[oe][meta-multimedia][wrynose][PATCH 10/22] libheif: patch CVE-2026-32740

[ankur.tyagi85@gmail.com]

From: Ankur Tyagi <ankur.tyagi85@gmail.com>

Backport commit identified by Debian[1] to the original file which was
renamed by upstream commit[2].

Details:
https://nvd.nist.gov/vuln/detail/cve-2026-32740

[1]https://security-tracker.debian.org/tracker/CVE-2026-32740
[2]https://github.com/strukturag/libheif/commit/f05c61ee8427ac3e39a3e5802a390b5aa99ae281

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
---
 .../libheif/libheif/CVE-2026-32740.patch      | 40 +++++++++++++++++++
 .../libheif/libheif_1.21.2.bb                 |  1 +
 2 files changed, 41 insertions(+)
 create mode 100644 meta-multimedia/recipes-multimedia/libheif/libheif/CVE-2026-32740.patch

diff --git a/meta-multimedia/recipes-multimedia/libheif/libheif/CVE-2026-32740.patch b/meta-multimedia/recipes-multimedia/libheif/libheif/CVE-2026-32740.patch
new file mode 100644
index 0000000000..e6ce0e01f4
--- /dev/null
+++ b/meta-multimedia/recipes-multimedia/libheif/libheif/CVE-2026-32740.patch
@@ -0,0 +1,40 @@
+From eec74f24bf52764d870988bade74cd35075a09df Mon Sep 17 00:00:00 2001
+From: Dirk Farin <dirk.farin@gmail.com>
+Date: Mon, 18 May 2026 18:03:01 +0200
+Subject: [PATCH] fix integer overflow when computing chroma sizes
+
+CVE: CVE-2026-32740
+Upstream-Status: Backport [https://github.com/strukturag/libheif/commit/6721f307ad684804b735e917dde7d372c5faae31]
+
+Upstream commit[1] renamed libheif/pixelimage.cc as libheif/image/pixelimage.cc
+Backport changes to the original file.
+
+[1] https://github.com/strukturag/libheif/commit/f05c61ee8427ac3e39a3e5802a390b5aa99ae281
+
+Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
+---
+ libheif/pixelimage.cc | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/libheif/pixelimage.cc b/libheif/pixelimage.cc
+index a8ab7397..da62ea88 100644
+--- a/libheif/pixelimage.cc
++++ b/libheif/pixelimage.cc
+@@ -54,7 +54,7 @@ uint32_t chroma_width(uint32_t w, heif_chroma chroma)
+   switch (chroma) {
+     case heif_chroma_420:
+     case heif_chroma_422:
+-      return (w+1)/2;
++      return w/2 + (w & 1); // note: prevents integer overflow
+     default:
+       return w;
+   }
+@@ -64,7 +64,7 @@ uint32_t chroma_height(uint32_t h, heif_chroma chroma)
+ {
+   switch (chroma) {
+     case heif_chroma_420:
+-      return (h+1)/2;
++      return h/2 + (h & 1); // note: prevents integer overflow
+     default:
+       return h;
+   }
diff --git a/meta-multimedia/recipes-multimedia/libheif/libheif_1.21.2.bb b/meta-multimedia/recipes-multimedia/libheif/libheif_1.21.2.bb
index ba16ee7afe..df7f0c56e1 100644
--- a/meta-multimedia/recipes-multimedia/libheif/libheif_1.21.2.bb
+++ b/meta-multimedia/recipes-multimedia/libheif/libheif_1.21.2.bb
@@ -10,6 +10,7 @@ SRC_URI = "git://github.com/strukturag/libheif.git;protocol=https;branch=master;
            file://CVE-2026-3949.patch \
            file://CVE-2026-32738.patch \
            file://CVE-2026-32739.patch \
+           file://CVE-2026-32740.patch \
            "
 
 SRCREV = "62f1b8c76ed4d8305071fdacbe74ef9717bacac5"