxBytesPerLine > INT_MAX)
+        {
+            throw Iex::InputExc("maximum bytes per scanline exceeds maximum permissible size");
+        }
+
+
         for (size_t i = 0; i < _data->lineBuffers.size(); i++)
         {
             _data->lineBuffers[i] = new LineBuffer (newCompressor
Index: openexr-1.6.1/IlmImf/ImfTiledMisc.cpp
Index: openexr-1.6.1/exrmakepreview/makePreview.cpp
===================================================================
--- openexr-1.6.1.orig/exrmakepreview/makePreview.cpp	2020-04-22 11:01:09.305125325 +0200
+++ openexr-1.6.1/exrmakepreview/makePreview.cpp	2020-04-22 11:01:09.329125447 +0200
@@ -122,8 +122,8 @@ generatePreview (const char inFileName[]
     previewHeight = max (int (h / (w * a) * previewWidth + .5f), 1);
     previewPixels.resizeErase (previewHeight, previewWidth);
 
-    float fx = (previewWidth  > 0)? (float (w - 1) / (previewWidth  - 1)): 1;
-    float fy = (previewHeight > 0)? (float (h - 1) / (previewHeight - 1)): 1;
+    double fx = (previewWidth  > 0)? (double (w - 1) / (previewWidth  - 1)): 1;
+    double fy = (previewHeight > 0)? (double (h - 1) / (previewHeight - 1)): 1;
     float m  = Math<float>::pow (2.f, clamp (exposure + 2.47393f, -20.f, 20.f));
 
     for (int y = 0; y < previewHeight; ++y)
