Commit 23d75f4d for libheif
commit 23d75f4d6908cf200f18651a120e69b241491026
Author: Joachim Bauch <bauch@struktur.de>
Date: Thu Oct 30 16:03:49 2025 +0100
Handle case where decoding returns no image.
Triggered by "fuzzing/data/corpus/clusterfuzz-testcase-minimized-file-fuzzer-5752063708495872.heic"
and fuzzer.
diff --git a/libheif/image-items/grid.cc b/libheif/image-items/grid.cc
index 9371c30f..ed96eefc 100644
--- a/libheif/image-items/grid.cc
+++ b/libheif/image-items/grid.cc
@@ -454,7 +454,9 @@ Result<std::shared_ptr<HeifPixelImage>> ImageItem_Grid::decode_full_grid_image(c
return Error{heif_error_Canceled, heif_suberror_Unspecified, "Decoding the image was canceled"};
}
- img->add_warnings(warnings);
+ if (img) {
+ img->add_warnings(warnings);
+ }
return img;
}
@@ -481,6 +483,12 @@ Error ImageItem_Grid::decode_and_paste_tile_image(heif_item_id tileID, uint32_t
auto tileItem = get_context()->get_image(tileID, true);
if (!tileItem && !options.strict_decoding) {
// We ignore missing images.
+ if (inout_image) {
+ inout_image->add_warning(Error{
+ heif_error_Invalid_input,
+ heif_suberror_Missing_grid_images,
+ });
+ }
return progress_and_return_ok(options, progress_counter);
}
@@ -493,6 +501,12 @@ Error ImageItem_Grid::decode_and_paste_tile_image(heif_item_id tileID, uint32_t
if (!decodeResult) {
if (!options.strict_decoding) {
// We ignore broken tiles.
+ if (inout_image) {
+ inout_image->add_warning(Error{
+ heif_error_Invalid_input,
+ heif_suberror_Missing_grid_images,
+ });
+ }
return progress_and_return_ok(options, progress_counter);
}
diff --git a/libheif/image-items/image_item.cc b/libheif/image-items/image_item.cc
index ce21e092..84eab178 100644
--- a/libheif/image-items/image_item.cc
+++ b/libheif/image-items/image_item.cc
@@ -710,6 +710,10 @@ Result<std::shared_ptr<HeifPixelImage>> ImageItem::decode_image(const heif_decod
}
auto img = *decodingResult;
+ if (!img) {
+ // Can happen if missing tiled image is decoded in non-strict mode.
+ return Error(heif_error_Decoder_plugin_error, heif_suberror_Unspecified);
+ }
std::shared_ptr<HeifFile> file = m_heif_context->get_heif_file();