[oe][meta-multimedia][wrynose][PATCH 9/22] libheif: patch CVE-2026-32739

[ankur.tyagi85@gmail.com]

From: Ankur Tyagi <ankur.tyagi85@gmail.com>

Backport commit identified by Debian[1]

Details:
https://nvd.nist.gov/vuln/detail/cve-2026-32739

[1]https://security-tracker.debian.org/tracker/CVE-2026-32739

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
---
 .../libheif/libheif/CVE-2026-32739.patch      | 54 +++++++++++++++++++
 .../libheif/libheif_1.21.2.bb                 |  1 +
 2 files changed, 55 insertions(+)
 create mode 100644 meta-multimedia/recipes-multimedia/libheif/libheif/CVE-2026-32739.patch

diff --git a/meta-multimedia/recipes-multimedia/libheif/libheif/CVE-2026-32739.patch b/meta-multimedia/recipes-multimedia/libheif/libheif/CVE-2026-32739.patch
new file mode 100644
index 0000000000..59cd793ef6
--- /dev/null
+++ b/meta-multimedia/recipes-multimedia/libheif/libheif/CVE-2026-32739.patch
@@ -0,0 +1,54 @@
+From 1c6fde64e37efa6031a6be2318dac62dfb38f370 Mon Sep 17 00:00:00 2001
+From: Dirk Farin <dirk.farin@gmail.com>
+Date: Fri, 13 Mar 2026 23:39:33 +0100
+Subject: [PATCH] fix infinite loop for sequences with variable frame-rate
+
+CVE: CVE-2026-32739
+Upstream-Status: Backport [https://github.com/strukturag/libheif/commit/723b58d6ca329b2743822951aeaf3299c7410448]
+Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
+---
+ libheif/sequences/seq_boxes.cc | 22 ++++++++--------------
+ 1 file changed, 8 insertions(+), 14 deletions(-)
+
+diff --git a/libheif/sequences/seq_boxes.cc b/libheif/sequences/seq_boxes.cc
+index 91865848..39c2e8f4 100644
+--- a/libheif/sequences/seq_boxes.cc
++++ b/libheif/sequences/seq_boxes.cc
+@@ -621,14 +621,11 @@ Error Box_stts::write(StreamWriter& writer) const
+ 
+ uint32_t Box_stts::get_sample_duration(uint32_t sample_idx)
+ {
+-  size_t i = 0;
+-  while (i < m_entries.size()) {
+-    if (sample_idx < m_entries[i].sample_count) {
+-      return m_entries[i].sample_delta;
+-    }
+-    else {
+-      sample_idx -= m_entries[i].sample_count;
++  for (const auto& entry : m_entries) {
++    if (sample_idx < entry.sample_count) {
++      return entry.sample_delta;
+     }
++    sample_idx -= entry.sample_count;
+   }
+ 
+   return 0;
+@@ -813,14 +810,11 @@ Error Box_ctts::write(StreamWriter& writer) const
+ 
+ int32_t Box_ctts::get_sample_offset(uint32_t sample_idx)
+ {
+-  size_t i = 0;
+-  while (i < m_entries.size()) {
+-    if (sample_idx < m_entries[i].sample_count) {
+-      return m_entries[i].sample_offset;
+-    }
+-    else {
+-      sample_idx -= m_entries[i].sample_count;
++  for (const auto& entry : m_entries) {
++    if (sample_idx < entry.sample_count) {
++      return entry.sample_offset;
+     }
++    sample_idx -= entry.sample_count;
+   }
+ 
+   return 0;
diff --git a/meta-multimedia/recipes-multimedia/libheif/libheif_1.21.2.bb b/meta-multimedia/recipes-multimedia/libheif/libheif_1.21.2.bb
index b238807fc5..ba16ee7afe 100644
--- a/meta-multimedia/recipes-multimedia/libheif/libheif_1.21.2.bb
+++ b/meta-multimedia/recipes-multimedia/libheif/libheif_1.21.2.bb
@@ -9,6 +9,7 @@ COMPATIBLE_MACHINE:powerpc64le = "null"
 SRC_URI = "git://github.com/strukturag/libheif.git;protocol=https;branch=master;tag=v${PV} \
            file://CVE-2026-3949.patch \
            file://CVE-2026-32738.patch \
+           file://CVE-2026-32739.patch \
            "
 
 SRCREV = "62f1b8c76ed4d8305071fdacbe74ef9717bacac5"