libheif-1.23.0-150700.3.15.1

- version update to 1.23.0:
  * add API functions to read and write metadata:
    ambient viewing environment
    nominal diffuse white luminance
  * adds a output_image_nclx_profile_passthrough option to heif_decoding_options
  * CVE-2026-50142 (GHSA-jvmp-j3cw-84mh) - unbounded heap allocation in HEIF
    sequence parser (stsz fixed-size mode missing bound check)
- fixes [bsc#1267455]

- version update to 1.22.2:
  * build issues with OpenJPEG plugin (#1813)
  * non-plain C in header (#1812)
  * CVE-2026-49271 (GHSA-r7qj-cg5r-r6vf) - Wrapped icef compressed-unit
    range check causes out-of-bounds read in uncompressed HEIF decoder
  * CVE TBD (GHSA-5hqq-636x-r3cr) - Out-of-bounds write in inline mask
    region API when source mask exceeds declared region
- deleted patches
  * libheif-fix-tests-no-HEVC.patch (upstreamed)
- fixes [bsc#1266281]
    [bsc#1266282] CVE-2026-49271

- added patches
  https://github.com/strukturag/libheif/commit/5780da88104270ef316c764c2c2945e0c43af624
  * libheif-fix-tests-no-HEVC.patch

- update to 1.22.0:
  * This is a large release with substantial new functionality,
    mainly focusing on generalized image formats (e.g., multi-
    spectral images) and a reworked implementation of ISO/IEC
    23001-17 (lossless image codec).
  * HDR up to 64 bpp
  * Multi-component images with arbitrary component layouts
    (multi-spectral images, arbitrary non-visual data)
  * Filter-array (Bayer / mosaic) images, with debayering in
    color transformation pipeline
  * Metadata: chroma-sample location (cloc), sample non-
    uniformity (snuc), sensor bad-pixel map (sbpm), polarization
    pattern (splz)
  * heif-dec can now convert to WebP (thanks to @torusrxxx).
  * heif-enc can now accept input from WebP, HEIF, pure raw files
    (including floating point pixel data), and CMYK JPEG
    (converted to RGB).
  * TIFF input can now read many TIFF formats used in geospatial
    imaging, like: 16-bit, signed integers, float samples, tiled
    TIFFs, GeoTIFF overview images, CMYK JPEG, YCbCr-as-JPEG.
    TIFFs with image tiling and multi-resolution layers are now
    reproduced as HEIFs when converted.
  * PNG decoder/encoder: cICP, cLLI, and mDCV chunk support
    (#1697).
  * heif-dec: auto-correct option to fix known input errors (e.g.
    mismatched NCLX/VUI).
  * Image, Track, Sequence samples, image component GIMI content
    IDs
  * Embedding of Turtle (.ttl) metadata files; automatic parsing
    of GIMI content IDs from Turtle
  * AOM encoder plugin now auto-selects IQ tune mode
  * mini-box syntax updated to the current HEIF version 4 draft
    (thanks @bradh for the initial implementation)
  * unif brand (globally-unique-ID) support
  * OMAF (omnidirectional images): indicate ISO/IEC 23000-22
    spherical/omnidirectional image projection
  * alpha bit-depth tracked through the color-conversion pipeline
  * CVE-2026-32738 (GHSA-7f2h-cmpf-v9ww)  : Heap OOB Read / SEGV
    Crash via Zero samples_per_chunk in stsc (bsc#1265874)
  * CVE-2026-32739 (GHSA-j9g7-q9hv-gq8c) : Infinite Loop DoS in
    stts Sample Duration Lookup (bsc#1265875)
  * CVE-2026-32740 (GHSA-frfr-f3vg-2g6j) : Heap-Buffer-Overflow
    Write in Grid Tile Chroma Compositing (bsc#1265876)
  * CVE-2026-32741 (GHSA-j3w5-7whq-p37q) : heap buffer overflow
    in decode_mask_image() (bsc#1265877)
  * CVE-2026-32814 (GHSA-4m8r-34pg-rvwc)  : Uninitialized Heap
    Memory Information Leak via Failed Grid Tiles (bsc#1265878)
  * CVE-2026-32882 (GHSA-hg7q-rjr2-8x46) : Heap Buffer OOB Read
    in overlay compositing due to wrong alpha stride (bsc#1265879)
  * CVE-2026-41069 (GHSA-p82x-fpmv-576r) : Out-of-bounds vector
    access leading to invalid dereference (bsc#1265979)
  * CVE-2026-41071 (GHSA-xj92-xjff-h8w3) : Heap buffer over-read
    in SampleAuxInfoReader via crafted HEIF sequence file with
    mismatched saiz sample count (bsc#1265980)
  * CVE-2026-47178 (GHSA-5x55-x5pf-9c6g) : Heap Out Of Bounds
    Write in unci subsystem (bsc#1265981)
  * CVE-2026-47247 (GHSA-2vh6-whr3-cmq3) : Heap Information
    Disclosure via Grid Image Gap + Uninitialized Pixel Plane
    Allocation (bsc#1265982)
  * CVE-2026-47251 (GHSA-p6q9-fhf2-vj9v) : Incomplete fix for
    (bsc#1265983)
    CVE-2026-3949: integer overflow bypass in vvdec_push_data2
  * CVE-2026-47254 (GHSA-wqjg-4x9g-6cvg) : Heap Buffer Overflow
    in `Track::get_next_sample_raw_data()` -- OOB Chunk Vector
    Access (bsc#1265987)
  * CVE-2026-47709 (GHSA-4h72-vqgp-9376) : NULL pointer
    dereference in heif_image_handle_get_image_tiling for
    malformed unci image missing ispe
    (bsc#1265988)
  * CVE-2026-47714 (GHSA-h4wm-6wwf-qvhx) : Integer overflow in
    inline mask size calculation causes undersized buffer
    allocation (bsc#1265989)
  * CVE-2026-48029 (GHSA-6x5f-qchq-cxqv) : heap OOB read in
    ImageItem_Grid::decode_grid_tile via irot-induced tile-
    coordinate underflow (bsc#1265990)
  * (GHSA-95jx-g5vf-cpp8) : Integer Overflow in
    SampleAuxInfoReader Offset Calculation (bsc#1265992)
  * (GHSA-p4r6-6972-g26m) : Incorrect byte-count initialization
    in BitstreamRange constructor allows container-boundary check
    bypass (bsc#1265995)
  * (GHSA-jh2w-m72q-q595) : Out-of-bounds read and assertion-
    based DoS in EXIF parsing (find_exif_tag / read32) with short
    EXIF TIFF payload (bsc#1265996)
  * (GHSA-9h96-c44j-jpq9) : Heap buffer overflow via uint32_t
    stride overflow in image plane allocation (bsc#1265997)
  * ## Build / CI
  * requires C++20
  * oss-fuzz integration overhauled
  * fuzzers for tile API, generic API surface, and per-codec
    encoders
- drop libheif-CVE-2026-3950.patch,
    libheif-CVE-2026-3949.patch: upstream

