fix(libheif): CVE-2025-68431, CVE-2026-3949

debian/changelog

@@ -1,3 +1,13 @@
+libheif (1.18.1-1deepin1) unstable; urgency=medium
+
+  * Fix CVE-2025-68431, CVE-2026-3949: heap buffer over-read and out-of-
+    bounds read vulnerabilities.  CVE-2025-43966, CVE-2025-43967, CVE-
+    2026-3950: NOT-AFFECTED - vulnerable code does not exist in version
+    1.18.1 (image-items/iden.cc, image-items/grid.cc, sequences/track.cc
+    not present).
+
+ -- deepin-ci-robot <packages@deepin.org>  Wed, 27 May 2026 03:41:10 +0800
+
 libheif (1.18.1-1deepin0) unstable; urgency=medium
 
   * No source change upload against GCC 12.

debian/patches/CVE-2025-68431.patch

@@ -0,0 +1,11 @@
+--- a/libheif/pixelimage.cc
++++ b/libheif/pixelimage.cc
+@@ -880,7 +880,7 @@
+       if (!has_alpha) {
+         memcpy(out_p + out_x0 + (out_y0 + y - in_y0) * out_stride,
+                in_p + in_x0 + y * in_stride,
+-               in_w - in_x0);
++               in_w);
+       }
+       else {
+         for (uint32_t x = in_x0; x < in_w; x++) {

debian/patches/CVE-2026-3949.patch

@@ -0,0 +1,50 @@
+Description: Fix out-of-bounds read in vvdec_push_data
+ Add boundary checks to prevent out-of-bounds read when processing
+ vvdec data. This fixes CVE-2026-3949.
+Author: Dirk Farin <dirk.farin@gmail.com>
+Origin: upstream, https://github.com/strukturag/libheif/commit/b97c8b5f198b27f375127cd597a35f2113544d03
+Bug: https://security-tracker.debian.org/tracker/CVE-2026-3949
+Bug-Debian: https://github.com/strukturag/libheif/issues/1712
+Forwarded: not-needed
+Last-Update: 2026-04-15
+
+--- a/libheif/plugins/decoder_vvdec.cc
++++ b/libheif/plugins/decoder_vvdec.cc
+@@ -44,6 +44,7 @@
+   std::vector<std::vector<uint8_t>> nalus;
+ };
+
++static const char kEmptyString[] = "";
+ static const char kSuccess[] = "Success";
+
+ static const int VVDEC_PLUGIN_PRIORITY = 100;
+@@ -146,6 +147,14 @@
+
+   const auto* data = (const uint8_t*) frame_data;
+
++  if (frame_size < 4) {
++    return {
++      heif_error_Decoder_plugin_error,
++      heif_suberror_End_of_data,
++      kEmptyString
++    };
++  }
++
+   for (;;) {
+     uint32_t size = ((((uint32_t) data[0]) << 24) |
+                      (((uint32_t) data[1]) << 16) |
+@@ -154,6 +163,14 @@
+
+     data += 4;
+
++    if (frame_size < 4 + size) {
++      return {
++        heif_error_Decoder_plugin_error,
++        heif_suberror_End_of_data,
++        kEmptyString
++      };
++    }
++
+     std::vector<uint8_t> nalu;
+     nalu.push_back(0);
+     nalu.push_back(0);

debian/patches/series

@@ -1 +1,3 @@
 fix_openjpeg_detection.patch
+CVE-2025-68431.patch
+CVE-2026-3949.patch