kde-frameworks/kimageformats: heif: reject invalid files with zero size

Upstream commit b654f20ecebc30ab73022a6b32c2fd1cef162ea6

See also: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=50850

Bug: https://bugs.gentoo.org/891927
Signed-off-by: Andreas Sturmlechner <asturm@gentoo.org>

2 files changed, 77 insertions, 0 deletions

diff --git a/kde-frameworks/kimageformats/files/kimageformats-5.102.0-heif-reject-invalid-files-w-0-size.patch b/kde-frameworks/kimageformats/files/kimageformats-5.102.0-heif-reject-invalid-files-w-0-size.patch
new file mode 100644
index 000000000000..809d11ce382f
--- /dev/null
+++ b/kde-frameworks/kimageformats/files/kimageformats-5.102.0-heif-reject-invalid-files-w-0-size.patch
@@ -0,0 +1,31 @@
+From b654f20ecebc30ab73022a6b32c2fd1cef162ea6 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Daniel=20Novomesk=C3=BD?= <dnovomesky@gmail.com>
+Date: Sun, 29 Jan 2023 16:16:52 +0100
+Subject: [PATCH] heif: reject invalid files with zero size
+
+---
+ src/imageformats/heif.cpp | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+diff --git a/src/imageformats/heif.cpp b/src/imageformats/heif.cpp
+index 3365d92..c938c0d 100644
+--- a/src/imageformats/heif.cpp
++++ b/src/imageformats/heif.cpp
+@@ -449,6 +449,14 @@ bool HEIFHandler::ensureDecoder()
+         return false;
+     }
+ 
++    if ((heif_image_handle_get_width(handle) == 0) || (heif_image_handle_get_height(handle) == 0)) {
++        m_parseState = ParseHeicError;
++        heif_image_handle_release(handle);
++        heif_context_free(ctx);
++        qWarning() << "HEIC image has zero dimension";
++        return false;
++    }
++
+     const bool hasAlphaChannel = heif_image_handle_has_alpha_channel(handle);
+     const int bit_depth = heif_image_handle_get_luma_bits_per_pixel(handle);
+     heif_chroma chroma;
+-- 
+GitLab
+
diff --git a/kde-frameworks/kimageformats/kimageformats-5.102.0-r1.ebuild b/kde-frameworks/kimageformats/kimageformats-5.102.0-r1.ebuild
new file mode 100644
index 000000000000..fef1628f46c6
--- /dev/null
+++ b/kde-frameworks/kimageformats/kimageformats-5.102.0-r1.ebuild
@@ -0,0 +1,46 @@
+# Copyright 1999-2023 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+ECM_QTHELP="false"
+PVCUT=$(ver_cut 1-2)
+QTMIN=5.15.5
+VIRTUALX_REQUIRED="test"
+inherit ecm frameworks.kde.org
+
+DESCRIPTION="Framework providing additional format plugins for Qt's image I/O system"
+
+LICENSE="LGPL-2+"
+KEYWORDS="~amd64 ~arm ~arm64 ~loong ~ppc64 ~riscv ~x86"
+IUSE="avif eps heif jpegxl openexr raw"
+
+RDEPEND="
+	>=dev-qt/qtgui-${QTMIN}:5
+	=kde-frameworks/karchive-${PVCUT}*:5
+	avif? ( >=media-libs/libavif-0.8.2:= )
+	eps? ( >=dev-qt/qtprintsupport-${QTMIN}:5 )
+	heif? ( >=media-libs/libheif-1.10.0:= )
+	jpegxl? ( media-libs/libjxl )
+	openexr? ( >=media-libs/openexr-3:= )
+	raw? ( media-libs/libraw:= )
+"
+DEPEND="${RDEPEND}
+	test? ( heif? ( media-libs/libheif[x265] ) )
+"
+
+DOCS=( src/imageformats/AUTHORS )
+
+PATCHES=( "${FILESDIR}/${P}-heif-reject-invalid-files-w-0-size.patch" )
+
+src_configure() {
+	local mycmakeargs=(
+		-DKIMAGEFORMATS_JXL=$(usex jpegxl)
+		$(cmake_use_find_package avif libavif)
+		$(cmake_use_find_package eps Qt5PrintSupport)
+		-DKIMAGEFORMATS_HEIF=$(usex heif)
+		$(cmake_use_find_package openexr OpenEXR)
+		$(cmake_use_find_package raw LibRaw)
+	)
+	ecm_src_configure
+}