From 9ff4a5010c0c0355d29ba6c0e2717a0bd6bfce03 Mon Sep 17 00:00:00 2001
From: Dominik 'Rathann' Mierzejewski <dominik@greysector.net>
Date: Mon, 1 May 2023 00:38:36 +0200
Subject: [PATCH] backport fix for issue#590

---
 815.patch    | 133 +++++++++++++++++++++++++++++++++++++++++++++++++++
 libheif.spec |   4 ++
 2 files changed, 137 insertions(+)
 create mode 100644 815.patch

diff --git a/815.patch b/815.patch
new file mode 100644
index 0000000..b39d2b7
--- /dev/null
+++ b/815.patch
@@ -0,0 +1,133 @@
+From 1e24db049f05a53ff7bd732ccde50c41bcd7d690 Mon Sep 17 00:00:00 2001
+From: fairay <ffairay@gmail.com>
+Date: Thu, 6 Apr 2023 15:31:20 +0300
+Subject: [PATCH 1/2] Add image reference cycle detection
+
+---
+ libheif/error.cc     |  2 ++
+ libheif/heif.h       |  3 +++
+ libheif/heif_file.cc | 30 ++++++++++++++++++++++++++++++
+ libheif/heif_file.h  |  5 +++++
+ 4 files changed, 40 insertions(+)
+
+diff --git a/libheif/error.cc b/libheif/error.cc
+index d653cb44d7..7eef599cba 100644
+--- a/libheif/error.cc
++++ b/libheif/error.cc
+@@ -179,6 +179,8 @@ const char* heif::Error::get_error_string(heif_suberror_code err)
+       return "Unsupported parameter";
+     case heif_suberror_Invalid_parameter_value:
+       return "Invalid parameter value";
++    case heif_suberror_Item_reference_cycle:
++      return "Image reference cycle";
+ 
+       // --- Unsupported_feature ---
+ 
+diff --git a/libheif/heif.h b/libheif/heif.h
+index 793e46c871..c41955b19c 100644
+--- a/libheif/heif.h
++++ b/libheif/heif.h
+@@ -253,6 +253,9 @@ enum heif_suberror_code
+   // The value for the given parameter is not in the valid range.
+   heif_suberror_Invalid_parameter_value = 2006,
+ 
++  // Image reference cycle found in iref
++  heif_suberror_Item_reference_cycle = 2007,
++
+ 
+   // --- Unsupported_feature ---
+ 
+diff --git a/libheif/heif_file.cc b/libheif/heif_file.cc
+index 9b887e47b7..d1add4a3f3 100644
+--- a/libheif/heif_file.cc
++++ b/libheif/heif_file.cc
+@@ -318,6 +318,13 @@ Error HeifFile::parse_heif_file(BitstreamRange& range)
+   m_idat_box = std::dynamic_pointer_cast<Box_idat>(m_meta_box->get_child_box(fourcc("idat")));
+ 
+   m_iref_box = std::dynamic_pointer_cast<Box_iref>(m_meta_box->get_child_box(fourcc("iref")));
++  if (m_iref_box) {
++    std::unordered_set<heif_item_id> parent_items;
++    Error error = check_for_ref_cycle(get_primary_image_ID(), m_iref_box, parent_items);
++    if (error) {
++      return error;
++    }
++  }
+ 
+   m_iinf_box = std::dynamic_pointer_cast<Box_iinf>(m_meta_box->get_child_box(fourcc("iinf")));
+   if (!m_iinf_box) {
+@@ -345,6 +352,29 @@ Error HeifFile::parse_heif_file(BitstreamRange& range)
+ }
+ 
+ 
++Error HeifFile::check_for_ref_cycle(heif_item_id ID,
++                                    std::shared_ptr<Box_iref>& iref_box,
++                                    std::unordered_set<heif_item_id>& parent_items) const {
++  if (parent_items.contains(ID)) {
++    return Error(heif_error_Invalid_input,
++                 heif_suberror_Item_reference_cycle,
++                 "Image reference cycle");
++  }
++  parent_items.insert(ID);
++
++  std::vector<heif_item_id> image_references = iref_box->get_references(ID, fourcc("dimg"));
++  for (heif_item_id reference_idx : image_references) {
++    Error error = check_for_ref_cycle(reference_idx, iref_box, parent_items);
++    if (error) {
++      return error;
++    }
++  }
++
++  parent_items.erase(ID);
++  return Error::Ok;
++}
++
++
+ bool HeifFile::image_exists(heif_item_id ID) const
+ {
+   auto image_iter = m_infe_boxes.find(ID);
+diff --git a/libheif/heif_file.h b/libheif/heif_file.h
+index bdc0a10993..4c95227396 100644
+--- a/libheif/heif_file.h
++++ b/libheif/heif_file.h
+@@ -32,6 +32,7 @@
+ #include <string>
+ #include <map>
+ #include <vector>
++#include <unordered_set>
+ 
+ #if ENABLE_PARALLEL_TILE_DECODING
+ #include <mutex>
+@@ -199,6 +200,10 @@ namespace heif {
+ 
+     Error parse_heif_file(BitstreamRange& bitstream);
+ 
++    Error check_for_ref_cycle(heif_item_id ID,
++                              std::shared_ptr<Box_iref>& iref_box,
++                              std::unordered_set<heif_item_id>& parent_items) const;
++
+     std::shared_ptr<Box_infe> get_infe(heif_item_id ID) const;
+   };
+ 
+
+From 5170f7c0ed068b3c9eb91e257d9d496b4c611151 Mon Sep 17 00:00:00 2001
+From: fairay <ffairay@gmail.com>
+Date: Thu, 6 Apr 2023 17:01:35 +0300
+Subject: [PATCH 2/2] fix contains method usage
+
+---
+ libheif/heif_file.cc | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/libheif/heif_file.cc b/libheif/heif_file.cc
+index d1add4a3f3..df35011164 100644
+--- a/libheif/heif_file.cc
++++ b/libheif/heif_file.cc
+@@ -355,7 +355,7 @@ Error HeifFile::parse_heif_file(BitstreamRange& range)
+ Error HeifFile::check_for_ref_cycle(heif_item_id ID,
+                                     std::shared_ptr<Box_iref>& iref_box,
+                                     std::unordered_set<heif_item_id>& parent_items) const {
+-  if (parent_items.contains(ID)) {
++  if (parent_items.find(ID) != parent_items.end()) {
+     return Error(heif_error_Invalid_input,
+                  heif_suberror_Item_reference_cycle,
+                  "Image reference cycle");
diff --git a/libheif.spec b/libheif.spec
index b6af1bb..9c4f12b 100644
--- a/libheif.spec
+++ b/libheif.spec
@@ -11,6 +11,7 @@ Summary:        HEIF and AVIF file format decoder and encoder
 License:        LGPL-3.0-or-later and MIT
 URL:            https://github.com/strukturag/%{name}
 Source0:        %{url}/archive/v%{version}/%{name}-%{version}.tar.gz
+Patch0:         https://patch-diff.githubusercontent.com/raw/strukturag/libheif/pull/815.patch
 
 BuildRequires:  cmake
 BuildRequires:  gcc-c++
@@ -134,6 +135,9 @@ rm -rf third-party/
 
 
 %changelog
+* Sun Apr 30 2023 Dominik Mierzejewski <dominik@greysector.net> - 1.15.2-2
+- backport fix for issue#590
+
 * Tue Apr 11 2023 Sandro <devel@penguinpee.nl> - 1.15.2-1
 - Update to 1.15.2 (RHBZ#2183664)
 - Drop patch