libheif: patch CVE-2025-68431

Details: https://nvd.nist.gov/vuln/detail/CVE-2025-68431

Backport the patch referenced by the NVD advisory.

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>

2 files changed, 29 insertions, 1 deletions

diff --git a/meta-multimedia/recipes-multimedia/libheif/libheif/CVE-2025-68431.patch b/meta-multimedia/recipes-multimedia/libheif/libheif/CVE-2025-68431.patch
new file mode 100644
index 0000000000..829d94c113
--- /dev/null
+++ b/meta-multimedia/recipes-multimedia/libheif/libheif/CVE-2025-68431.patch
@@ -0,0 +1,26 @@
+From 6747399f04736d9bc59e36befae2946c448553a5 Mon Sep 17 00:00:00 2001
+From: Dirk Farin <dirk.farin@gmail.com>
+Date: Tue, 11 Nov 2025 19:47:50 +0100
+Subject: [PATCH] fix wrong copy width in overlay images (thanks to Aldo
+ Ristori for reporting this)
+
+CVE: CVE-2025-68431
+Upstream-Status: Backport [https://github.com/strukturag/libheif/commit/b8c12a7b70f46c9516711a988483bed377b78d46]
+Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
+---
+ libheif/pixelimage.cc | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/libheif/pixelimage.cc b/libheif/pixelimage.cc
+index b46aaf06..d147f66e 100644
+--- a/libheif/pixelimage.cc
++++ b/libheif/pixelimage.cc
+@@ -1348,7 +1348,7 @@ Error HeifPixelImage::overlay(std::shared_ptr<HeifPixelImage>& overlay, int32_t
+       if (!has_alpha) {
+         memcpy(out_p + out_x0 + (out_y0 + y - in_y0) * out_stride,
+                in_p + in_x0 + y * in_stride,
+-               in_w - in_x0);
++               in_w);
+       }
+       else {
+         for (uint32_t x = in_x0; x < in_w; x++) {
diff --git a/meta-multimedia/recipes-multimedia/libheif/libheif_1.20.2.bb b/meta-multimedia/recipes-multimedia/libheif/libheif_1.20.2.bb
index b268b37d8e..b9083ddd23 100644
--- a/meta-multimedia/recipes-multimedia/libheif/libheif_1.20.2.bb
+++ b/meta-multimedia/recipes-multimedia/libheif/libheif_1.20.2.bb
@@ -6,7 +6,9 @@ LICENSE_FLAGS = "commercial"
 
 COMPATIBLE_MACHINE:powerpc64le = "null"
 
-SRC_URI = "git://github.com/strukturag/libheif.git;protocol=https;branch=v1.20.x-releases"
+SRC_URI = "git://github.com/strukturag/libheif.git;protocol=https;branch=v1.20.x-releases \
+           file://CVE-2025-68431.patch \
+           "
 
 SRCREV = "35dad50a9145332a7bfdf1ff6aef6801fb613d68"