mirrors/meta-openembedded
1
0
Fork 0
mirror of https://github.com/openembedded/meta-openembedded.git synced 2026-09-27 12:40:19 +00:00
Code Issues Projects Releases Wiki Activity

libheif: patch CVE-2026-32740

Browse Source 
Backport commit identified by Debian[1] to the original file which was
renamed by upstream commit[2].

Details:
https://nvd.nist.gov/vuln/detail/cve-2026-32740

[1]https://security-tracker.debian.org/tracker/CVE-2026-32740
[2]https://github.com/strukturag/libheif/commit/f05c61ee8427ac3e39a3e5802a390b5aa99ae281

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
This commit is contained in:
Ankur Tyagi
2026-09-15 07:52:08 +05:30
committed by Anuj Mittal
parent 6bc5abde11
commit f179d08aed
2 changed files with 41 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
meta-multimedia/recipes-multimedia/libheif/libheif/CVE-2026-32740.patch
+40
View File
@@ -0,0 +1,40 @@
From eec74f24bf52764d870988bade74cd35075a09df Mon Sep 17 00:00:00 2001
From: Dirk Farin <dirk.farin@gmail.com>
Date: Mon, 18 May 2026 18:03:01 +0200
Subject: [PATCH] fix integer overflow when computing chroma sizes
CVE: CVE-2026-32740
Upstream-Status: Backport [https://github.com/strukturag/libheif/commit/6721f307ad684804b735e917dde7d372c5faae31]
Upstream commit[1] renamed libheif/pixelimage.cc as libheif/image/pixelimage.cc
Backport changes to the original file.
[1] https://github.com/strukturag/libheif/commit/f05c61ee8427ac3e39a3e5802a390b5aa99ae281
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
---
libheif/pixelimage.cc | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/libheif/pixelimage.cc b/libheif/pixelimage.cc
index a8ab7397..da62ea88 100644
--- a/libheif/pixelimage.cc
+++ b/libheif/pixelimage.cc
@@ -54,7 +54,7 @@ uint32_t chroma_width(uint32_t w, heif_chroma chroma)
switch (chroma) {
case heif_chroma_420:
case heif_chroma_422:
- return (w+1)/2;
+ return w/2 + (w & 1); // note: prevents integer overflow
default:
return w;
}
@@ -64,7 +64,7 @@ uint32_t chroma_height(uint32_t h, heif_chroma chroma)
{
switch (chroma) {
case heif_chroma_420:
- return (h+1)/2;
+ return h/2 + (h & 1); // note: prevents integer overflow
default:
return h;
}
meta-multimedia/recipes-multimedia/libheif/libheif_1.21.2.bb
+1
View File
@@ -10,6 +10,7 @@ SRC_URI = "git://github.com/strukturag/libheif.git;protocol=https;branch=master;
file://CVE-2026-3949.patch \
file://CVE-2026-32738.patch \
file://CVE-2026-32739.patch \
file://CVE-2026-32740.patch \
"
SRCREV = "62f1b8c76ed4d8305071fdacbe74ef9717bacac5"