- added patches
  CVE-2026-3950: manipulation of the component stsz/stts can lead to out-of-bounds read [bsc#1259544]
  * libheif-CVE-2026-3950.patch

- update to 1.21.2:
  * build script for JS/WASM now supports building with JPEG2000 and
    "ISO23001-17 Uncompressed" support.
  * image sequence SAI data now works when using the OpenH264 decoder
    plugin

- update to 1.21.1:
  * This patch release only fixes a build error with some GCC versions
    because of a missing #include.
- update to 1.21.0:
  * This release adds full support for reading and writing HEIF image
    sequences. libheif will now encode HEIF image sequences with all
    included codecs.
  * Since HEIF image sequences are very similar to MP4 videos, this new
    version is also capable of decoding most MP4 videos (without audio,
    of course).
  * heif-enc documentation for sequence encoding
  * API documentation for reading and writing sequences
  * Support for image sequences with alpha channels. For most codecs,
    the alpha channel will be stored in a separate, auxiliary,
    monochrome track. For ISO/IEC 23001-17 (uncompressed) streams, the
    alpha channel is stored in the main video track.
  * Support for sequence track edit lists to define the number of
    sequence repetitions (without actually repeating the video data).
  * New encoder plugin using x264 to write H.264-compressed video
    streams and images.
  * The FFmpeg decoder plugin will now decode both H.265 and H.264.
  * Support for HEIF text items and language properties.
  * CVEs fixed: CVE-2025-68431
- fixes [bsc#1255735]

