Commit b97c8b5f for libheif

commit b97c8b5f198b27f375127cd597a35f2113544d03
Author: Dirk Farin <dirk.farin@gmail.com>
Date:   Tue Feb 24 00:32:48 2026 +0100

    vvdec: check that NAL size does not exceed data size (#1712)

diff --git a/libheif/plugins/decoder_vvdec.cc b/libheif/plugins/decoder_vvdec.cc
index 09515720..14b3e9fd 100644
--- a/libheif/plugins/decoder_vvdec.cc
+++ b/libheif/plugins/decoder_vvdec.cc
@@ -55,6 +55,7 @@ struct vvdec_decoder
   std::string error_message;
 };

+static const char kEmptyString[] = "";
 static const char kSuccess[] = "Success";

 static const int VVDEC_PLUGIN_PRIORITY = 100;
@@ -179,9 +180,25 @@ heif_error vvdec_push_data2(void* decoder_raw, const void* frame_data, size_t fr

   const auto* data = (const uint8_t*) frame_data;

+  if (frame_size < 4) {
+    return {
+      heif_error_Decoder_plugin_error,
+      heif_suberror_End_of_data,
+      kEmptyString
+    };
+  }
+
   for (;;) {
     uint32_t size = four_bytes_to_uint32(data[0], data[1], data[2], data[3]);

+    if (frame_size < 4 + size) {
+      return {
+        heif_error_Decoder_plugin_error,
+        heif_suberror_End_of_data,
+        kEmptyString
+      };
+    }
+
     data += 4;

     std::vector<uint8_t> nalu;