mirrors/meta-openembedded
1
0 Fork 0
mirror of https://github.com/openembedded/meta-openembedded.git synced 2026-10-15 06:17:16 +00:00
Code Issues Projects Releases Wiki Activity

libheif: patch CVE-2026-41071

Browse Source 
Backport commit identified by Debian[1]
Also backport[2] which is needed to cherry-pick[1]

Details:
https://nvd.nist.gov/vuln/detail/cve-2026-41071

[1]https://security-tracker.debian.org/tracker/CVE-2026-41071
[2]https://github.com/strukturag/libheif/commit/71755d3d41a117685a3274bdd1214fc50a760f20

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
This commit is contained in:
Ankur Tyagi authored and Anuj Mittal committed 2026-09-15 07:52:09 +05:30
1 parent bb1a4701e6
commit 14e1292075
3 files changed
+80
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

meta-multimedia/recipes-multimedia/libheif/libheif/CVE-2026-41071-1.patch
+34
View File
@@ -0,0 +1,34 @@
From 415b59839dcf46bb05e08de7422a21e65ab28e03 Mon Sep 17 00:00:00 2001
From: Dirk Farin <dirk.farin@gmail.com>
Date: Mon, 13 Apr 2026 19:49:06 +0200
Subject: [PATCH] fix: reject malformed sequence files with saiz samples but no
chunks
(cherry picked from commit 71755d3d41a117685a3274bdd1214fc50a760f20)
CVE: CVE-2026-41071
Upstream-Status: Backport [https://github.com/strukturag/libheif/commit/71755d3d41a117685a3274bdd1214fc50a760f20]
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
---
libheif/sequences/track.cc | 8 ++++++++
1 file changed, 8 insertions(+)
diff --git a/libheif/sequences/track.cc b/libheif/sequences/track.cc
index acb916fa..ac5d5687 100644
--- a/libheif/sequences/track.cc
+++ b/libheif/sequences/track.cc
@@ -443,6 +443,14 @@ Error Track::load(const std::shared_ptr<Box_trak>& trak_box)
};
}
+ if (saio->get_num_chunks() != 1 && m_chunks.empty() && saiz->get_num_samples() > 0) {
+ return Error{
+ heif_error_Invalid_input,
+ heif_suberror_Unspecified,
+ "'saiz' box references samples but no chunks exist."
+ };
+ }
+
if (aux_info_type == fourcc("suid")) {
m_aux_reader_content_ids = std::make_unique<SampleAuxInfoReader>(saiz, saio, m_chunks);
}
meta-multimedia/recipes-multimedia/libheif/libheif/CVE-2026-41071-2.patch
+44
View File
@@ -0,0 +1,44 @@
From b79d7d2a4f1502e93739453025ac2dbfd59e514f Mon Sep 17 00:00:00 2001
From: Dirk Farin <dirk.farin@gmail.com>
Date: Mon, 13 Apr 2026 20:09:26 +0200
Subject: [PATCH] fix: reject malformed sequence files where saiz sample count
exceeds actual samples
(cherry picked from commit f20c81745e917b4c496615140385c86d7a2fa58d)
CVE: CVE-2026-41071
Upstream-Status: Backport [https://github.com/strukturag/libheif/commit/f20c81745e917b4c496615140385c86d7a2fa58d]
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
---
libheif/sequences/track.cc | 12 +++++++++++-
1 file changed, 11 insertions(+), 1 deletion(-)
diff --git a/libheif/sequences/track.cc b/libheif/sequences/track.cc
index ac5d5687..e4b08afa 100644
--- a/libheif/sequences/track.cc
+++ b/libheif/sequences/track.cc
@@ -138,7 +138,9 @@ SampleAuxInfoReader::SampleAuxInfoReader(std::shared_ptr<Box_saiz> saiz,
for (uint32_t i = 0; i < nSamples; i++) {
if (!oneChunk && i > chunks[current_chunk]->last_sample_number()) {
current_chunk++;
- assert(current_chunk < chunks.size());
+ if (current_chunk >= chunks.size()) {
+ break;
+ }
offset = saio->get_chunk_offset(current_chunk);
}
@@ -451,6 +453,14 @@ Error Track::load(const std::shared_ptr<Box_trak>& trak_box)
};
}
+ if (saiz->get_num_samples() > m_stsz->num_samples()) {
+ return Error{
+ heif_error_Invalid_input,
+ heif_suberror_Unspecified,
+ "Number of samples in 'saiz' box exceeds actual number of samples."
+ };
+ }
+
if (aux_info_type == fourcc("suid")) {
m_aux_reader_content_ids = std::make_unique<SampleAuxInfoReader>(saiz, saio, m_chunks);
}
meta-multimedia/recipes-multimedia/libheif/libheif_1.21.2.bb
+2
View File
@@ -12,6 +12,8 @@ SRC_URI = "git://github.com/strukturag/libheif.git;protocol=https;branch=master;
file://CVE-2026-32739.patch \
file://CVE-2026-32740.patch \
file://CVE-2026-32741.patch \
file://CVE-2026-41071-1.patch \
file://CVE-2026-41071-2.patch \
"
SRCREV = "62f1b8c76ed4d8305071fdacbe74ef9717bacac5"