From bb1a4701e68da2f79ecb082f5eab8f8c9fb454be Mon Sep 17 00:00:00 2001 From: Ankur Tyagi Date: Thu, 3 Sep 2026 21:49:42 +1200 Subject: [PATCH] libheif: patch CVE-2026-32741 Backport commit identified by Debian[1] Details: https://nvd.nist.gov/vuln/detail/cve-2026-32741 [1]https://security-tracker.debian.org/tracker/CVE-2026-32741 Signed-off-by: Ankur Tyagi Signed-off-by: Anuj Mittal --- .../libheif/libheif/CVE-2026-32741.patch | 29 +++++++++++++++++++ .../libheif/libheif_1.21.2.bb | 1 + 2 files changed, 30 insertions(+) create mode 100644 meta-multimedia/recipes-multimedia/libheif/libheif/CVE-2026-32741.patch diff --git a/meta-multimedia/recipes-multimedia/libheif/libheif/CVE-2026-32741.patch b/meta-multimedia/recipes-multimedia/libheif/libheif/CVE-2026-32741.patch new file mode 100644 index 0000000000..cd550aafa5 --- /dev/null +++ b/meta-multimedia/recipes-multimedia/libheif/libheif/CVE-2026-32741.patch @@ -0,0 +1,29 @@ +From 3c38488fa2ea31928fcad8f6a5010c1f6f0c1ace Mon Sep 17 00:00:00 2001 +From: Dirk Farin +Date: Thu, 5 Mar 2026 19:00:57 +0100 +Subject: [PATCH] fix possible buffer overflow when reading mask image + +(cherry picked from commit 123694271ac02f2de68a3ccdc5d483eb8a2ae593) + +CVE: CVE-2026-32741 +Upstream-Status: Backport [https://github.com/strukturag/libheif/commit/123694271ac02f2de68a3ccdc5d483eb8a2ae593] +Signed-off-by: Ankur Tyagi +--- + libheif/image-items/mask_image.cc | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/libheif/image-items/mask_image.cc b/libheif/image-items/mask_image.cc +index 328d1797..1c4357ff 100644 +--- a/libheif/image-items/mask_image.cc ++++ b/libheif/image-items/mask_image.cc +@@ -113,8 +113,8 @@ Error MaskImageCodec::decode_mask_image(const HeifContext* context, + + size_t stride; + uint8_t* dst = img->get_plane(heif_channel_Y, &stride); +- if (((uint32_t)stride) == width) { +- memcpy(dst, data.data(), data.size()); ++ if (stride == static_cast(width)) { ++ memcpy(dst, data.data(), static_cast(width) * height); + } + else + { diff --git a/meta-multimedia/recipes-multimedia/libheif/libheif_1.21.2.bb b/meta-multimedia/recipes-multimedia/libheif/libheif_1.21.2.bb index df7f0c56e1..92891cb5ef 100644 --- a/meta-multimedia/recipes-multimedia/libheif/libheif_1.21.2.bb +++ b/meta-multimedia/recipes-multimedia/libheif/libheif_1.21.2.bb @@ -11,6 +11,7 @@ SRC_URI = "git://github.com/strukturag/libheif.git;protocol=https;branch=master; file://CVE-2026-32738.patch \ file://CVE-2026-32739.patch \ file://CVE-2026-32740.patch \ + file://CVE-2026-32741.patch \ " SRCREV = "62f1b8c76ed4d8305071fdacbe74ef9717bacac5"