- version 1.20 requires at least ffmpeg 4, so go with version 7+

- update to 1.20.2:
  - When opening tiled images, do not check against maximum image
    size immediately to allow for tile-based decoding of very large
    images.
  - Several smaller fixes in writing image sequences
  - CMake option to disable building of heif-view, which pulls in
    dependency on SDL
  - Fixes reading/writing of GIMI content IDs
  - Some build fixes

- Remove conditionals for openh264, we can build against noopenh264

- update to 1.20.1:
  - Fixes a bug in decoder plugin loading.
- Changes from 1.20.0:
  - Sequences:
  - API for reading and writing image sequences. You can read and
    write sequences for all codecs (not just H.265 / AV1, but
    also JPEG-2000, ISO-23001-17 uncompressed, ...). Currently
    only intra-coded sequences are supported.
  - API for reading and writing metadata sequences. The metadata
    tracks can contain any raw timed data.
  - Support for SAI (sample auxiliary information). Timed samples
    (from image sequences or metadata) can have auxiliary data
    attached. Currently we support TAI timestamps and GIMI
    content description IDs.
  - Support for track references.
  - The API for sequences is described here:
    https://github.com/strukturag/libheif/wiki/Reading-and-Writing-Sequences
  - New command line tool heif-view to show HEIF sequences
    (requires libSDL).
  - Other new features:
  - You can specify a security limit for the maximum total memory
    libheif may use for decoding. This is easier to handle than
    specifying limits on the maximum image size or single memory
    allocations.
  - Support for TAI timestamps (in images and sequences) has been
    promoted from experimental to stable.
  - FFMPEG plugin now supports HDR decoding
  - Header files are now split into individual headers by topic.
    However, it should still be backwards compatible with heif.h
    being a catch-all covering the old content. For new
    functionality (sequences, TAI), you will need to include the
    specific headers.
  - All struct names of the API are now also typedefs.
- add build requires for brotli which it looks for since 1.18
- prepare building heif-view

- update to 1.19.8:
  * Set essential flag for transformative properties as required by
    MIAF. This fixes the display of AVIF images with transformations
    encoded by libheif in Chrome, which checks whether this flag is
    set. This mainly affected images encoded by ImageMagick.
  * If the environment variable LIBHEIF_SECURITY_LIMITS is set to OFF,
    libheif will not check any security limits. This can be used if a
    user works with large images and the application software does not
    allow to adjust the libheif security limits.
  * Resolved processing 16-bit JPEG-2000

- added patches
  CVE-2026-3949: manipulation of the argument size of a malicious frame can lead to out-of-bounds read (bsc#1259541)
  * libheif-CVE-2026-3949.patch

- security update
- added patches
  CVE-2025-68431 [bsc#1255735], heap buffer over-read in `HeifPixelImage::overlay()` via crafted HEIF that exercises the overlay image item
  * libheif-CVE-2025-68431.patch

- complete rpm changelog:
  * 0.18.0 fixed CVE-2023-0996 [bsc#1208640] and
    CVE-2024-41311 [bsc#1231714]
  * 1.15.2 fixed CVE-2023-29659 [bsc#1211174]

- update to 1.19.5:
  * fix heif_image_handle_is_premultiplied_alpha() #1394
- update to 1.19.4:
  * fix crash when encoding tiled unci images
  * fix crash in heif_context_encode_grid()
  * fix querying the preferred colorspace for monochroma AVIF files
  * error when using a chroma format or bit depth that is not supported
    by the Kvazaar plugin
  * output proper error message when memory allocation failed and use
    adapted security limits
  * heif-dec: do not show progress with option --quiet it given

- Fix build for Tumbleweed

- cleanup

- build for 15:
  * openjpeg only for 16+
  * require correct gcc version

- update to 1.19.3:
  * fixes a race condition that may lead to some image tiles not being
    included in the output image (#1379)
  * fix a potential crash when querying overlay image information

