diff mbox series

[meta-multimedia,wrynose,8/22] libheif: patch CVE-2026-32738

Message ID 20260903094954.3240723-8-ankur.tyagi85@gmail.com
State New
Headers show
Series [meta-oe,wrynose,1/22] jq: ignore CVE-2025-49014 | expand

Commit Message

Ankur Tyagi Sept. 3, 2026, 9:49 a.m. UTC 
From: Ankur Tyagi <ankur.tyagi85@gmail.com>

Backport commit identified by Debian[1]

Details:
https://nvd.nist.gov/vuln/detail/cve-2026-32738

[1]https://security-tracker.debian.org/tracker/CVE-2026-32738

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
---
 .../libheif/libheif/CVE-2026-32738.patch      | 32 +++++++++++++++++++
 .../libheif/libheif_1.21.2.bb                 |  1 +
 2 files changed, 33 insertions(+)
 create mode 100644 meta-multimedia/recipes-multimedia/libheif/libheif/CVE-2026-32738.patch
diff mbox series

Patch

diff --git a/meta-multimedia/recipes-multimedia/libheif/libheif/CVE-2026-32738.patch b/meta-multimedia/recipes-multimedia/libheif/libheif/CVE-2026-32738.patch
new file mode 100644
index 0000000000..4308aa6195
--- /dev/null
+++ b/meta-multimedia/recipes-multimedia/libheif/libheif/CVE-2026-32738.patch
@@ -0,0 +1,32 @@ 
+From 95a7008c89335ca97fc22ab8caab5d62b077a34f Mon Sep 17 00:00:00 2001
+From: Dirk Farin <dirk.farin@gmail.com>
+Date: Sat, 14 Mar 2026 20:32:39 +0100
+Subject: [PATCH] check that 'stsc' box does not have zero samples per chunk
+
+(cherry picked from commit bdaa37728442800497ea224bd232ca25e2f9bdff)
+
+CVE: CVE-2026-32738
+Upstream-Status: Backport [https://github.com/strukturag/libheif/commit/bdaa37728442800497ea224bd232ca25e2f9bdff]
+Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
+---
+ libheif/sequences/seq_boxes.cc | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+diff --git a/libheif/sequences/seq_boxes.cc b/libheif/sequences/seq_boxes.cc
+index aec84fd5..91865848 100644
+--- a/libheif/sequences/seq_boxes.cc
++++ b/libheif/sequences/seq_boxes.cc
+@@ -875,6 +875,13 @@ Error Box_stsc::parse(BitstreamRange& range, const heif_security_limits* limits)
+     entry.samples_per_chunk = range.read32();
+     entry.sample_description_index = range.read32();
+ 
++    if (entry.samples_per_chunk == 0) {
++      return {
++        heif_error_Invalid_input,
++        heif_suberror_Unspecified,
++        "'stsc' box with zero samples per chunk entry."};
++    }
++
+     if (entry.sample_description_index == 0) {
+       return {
+       heif_error_Invalid_input,
diff --git a/meta-multimedia/recipes-multimedia/libheif/libheif_1.21.2.bb b/meta-multimedia/recipes-multimedia/libheif/libheif_1.21.2.bb
index ab29fa3b02..b238807fc5 100644
--- a/meta-multimedia/recipes-multimedia/libheif/libheif_1.21.2.bb
+++ b/meta-multimedia/recipes-multimedia/libheif/libheif_1.21.2.bb
@@ -8,6 +8,7 @@  COMPATIBLE_MACHINE:powerpc64le = "null"
 
 SRC_URI = "git://github.com/strukturag/libheif.git;protocol=https;branch=master;tag=v${PV} \
            file://CVE-2026-3949.patch \
+           file://CVE-2026-32738.patch \
            "
 
 SRCREV = "62f1b8c76ed4d8305071fdacbe74ef9717bacac5"