diff mbox series

[meta-multimedia,wrynose,11/22] libheif: patch CVE-2026-32741

Message ID 20260903094954.3240723-11-ankur.tyagi85@gmail.com
State New
Headers show
Series [meta-oe,wrynose,1/22] jq: ignore CVE-2025-49014 | expand

Commit Message

Ankur Tyagi Sept. 3, 2026, 9:49 a.m. UTC 
From: Ankur Tyagi <ankur.tyagi85@gmail.com>

Backport commit identified by Debian[1]

Details:
https://nvd.nist.gov/vuln/detail/cve-2026-32741

[1]https://security-tracker.debian.org/tracker/CVE-2026-32741

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
---
 .../libheif/libheif/CVE-2026-32741.patch      | 29 +++++++++++++++++++
 .../libheif/libheif_1.21.2.bb                 |  1 +
 2 files changed, 30 insertions(+)
 create mode 100644 meta-multimedia/recipes-multimedia/libheif/libheif/CVE-2026-32741.patch
diff mbox series

Patch

diff --git a/meta-multimedia/recipes-multimedia/libheif/libheif/CVE-2026-32741.patch b/meta-multimedia/recipes-multimedia/libheif/libheif/CVE-2026-32741.patch
new file mode 100644
index 0000000000..cd550aafa5
--- /dev/null
+++ b/meta-multimedia/recipes-multimedia/libheif/libheif/CVE-2026-32741.patch
@@ -0,0 +1,29 @@ 
+From 3c38488fa2ea31928fcad8f6a5010c1f6f0c1ace Mon Sep 17 00:00:00 2001
+From: Dirk Farin <dirk.farin@gmail.com>
+Date: Thu, 5 Mar 2026 19:00:57 +0100
+Subject: [PATCH] fix possible buffer overflow when reading mask image
+
+(cherry picked from commit 123694271ac02f2de68a3ccdc5d483eb8a2ae593)
+
+CVE: CVE-2026-32741
+Upstream-Status: Backport [https://github.com/strukturag/libheif/commit/123694271ac02f2de68a3ccdc5d483eb8a2ae593]
+Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
+---
+ libheif/image-items/mask_image.cc | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/libheif/image-items/mask_image.cc b/libheif/image-items/mask_image.cc
+index 328d1797..1c4357ff 100644
+--- a/libheif/image-items/mask_image.cc
++++ b/libheif/image-items/mask_image.cc
+@@ -113,8 +113,8 @@ Error MaskImageCodec::decode_mask_image(const HeifContext* context,
+ 
+   size_t stride;
+   uint8_t* dst = img->get_plane(heif_channel_Y, &stride);
+-  if (((uint32_t)stride) == width) {
+-    memcpy(dst, data.data(), data.size());
++  if (stride == static_cast<size_t>(width)) {
++    memcpy(dst, data.data(), static_cast<size_t>(width) * height);
+   }
+   else
+   {
diff --git a/meta-multimedia/recipes-multimedia/libheif/libheif_1.21.2.bb b/meta-multimedia/recipes-multimedia/libheif/libheif_1.21.2.bb
index df7f0c56e1..92891cb5ef 100644
--- a/meta-multimedia/recipes-multimedia/libheif/libheif_1.21.2.bb
+++ b/meta-multimedia/recipes-multimedia/libheif/libheif_1.21.2.bb
@@ -11,6 +11,7 @@  SRC_URI = "git://github.com/strukturag/libheif.git;protocol=https;branch=master;
            file://CVE-2026-32738.patch \
            file://CVE-2026-32739.patch \
            file://CVE-2026-32740.patch \
+           file://CVE-2026-32741.patch \
            "
 
 SRCREV = "62f1b8c76ed4d8305071fdacbe74ef9717bacac5"