- update to 1.19.2:
  * fix DLL symbol export for non MSVC-compilers on Windows
  * fix running the unit tests from the build directory when building
    with plugins
  * switch to catch2 testing framework. We can now check for prerequisites
    at runtime and skip tests accordingly
- Remove patch that is no longer needed
  - only-run-test-when-HEVC-encoder-available.patch

- update to 1.19.1:
  * Fixes backwards compatibility of heif_context_set_maximum_image_size_limit()
- update to 1.19.0:
  * The major new feature in this decoding separate tiles of images and
    also encoding an image tile by tile. This allows to process
    high-resolution images that do not fit into memory. We support three
    tiling methods:
  - grid, which is the default tiling method used in most existing
    HEIC or AVIF images.
  - unci, which is the built-in tiling method of the ISO 23001-17
    uncompressed codec.
  - tili, which is a proprietary scheme with much less overhead than
    grid and which supports efficient streaming of high-resolution
    images over networks without having to download huge amounts of
    metadata. It also supports much larger images than possible with
    grid. As an extra, it supports the processing of multi-dimensional
    images, like 3D image cubes, or image sets addressed by several
    parameter dimensions.
  * decoding is faster, especially if you let libheif decide on the best
    colorspace to work in by passing heif_colorspace_unknown and
    heif_chroma_unknown to heif_decode_image(). It will then use the
    input colorspace and avoid unnecessary conversions.
  * support for multi-resolution pyramids (pymd) to show downscaled
    versions of high-resolution images
  * improved reader interface that enables to connect libheif to a
    network source. Libheif will request the portions of the image file
    that have to be downloaded from the server. This is especially
    useful in connection with the tiling / multi-resolution pyramid
    feature.
  * function to generate overlay images
  * decoding progress is signaled to the client application and decoding
    can be cancelled
  * decoding of AVC encoded images through OpenH264
  * security limits can be changed to be able to read very large images
- Skip test when HEVC encoder is unavailable
  + only-run-test-when-HEVC-encoder-available.patch

- build *-test subpackage with multibuild for running the test suite
- added sources
  + _multibuild

- Add heif-convert to the files list of the heif-examples sub-package

- update to 1.18.2:
  * fix regression that Exif orientation was not correctly reset when
    converting rotated HEIF (heif-dec)
  * swap Exif width/height when rotating image by 90 degrees
  * fix memory leak in OpenJPEG decoding plugin
  * pay attention to DESTDIR variable when installing heif-convert symlink

- update to 1.18.1:
  * Fix libbrotlidec pkg-config requires
  * tiff: Fix wrong type for "seekTIFF" function.
  * fix 32bit compiler warnings in box.cc
  * fix memory leaks in Brotli decoder

- update to 1.18.0:
  * now reads images generated by iOS 18
  * heif-convert has been renamed to heif-dec
  * encoding: property item boxes with identical content are reused
  * support ISO 23001-17 version 1 uncC minimized headers
  * support ISO 23001-17 images with 'deflate', 'zlib' and Brotli
    compression
  * heif-enc can read TIFF images
  * API functions to read/write raw items and item properties
  * many bug fixes and smaller enhancements
- Remove libheif-svtav1.patch: no longer needed

- Add libheif-svtav1.patch: Fix compilation with libsvtav1 2.0.0.

- update to 1.17.6:
  * A couple of build fixes and bug fixes detected by fuzzing.
  * Corrects these issues:
  * CVE-2023-49462 - #1043
  * CVE-2023-49463 - #1042
- drop libheif-CVE-2023-49462.patch,
  libheif-CVE-2023-49464.patch,
  libheif-CVE-2023-49460.patch: upstream

- security update
- added patches
  fix CVE-2023-49460 [bsc#1217902], segmentation violation in decode_uncompressed_image()
  + libheif-CVE-2023-49460.patch

- sync ExclusiveArch with SVT-AV1
- move HEIF plugins from examples to separate package
- make sure all subpackages use the same libheif1 ABI

- remove usage of presets to allow any cmake
- remove plugin conditional, to provide plugins on Leap as well
- remove rav1e conditional, because it is always available

- security update
- added patches
  fix CVE-2023-49462 [bsc#1217898], read16 segv
  + libheif-CVE-2023-49462.patch
  fix CVE-2023-49464 [bsc#1217900], UAF
  + libheif-CVE-2023-49464.patch

- update to 1.19.7:
  * Fixes a build error with SVT-AV1 encoder plugin when using reduced
    symbol visibility

- update to 1.19.6:
  * C++ and Go wrapper licenses have been changed to MIT
  * supports SVT-AV1 v3.0.0 encoder
  * support emscripten builds for ES6 modules
- Use correct license (these were changed in 2018)
- Remove 0001-support-SVT-AV1-3.0.0.patch (no longer needed)

- Add 0001-support-SVT-AV1-3.0.0.patch to make build succeed
  with new SVT-AV1 API.

