From 14e12920756294b06268432c9b199b0239ab4526 Mon Sep 17 00:00:00 2001 From: Ankur Tyagi Date: Thu, 3 Sep 2026 21:49:43 +1200 Subject: [PATCH] libheif: patch CVE-2026-41071 Backport commit identified by Debian[1] Also backport[2] which is needed to cherry-pick[1] Details: https://nvd.nist.gov/vuln/detail/cve-2026-41071 [1]https://security-tracker.debian.org/tracker/CVE-2026-41071 [2]https://github.com/strukturag/libheif/commit/71755d3d41a117685a3274bdd1214fc50a760f20 Signed-off-by: Ankur Tyagi Signed-off-by: Anuj Mittal --- .../libheif/libheif/CVE-2026-41071-1.patch | 34 ++++++++++++++ .../libheif/libheif/CVE-2026-41071-2.patch | 44 +++++++++++++++++++ .../libheif/libheif_1.21.2.bb | 2 + 3 files changed, 80 insertions(+) create mode 100644 meta-multimedia/recipes-multimedia/libheif/libheif/CVE-2026-41071-1.patch create mode 100644 meta-multimedia/recipes-multimedia/libheif/libheif/CVE-2026-41071-2.patch diff --git a/meta-multimedia/recipes-multimedia/libheif/libheif/CVE-2026-41071-1.patch b/meta-multimedia/recipes-multimedia/libheif/libheif/CVE-2026-41071-1.patch new file mode 100644 index 0000000000..7971ea3cef --- /dev/null +++ b/meta-multimedia/recipes-multimedia/libheif/libheif/CVE-2026-41071-1.patch @@ -0,0 +1,34 @@ +From 415b59839dcf46bb05e08de7422a21e65ab28e03 Mon Sep 17 00:00:00 2001 +From: Dirk Farin +Date: Mon, 13 Apr 2026 19:49:06 +0200 +Subject: [PATCH] fix: reject malformed sequence files with saiz samples but no + chunks + +(cherry picked from commit 71755d3d41a117685a3274bdd1214fc50a760f20) + +CVE: CVE-2026-41071 +Upstream-Status: Backport [https://github.com/strukturag/libheif/commit/71755d3d41a117685a3274bdd1214fc50a760f20] +Signed-off-by: Ankur Tyagi +--- + libheif/sequences/track.cc | 8 ++++++++ + 1 file changed, 8 insertions(+) + +diff --git a/libheif/sequences/track.cc b/libheif/sequences/track.cc +index acb916fa..ac5d5687 100644 +--- a/libheif/sequences/track.cc ++++ b/libheif/sequences/track.cc +@@ -443,6 +443,14 @@ Error Track::load(const std::shared_ptr& trak_box) + }; + } + ++ if (saio->get_num_chunks() != 1 && m_chunks.empty() && saiz->get_num_samples() > 0) { ++ return Error{ ++ heif_error_Invalid_input, ++ heif_suberror_Unspecified, ++ "'saiz' box references samples but no chunks exist." ++ }; ++ } ++ + if (aux_info_type == fourcc("suid")) { + m_aux_reader_content_ids = std::make_unique(saiz, saio, m_chunks); + } diff --git a/meta-multimedia/recipes-multimedia/libheif/libheif/CVE-2026-41071-2.patch b/meta-multimedia/recipes-multimedia/libheif/libheif/CVE-2026-41071-2.patch new file mode 100644 index 0000000000..952c366966 --- /dev/null +++ b/meta-multimedia/recipes-multimedia/libheif/libheif/CVE-2026-41071-2.patch @@ -0,0 +1,44 @@ +From b79d7d2a4f1502e93739453025ac2dbfd59e514f Mon Sep 17 00:00:00 2001 +From: Dirk Farin +Date: Mon, 13 Apr 2026 20:09:26 +0200 +Subject: [PATCH] fix: reject malformed sequence files where saiz sample count + exceeds actual samples + +(cherry picked from commit f20c81745e917b4c496615140385c86d7a2fa58d) +CVE: CVE-2026-41071 +Upstream-Status: Backport [https://github.com/strukturag/libheif/commit/f20c81745e917b4c496615140385c86d7a2fa58d] +Signed-off-by: Ankur Tyagi +--- + libheif/sequences/track.cc | 12 +++++++++++- + 1 file changed, 11 insertions(+), 1 deletion(-) + +diff --git a/libheif/sequences/track.cc b/libheif/sequences/track.cc +index ac5d5687..e4b08afa 100644 +--- a/libheif/sequences/track.cc ++++ b/libheif/sequences/track.cc +@@ -138,7 +138,9 @@ SampleAuxInfoReader::SampleAuxInfoReader(std::shared_ptr saiz, + for (uint32_t i = 0; i < nSamples; i++) { + if (!oneChunk && i > chunks[current_chunk]->last_sample_number()) { + current_chunk++; +- assert(current_chunk < chunks.size()); ++ if (current_chunk >= chunks.size()) { ++ break; ++ } + offset = saio->get_chunk_offset(current_chunk); + } + +@@ -451,6 +453,14 @@ Error Track::load(const std::shared_ptr& trak_box) + }; + } + ++ if (saiz->get_num_samples() > m_stsz->num_samples()) { ++ return Error{ ++ heif_error_Invalid_input, ++ heif_suberror_Unspecified, ++ "Number of samples in 'saiz' box exceeds actual number of samples." ++ }; ++ } ++ + if (aux_info_type == fourcc("suid")) { + m_aux_reader_content_ids = std::make_unique(saiz, saio, m_chunks); + } diff --git a/meta-multimedia/recipes-multimedia/libheif/libheif_1.21.2.bb b/meta-multimedia/recipes-multimedia/libheif/libheif_1.21.2.bb index 92891cb5ef..f3f03abdc7 100644 --- a/meta-multimedia/recipes-multimedia/libheif/libheif_1.21.2.bb +++ b/meta-multimedia/recipes-multimedia/libheif/libheif_1.21.2.bb @@ -12,6 +12,8 @@ SRC_URI = "git://github.com/strukturag/libheif.git;protocol=https;branch=master; file://CVE-2026-32739.patch \ file://CVE-2026-32740.patch \ file://CVE-2026-32741.patch \ + file://CVE-2026-41071-1.patch \ + file://CVE-2026-41071-2.patch \ " SRCREV = "62f1b8c76ed4d8305071fdacbe74ef9717bacac5"