CVS commit: pkgsrc/graphics/libheif

["Thomas Klausner" <wiz%netbsd.org@localhost>]

Module Name:    pkgsrc
Committed By:   wiz
Date:           Sun Aug 30 15:07:41 UTC 2026

Modified Files:
        pkgsrc/graphics/libheif: Makefile distinfo

Log Message:
libheif: update to 1.23.2.

v1.23.2 is a security and bugfix release. It is ABI- and API-compatible with v1.23.1 and is a drop-in replacement.

Two of the fixed issues are rated critical, so all users are strongly advised to upgrade.
Security fixes

(CVE numbers will be added when assigned.)

    CVE-2026-XXXXX (GHSA-g89c-p67h-r497) Heap buffer overflow in scale_nearest_neighbor() via duplicate alpha planes from nested iden/auxl items. (critical)
    (GHSA-2jg2-4ch7-h545) Out-of-bounds read and write in derived-item and pixel-plane handling. Through iden and auxl item chains, a crafted file could attach pixel planes whose size differs from 
the image geometry; crop, scale, and plane-extraction code then indexed those planes with the wrong size. A working code-execution exploit was confirmed. Plane sizes are now validated wherever they 
are consumed. (critical)
    CVE-2026-XXXXX (GHSA-24wx-9w62-c96w) brotli/zlib decompression of mime metadata and unci image data had no effective output-size limit, so a decompression bomb could exhaust memory. Decompressed 
output is now bounded by the security limits. (high)
    CVE-2026-XXXXX (GHSA-x8xm-cm2c-cfc8) Chains of derived-image references (grid, iovl, iden) bypassed decode caching and memory limits, causing CPU and memory amplification. (high)
    CVE-2026-XXXXX (GHSA-xw34-mjcp-jqh8) Sequence sample-timing initialization could produce non-terminating decode loops and unbounded memory, bypassing max_sequence_frames. (high)
    CVE-2026-XXXXX (GHSA-j264-xvrp-5v7q) Out-of-bounds write in the unci encoder when heif_context_add_image_tile() is given a tile whose planes do not match its declared size. (high)
    CVE-2026-XXXXX (GHSA-p58j-h3vm-3fp5) Heap out-of-bounds read in the inline-mask region API when mask_data_len does not match the region geometry. (medium)

Thanks to David Schutz (Meta Product Security), @rootxharsh, @KarimPwnz, @hacktronai-research, @Nora-Qiu, @holimart, @buraks1998, and @zenniskayy2k4 for reporting these issues.
Hardening

    C++ exceptions such as std::bad_alloc can no longer escape the C API read/decode entry points; they are returned as a heif_error instead of aborting the process
    assert()s in the pixel-image plane allocation were replaced by runtime errors
    stts/ctts tables describing more samples than the track can have are rejected
    pclr (JPEG 2000 palette) box: the number of palette entries is bounded by the box size
    BitReader::skip_bytes() is now constant time (fixes a fuzzer timeout on bogus alignment values)
    iden items now validate the decoded image size like all other items
    The uncompressed (unci) encoder rejects images without pixel planes

Bug fixes

    meta, mini, and moov boxes with size 0 (extending to the end of the file) are now parsed correctly (#1857)
    Fixed an integer overflow when probing the file size (#1857)
    Fixed undefined behavior (signed shift) when reading the NAL unit length in the OpenH264 decoder

Behavior changes

    heif_region_item_add_region_inline_mask_data() now requires non-zero width and height and the mask_data_len must equal the expected (width * height + 7) / 8; otherwise it returns an error instead 
of storing the mask
    heif_image_add_plane() returns an error instead of aborting for bit depths outside 1..128 or interleaved component counts outside 1..255


To generate a diff of this commit:
cvs rdiff -u -r1.57 -r1.58 pkgsrc/graphics/libheif/Makefile
cvs rdiff -u -r1.49 -r1.50 pkgsrc/graphics/libheif/distinfo

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.

Modified files:

Index: pkgsrc/graphics/libheif/Makefile
diff -u pkgsrc/graphics/libheif/Makefile:1.57 pkgsrc/graphics/libheif/Makefile:1.58
--- pkgsrc/graphics/libheif/Makefile:1.57       Sun Jun 28 14:00:09 2026
+++ pkgsrc/graphics/libheif/Makefile    Sun Aug 30 15:07:40 2026
@@ -1,6 +1,6 @@
-# $NetBSD: Makefile,v 1.57 2026/06/28 14:00:09 wiz Exp $
+# $NetBSD: Makefile,v 1.58 2026/08/30 15:07:40 wiz Exp $
 
-DISTNAME=      libheif-1.23.1
+DISTNAME=      libheif-1.23.2
 CATEGORIES=    graphics
 MASTER_SITES=  ${MASTER_SITE_GITHUB:=strukturag/}
 GITHUB_RELEASE=        v${PKGVERSION_NOREV}

Index: pkgsrc/graphics/libheif/distinfo
diff -u pkgsrc/graphics/libheif/distinfo:1.49 pkgsrc/graphics/libheif/distinfo:1.50
--- pkgsrc/graphics/libheif/distinfo:1.49       Thu Jul  2 14:39:18 2026
+++ pkgsrc/graphics/libheif/distinfo    Sun Aug 30 15:07:40 2026
@@ -1,6 +1,6 @@
-$NetBSD: distinfo,v 1.49 2026/07/02 14:39:18 tnn Exp $
+$NetBSD: distinfo,v 1.50 2026/08/30 15:07:40 wiz Exp $
 
-BLAKE2s (libheif-1.23.1.tar.gz) = 60738659a152a65aef0bd71a0e7ced02a933352df895fced9a6924003d9b8144
-SHA512 (libheif-1.23.1.tar.gz) = 6257d9c8cf75c9880f0f60e9f62722730bd189cd132dc55701985e5fd14f096ca9958a6c987df7a1633f9897087f7c755f6e78c6a388cddb04f6227b06a35873
-Size (libheif-1.23.1.tar.gz) = 2071186 bytes
+BLAKE2s (libheif-1.23.2.tar.gz) = 4b1194dc28d06a3daa5247137ce2b619ccf2d46c3d4aa0eb62c9aca269d0331a
+SHA512 (libheif-1.23.2.tar.gz) = c40fb665e9e0e1b0ea1c618dc189f88afdb0738992ff3601fefd0a94d3c3ba089867f6b2cb141278462dd1c7e139f6af280356a9130281122e1f764096e170cb
+Size (libheif-1.23.2.tar.gz) = 2111195 bytes
 SHA1 (patch-heifio_CMakeLists.txt) = dda4522707589342898c29bba189557895d75178