[oe][meta-multimedia][wrynose][PATCH 12/22] libheif: patch CVE-2026-41071

[ankur.tyagi85@gmail.com]

From: Ankur Tyagi <ankur.tyagi85@gmail.com>

Backport commit identified by Debian[1]
Also backport[2] which is needed to cherry-pick[1]

Details:
https://nvd.nist.gov/vuln/detail/cve-2026-41071

[1]https://security-tracker.debian.org/tracker/CVE-2026-41071
[2]https://github.com/strukturag/libheif/commit/71755d3d41a117685a3274bdd1214fc50a760f20

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
---
 .../libheif/libheif/CVE-2026-41071-1.patch    | 34 ++++++++++++++
 .../libheif/libheif/CVE-2026-41071-2.patch    | 44 +++++++++++++++++++
 .../libheif/libheif_1.21.2.bb                 |  2 +
 3 files changed, 80 insertions(+)
 create mode 100644 meta-multimedia/recipes-multimedia/libheif/libheif/CVE-2026-41071-1.patch
 create mode 100644 meta-multimedia/recipes-multimedia/libheif/libheif/CVE-2026-41071-2.patch

diff --git a/meta-multimedia/recipes-multimedia/libheif/libheif/CVE-2026-41071-1.patch b/meta-multimedia/recipes-multimedia/libheif/libheif/CVE-2026-41071-1.patch
new file mode 100644
index 0000000000..7971ea3cef
--- /dev/null
+++ b/meta-multimedia/recipes-multimedia/libheif/libheif/CVE-2026-41071-1.patch
@@ -0,0 +1,34 @@
+From 415b59839dcf46bb05e08de7422a21e65ab28e03 Mon Sep 17 00:00:00 2001
+From: Dirk Farin <dirk.farin@gmail.com>
+Date: Mon, 13 Apr 2026 19:49:06 +0200
+Subject: [PATCH] fix: reject malformed sequence files with saiz samples but no
+ chunks
+
+(cherry picked from commit 71755d3d41a117685a3274bdd1214fc50a760f20)
+
+CVE: CVE-2026-41071
+Upstream-Status: Backport [https://github.com/strukturag/libheif/commit/71755d3d41a117685a3274bdd1214fc50a760f20]
+Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
+---
+ libheif/sequences/track.cc | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+diff --git a/libheif/sequences/track.cc b/libheif/sequences/track.cc
+index acb916fa..ac5d5687 100644
+--- a/libheif/sequences/track.cc
++++ b/libheif/sequences/track.cc
+@@ -443,6 +443,14 @@ Error Track::load(const std::shared_ptr<Box_trak>& trak_box)
+         };
+       }
+ 
++      if (saio->get_num_chunks() != 1 && m_chunks.empty() && saiz->get_num_samples() > 0) {
++        return Error{
++          heif_error_Invalid_input,
++          heif_suberror_Unspecified,
++          "'saiz' box references samples but no chunks exist."
++        };
++      }
++
+       if (aux_info_type == fourcc("suid")) {
+         m_aux_reader_content_ids = std::make_unique<SampleAuxInfoReader>(saiz, saio, m_chunks);
+       }
diff --git a/meta-multimedia/recipes-multimedia/libheif/libheif/CVE-2026-41071-2.patch b/meta-multimedia/recipes-multimedia/libheif/libheif/CVE-2026-41071-2.patch
new file mode 100644
index 0000000000..952c366966
--- /dev/null
+++ b/meta-multimedia/recipes-multimedia/libheif/libheif/CVE-2026-41071-2.patch
@@ -0,0 +1,44 @@
+From b79d7d2a4f1502e93739453025ac2dbfd59e514f Mon Sep 17 00:00:00 2001
+From: Dirk Farin <dirk.farin@gmail.com>
+Date: Mon, 13 Apr 2026 20:09:26 +0200
+Subject: [PATCH] fix: reject malformed sequence files where saiz sample count
+ exceeds actual samples
+
+(cherry picked from commit f20c81745e917b4c496615140385c86d7a2fa58d)
+CVE: CVE-2026-41071
+Upstream-Status: Backport [https://github.com/strukturag/libheif/commit/f20c81745e917b4c496615140385c86d7a2fa58d]
+Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
+---
+ libheif/sequences/track.cc | 12 +++++++++++-
+ 1 file changed, 11 insertions(+), 1 deletion(-)
+
+diff --git a/libheif/sequences/track.cc b/libheif/sequences/track.cc
+index ac5d5687..e4b08afa 100644
+--- a/libheif/sequences/track.cc
++++ b/libheif/sequences/track.cc
+@@ -138,7 +138,9 @@ SampleAuxInfoReader::SampleAuxInfoReader(std::shared_ptr<Box_saiz> saiz,
+     for (uint32_t i = 0; i < nSamples; i++) {
+       if (!oneChunk && i > chunks[current_chunk]->last_sample_number()) {
+         current_chunk++;
+-        assert(current_chunk < chunks.size());
++        if (current_chunk >= chunks.size()) {
++          break;
++        }
+         offset = saio->get_chunk_offset(current_chunk);
+       }
+ 
+@@ -451,6 +453,14 @@ Error Track::load(const std::shared_ptr<Box_trak>& trak_box)
+         };
+       }
+ 
++      if (saiz->get_num_samples() > m_stsz->num_samples()) {
++        return Error{
++          heif_error_Invalid_input,
++          heif_suberror_Unspecified,
++          "Number of samples in 'saiz' box exceeds actual number of samples."
++        };
++      }
++
+       if (aux_info_type == fourcc("suid")) {
+         m_aux_reader_content_ids = std::make_unique<SampleAuxInfoReader>(saiz, saio, m_chunks);
+       }
diff --git a/meta-multimedia/recipes-multimedia/libheif/libheif_1.21.2.bb b/meta-multimedia/recipes-multimedia/libheif/libheif_1.21.2.bb
index 92891cb5ef..f3f03abdc7 100644
--- a/meta-multimedia/recipes-multimedia/libheif/libheif_1.21.2.bb
+++ b/meta-multimedia/recipes-multimedia/libheif/libheif_1.21.2.bb
@@ -12,6 +12,8 @@ SRC_URI = "git://github.com/strukturag/libheif.git;protocol=https;branch=master;
            file://CVE-2026-32739.patch \
            file://CVE-2026-32740.patch \
            file://CVE-2026-32741.patch \
+           file://CVE-2026-41071-1.patch \
+           file://CVE-2026-41071-2.patch \
            "
 
 SRCREV = "62f1b8c76ed4d8305071fdacbe74ef9717bacac5"