important · Image processing
Crafted tiled HEIF files still crash libheif after the earlier tile fix.
Affects
libheif, a cross-platform HEIF/AVIF library, when used by tiled-image viewers, converters, thumbnailers, or server pipelines through its tile-decoding API.
A missed sibling branch wraps tile-offset arithmetic to zero and calls memcpy with an invalid pointer and a one-terabyte length; the public reproducer crashed three clean runs out of three.
Detail and 2 sources
Only denial of service is established, and the new patch was not assessed for this brief.