helium-3rd-party/meta-openembedded
1
0
Fork 0
mirror of git://git.openembedded.org/meta-openembedded synced 2026-04-02 02:49:12 +00:00
Code Issues Packages Projects Releases Wiki Activity

libheif: CVE-2026-3949

Browse Source 
Details: https://nvd.nist.gov/vuln/detail/CVE-2026-3949

Backport the patch that is referenced by the NVD report (in the description)

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
This commit is contained in:
Gyorgy Sarvari 2026-03-17 18:23:46 +01:00 committed by Khem Raj
parent e673a4cd8e
commit 260662ca32
No known key found for this signature in database
GPG Key ID: BB053355919D3314
2 changed files with 53 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

50
meta-multimedia/recipes-multimedia/libheif/libheif/CVE-2026-3949.patch Normal file
View File

@ -0,0 +1,50 @@
From cba59e7671a36a78e31c0490efe74ec226918580 Mon Sep 17 00:00:00 2001
From: Dirk Farin <dirk.farin@gmail.com>
Date: Tue, 24 Feb 2026 00:32:48 +0100
Subject: [PATCH] vvdec: check that NAL size does not exceed data size (#1712)
CVE: CVE-2026-3949
Upstream-Status: Backport [https://github.com/strukturag/libheif/commit/b97c8b5f198b27f375127cd597a35f2113544d03]
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
---
libheif/plugins/decoder_vvdec.cc | 17 +++++++++++++++++
1 file changed, 17 insertions(+)
diff --git a/libheif/plugins/decoder_vvdec.cc b/libheif/plugins/decoder_vvdec.cc
index 09515720..14b3e9fd 100644
--- a/libheif/plugins/decoder_vvdec.cc
+++ b/libheif/plugins/decoder_vvdec.cc
@@ -55,6 +55,7 @@ struct vvdec_decoder
std::string error_message;
};
+static const char kEmptyString[] = "";
static const char kSuccess[] = "Success";
static const int VVDEC_PLUGIN_PRIORITY = 100;
@@ -179,9 +180,25 @@ heif_error vvdec_push_data2(void* decoder_raw, const void* frame_data, size_t fr
const auto* data = (const uint8_t*) frame_data;
+ if (frame_size < 4) {
+ return {
+ heif_error_Decoder_plugin_error,
+ heif_suberror_End_of_data,
+ kEmptyString
+ };
+ }
+
for (;;) {
uint32_t size = four_bytes_to_uint32(data[0], data[1], data[2], data[3]);
+ if (frame_size < 4 + size) {
+ return {
+ heif_error_Decoder_plugin_error,
+ heif_suberror_End_of_data,
+ kEmptyString
+ };
+ }
+
data += 4;
std::vector<uint8_t> nalu;

4
meta-multimedia/recipes-multimedia/libheif/libheif_1.21.2.bb
View File

@ -6,7 +6,9 @@ LICENSE_FLAGS = "commercial"
COMPATIBLE_MACHINE:powerpc64le = "null"
SRC_URI = "git://github.com/strukturag/libheif.git;protocol=https;branch=master;tag=v${PV}"
SRC_URI = "git://github.com/strukturag/libheif.git;protocol=https;branch=master;tag=v${PV} \
file://CVE-2026-3949.patch \
"
SRCREV = "62f1b8c76ed4d8305071fdacbe74ef9717bacac5"