Commit b117d537 for libheif
commit b117d5375541c8248065e19c17ee71d3ebc4a54d
Author: Dirk Farin <dirk.farin@gmail.com>
Date: Sun Dec 21 20:12:43 2025 +0100
apply security limit for sequence length (fixes #1643)
diff --git a/libheif/sequences/track.cc b/libheif/sequences/track.cc
index a6a44d32..20eb6e5d 100644
--- a/libheif/sequences/track.cc
+++ b/libheif/sequences/track.cc
@@ -414,6 +414,20 @@ Error Track::load(const std::shared_ptr<Box_trak>& trak_box)
}
}
+
+ // --- security checks
+
+ if (m_stsz->num_samples() > m_heif_context->get_security_limits()->max_sequence_frames) {
+ return {
+ heif_error_Memory_allocation_error,
+ heif_suberror_Security_limit_exceeded,
+ "Security limit for maximum number of sequence frames exceeded"
+ };
+ }
+
+
+ // --- initialize track tables
+
init_sample_timing_table();
return {};