Commit 92b79c64 for libheif
commit 92b79c643748da7e5551b0808dbbafa117fb1e99
Author: Dirk Farin <dirk.farin@gmail.com>
Date: Sat Sep 5 00:44:45 2026 +0200
Remove now-dead child-count check in Box_dref::parse (GHSA-vg7w-rp49-4fc2)
read_children now rejects a short read, so on success the number of
children always equals the declared nEntities. The trailing
'if (m_children.size() != nEntities)' block (an unimplemented TODO) is
therefore unreachable; drop it and return read_children directly.
diff --git a/libheif/box.cc b/libheif/box.cc
index 3ea69bf7..33ad24d4 100644
--- a/libheif/box.cc
+++ b/libheif/box.cc
@@ -4729,16 +4729,8 @@ Error Box_dref::parse(BitstreamRange& range, const heif_security_limits* limits)
"Too many entities in dref box.");
}
- Error err = read_children(range, (int)nEntities, limits);
- if (err) {
- return err;
- }
-
- if (m_children.size() != nEntities) {
- // TODO return Error(
- }
-
- return err;
+ // read_children verifies that exactly nEntities children are present.
+ return read_children(range, (int)nEntities, limits);
}