Commit 03a01b16 for libheif

commit 03a01b16d5ef01f4d43294f2e312e2c9bd07fb9c
Author: Dirk Farin <dirk.farin@gmail.com>
Date:   Thu May 28 16:02:07 2026 +0200

    tili: defensive check against number of tiles

diff --git a/libheif/image-items/tiled.cc b/libheif/image-items/tiled.cc
index 0c504965..946392ec 100644
--- a/libheif/image-items/tiled.cc
+++ b/libheif/image-items/tiled.cc
@@ -428,6 +428,13 @@ uint32_t TiledHeader::get_offset_table_entry_size() const

 std::pair<uint32_t, uint32_t> TiledHeader::get_tile_offset_table_range_to_read(uint32_t idx, uint32_t nEntries) const
 {
+  // Defense in depth: callers are expected to validate idx, but if they don't,
+  // returning an empty range prevents the subsequent read_offset_table_range
+  // from writing past m_offsets.
+  if (idx >= m_offsets.size()) {
+    return {0, 0};
+  }
+
   uint32_t start = idx;
   uint32_t end = idx+1;

@@ -959,7 +966,7 @@ ImageItem_Tiled::decode_compressed_image(const heif_decoding_options& options,
 Error ImageItem_Tiled::append_compressed_tile_data(std::vector<uint8_t>& data, uint32_t tx, uint32_t ty) const
 {
   uint64_t idx64 = static_cast<uint64_t>(ty) * nTiles_h(m_tild_header.get_parameters()) + tx;
-  if (idx64 > std::numeric_limits<uint32_t>::max()) {
+  if (idx64 >= m_tild_header.get_num_tiles()) {
     return Error{heif_error_Invalid_input,
                  heif_suberror_Unspecified,
                  "Tile index out of range."};
diff --git a/libheif/image-items/tiled.h b/libheif/image-items/tiled.h
index 9c861f48..92c64d29 100644
--- a/libheif/image-items/tiled.h
+++ b/libheif/image-items/tiled.h
@@ -114,6 +114,8 @@ public:

   size_t get_header_size() const;

+  size_t get_num_tiles() const { return m_offsets.size(); }
+
   uint64_t get_tile_offset(uint32_t idx) const { return m_offsets[idx].offset; }

   uint32_t get_tile_size(uint32_t idx) const { return m_offsets[idx].size; }