Commit 0d4e00fb for libheif
commit 0d4e00fb388ad73d011fbffeb7d75c4461067ebe
Author: Anthony Hurtado <amhurtado@pm.me>
Date: Sun May 17 22:01:16 2026 -0500
heif_entity_groups: fix NULL deref on unknown grpl child types
dynamic_pointer_cast<Box_EntityToGroup> returns nullptr when a grpl
child box has a four-cc type not in {pymd, altr, ster}. The result
was dereferenced without a null check, crashing any application
calling heif_context_get_entity_groups() on crafted HEIF input.
Add a null check to skip unrecognized entity group box types.
Found by: AFL++ fuzzing with custom harness
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Signed-off-by: Anthony Hurtado <amhurtado@pm.me>
diff --git a/libheif/api/libheif/heif_entity_groups.cc b/libheif/api/libheif/heif_entity_groups.cc
index c8dd171b..0646f012 100644
--- a/libheif/api/libheif/heif_entity_groups.cc
+++ b/libheif/api/libheif/heif_entity_groups.cc
@@ -53,6 +53,7 @@ heif_entity_group* heif_context_get_entity_groups(const heif_context* ctx,
}
auto groupBox = std::dynamic_pointer_cast<Box_EntityToGroup>(group);
+ if (!groupBox) continue;
const std::vector<heif_item_id>& items = groupBox->get_item_ids();
if (item_filter != 0 && std::all_of(items.begin(), items.end(), [item_filter](heif_item_id item) {