libheif

Reading the patch[0] for libheif the bug which lead to the vuln was around bounds checking for image overlays. the container can have multiple images and you can compose them in the output. heif also supports rotating, cropping, alpha channels, thumbnails and a ton of other features that a web forum where a user is uploading photos or screenshots doesn't need. It's a much, much larger attack surface than plain old school JPEG. I'd suggest rather than wait for the next bug to appear in this or another image lib to keeping things simple - stick to plain JPEG and handle image conversion in the client (wasm in the browser) if you really need to support users uploading iphone images. Media decoding is so hard - there have been tons of bugs in ffmpeg and imagemagick and the core libs. You really need to think about how much of it you expose via

Btw there are so many "critical" vulnerabilities in libheif I can't even tell if I have them all patched. Just awesome. https://github.com/strukturag/libheif/security/advisories?qu... https://ubuntu.com/security/notices/USN-8649-1 https://ubuntu.com/security/notices/USN-8683-1 https://ubuntu.com/security/notices/USN-8774-1

How hard should it be to convert an heic picture to jpeg? There's no out of box solution in Ubuntu 24 LTS, the libheif library for 24 LTS and older Ubuntu versions fails to convert heic pictures. https://github.com/strukturag/libheif/issues/1190 I am not blaming libheif author, however I am left a little bit frustrated that this simple task requires developer expertise!

> Windows https://www.microsoft.com/en-us/p/heif-image-extensions/9pmm... + https://www.microsoft.com/en-us/p/hevc-video-extensions/9nmz... > Linux https://github.com/strukturag/libheif (includes gdk-pixbuf loader and nautilus thumbnailer)

Thanks, I couldn't reproduce it with the stable build but I did with 92.0b7. Seems to be related to avif images and a bug in libheif. Trying to fix now. https://github.com/lynnandtonic/nestflix.fun/issues/65 https://github.com/strukturag/libheif/issues/477

Here's a LGPL decoder: https://github.com/strukturag/libheif

Similar thing for h265: http://strukturag.github.io/libde265.js/ Code: https://github.com/strukturag/libde265.js Difference is that this is using emscripten to compile the native code to JS. That was 5 years ago. Today, we would use WASM, of course. Runs surprisingly smooth, even though a native decoder is clearly superior. However, there are still nice uses, like adding support for HEIF to the browser: https://strukturag.github.io/libheif/ Code: https://github.com/strukturag/libheif