- Ensure Name: is conditionalized for the multibuild flavors to not
  overwrite the .src.rpm (which is a processed .spec) and to allow
  OBS to properly distinguish them flavors.

- security update
- added patches
  fix CVE-2024-41311 [bsc#1231714],  out-of-bounds read and write in ImageOverlay:parse() due to decoding a heif file containing an overlay image with forged offsets
  + libheif-CVE-2024-41311.patch

- security update
- added patches
  fix CVE-2023-29659 [bsc#1211174], segfault caused by divide-by-zero
  + libheif-CVE-2023-29659.patch

- security update
- added patches
  fix CVE-2023-0996 [bsc#1208640], buffer overflow in heif_js_decode_image in libheif
  + libheif-CVE-2023-0996.patch

- Add missing gdk-pixbuf loader scriptlets (bsc#1199987).

- Update to version 1.12.0:
  + Check for MIAF conformance and add as compatible brand.
  + Signaling of premultiplied alpha.
  + Parse AV1 obu_sequence_header for av1C box.
  + Write pixi box in AVIFs.
  + Save alpha as monochrome in AVIF if possible.
  + Many build fixes.

- update to 1.11.0:
  * fix writing ispe box in HEIFs
  * nclx output profile encoding parameters
  * change the way nclx profiles is written so that macOS can read them
  * API for listing file brands and checking file type
  * fix heif_image_handle_get_depth_image_representation_info()

- Add baselibs.conf: generate libheif1-32bit, which is a new
  dependency for ImageMagick-32bit after that one now enabled
  libheif support.

- Build with dav1d and rav1e support, do this via:
  + Add pkgconfig(dav1d) BuildRequires.
  + Add conditional pkgconfig(rav1e) BuildRequires (currently
    Tumbleweed only).
- Drop libheif-lang Recommends: Package does not exist.

- Fix the License

- Only build with AV1-AVIF support
- Update to version 1.9.1
  * https://github.com/strukturag/libheif/releases/tag/v1.9.1
- fixed CVE-2020-23109 [bsc#1192382]
  (bca0162018df9a32d21c05aad1fa203881fa7813)

- update to 1.11.0:
  * fix writing ispe box in HEIFs
  * nclx output profile encoding parameters
  * change the way nclx profiles is written so that macOS can read them
  * API for listing file brands and checking file type
  * fix heif_image_handle_get_depth_image_representation_info()

- Add baselibs.conf: generate libheif1-32bit, which is a new
  dependency for ImageMagick-32bit after that one now enabled
  libheif support.

- Build with dav1d and rav1e support, do this via:
  + Add pkgconfig(dav1d) BuildRequires.
  + Add conditional pkgconfig(rav1e) BuildRequires (currently
    Tumbleweed only).
- Drop libheif-lang Recommends: Package does not exist.

- Re-download tarball and check with osc service runall
  download_files, all ok.

- Updated to version 1.10.0:
  * New API: may access all (vendor-dependent) auxiliary images
    (e.g. hdrgainmap, semanticskinmatte, ...).
  * When ICC profile is present, will now write two color boxes
  (nclx and ICC) into AVIF files. Also reads files with two color
  boxes.
  * Alpha image is now saved as monochrome.
  * Loading of 16bit greyscale PNGs in heif_enc.
  * Deprecated heif_enc option "-E".
  * Remove dependency on alloca().
  * Bug fixes.

- Add build condition to enable additional options, codecs and
  example binaries.
- Remove rav1e and dav1d support for the moment as still WIP.

- Fix the License

- Only build with AV1-AVIF support
- Update to version 1.9.1
  * https://github.com/strukturag/libheif/releases/tag/v1.9.1

- initial package for 1.3.2