heifload: ensure unlimited flag removes all security limits where pos…

…sible (libvips#4398) Requires libheif v1.19.0+ Co-authored-by: Kleis Auke Wolthuizen <[email protected]>
Stars1233 · Feb 25, 2025 · df54c2b · df54c2b
1 parent 5ca47ef
commit df54c2b
Show file tree

Hide file tree

Showing 3 changed files with 8 additions and 0 deletions.
diff --git a/ChangeLog b/ChangeLog
@@ -10,6 +10,7 @@
 - add matrixmultiply
 - improve performance of vips_shrink() [kleisauke]
 - svgload: add support for custom CSS via stylesheet option [lovell]
+- heifload: `unlimited` flag removes all limits (requires libheif 1.19.0+) [lovell]
 
 8.16.1
 

diff --git a/libvips/foreign/heifload.c b/libvips/foreign/heifload.c
@@ -354,6 +354,11 @@ vips_foreign_load_heif_build(VipsObject *object)
 		heif_context_set_maximum_image_size_limit(heif->ctx,
 			heif->unlimited ? USHRT_MAX : 0x4000);
 #endif /* HAVE_HEIF_SET_MAX_IMAGE_SIZE_LIMIT */
+#ifdef HAVE_HEIF_GET_DISABLED_SECURITY_LIMITS
+		if (heif->unlimited)
+			heif_context_set_security_limits(heif->ctx,
+				heif_get_disabled_security_limits());
+#endif /* HAVE_HEIF_GET_DISABLED_SECURITY_LIMITS */
 		error = heif_context_read_from_reader(heif->ctx,
 			heif->reader, heif, NULL);
 		if (error.code) {

diff --git a/meson.build b/meson.build
@@ -510,6 +510,8 @@ if libheif_dep.found()
     cfg_var.set('HAVE_HEIF_ENCODING_OPTIONS_IMAGE_ORIENTATION', cpp.has_member('struct heif_encoding_options', 'image_orientation', prefix: '#include <libheif/heif.h>', dependencies: libheif_dep))
     # heif_error_success added in 1.17.0
     cfg_var.set('HAVE_HEIF_ERROR_SUCCESS', libheif_dep.version().version_compare('>=1.17.0'))
+    # heif_get_disabled_security_limits added in 1.19.0
+    cfg_var.set('HAVE_HEIF_GET_DISABLED_SECURITY_LIMITS', cpp.has_function('heif_get_disabled_security_limits', prefix: '#include <libheif/heif.h>', dependencies: libheif_dep))
 endif
 
 libjxl_dep = dependency('libjxl', version: '>=0.6', required: get_option('jpeg-xl'))