Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
2 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
An HEVC picture parameter set (PPS) stores explicit tile column widths and row heights computed against the sequence parameter set (SPS) active when it was parsed. A crafted stream can redefine that SPS afterwards, so that the tile sizes add up to more than the picture. The decoder then indexed past its coding tree block tables: Rust's bounds checks turned this into a panic, or the picture was decoded wrongly. A panic aborts the decoding thread, or the whole process when built with `panic = "abort"`. The crate forbids `unsafe` code, so there is no memory corruption. Any application that decodes untrusted HEIC files or HEVC streams with `heifer-hevc-dec`, directly or through the `heifer` crate, is affected. The flaw was corrected in 0.3.27 (commit `71dfc67`): a tile layout that does not match the picture size is rejected with `Error::Invalid` at decode time.
Recommended action: Upgrade to 0.3.27 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
An HEVC Range Extensions stream can set `cu_chroma_qp_offset_enabled_flag` in a slice while its picture parameter set carries an empty chroma QP offset list. The decoder then read the list at the signalled index, which panicked on the out-of-range access. A panic aborts the decoding thread, or the whole process when built with `panic = "abort"`. The crate forbids `unsafe` code, so there is no memory corruption. Any application that decodes untrusted HEIC files or HEVC streams with `heifer-hevc-dec`, directly or through the `heifer` crate, is affected. The flaw was corrected in 0.3.27 (commit `1a8426e`): with an empty list there is no offset to apply, and the offset is zero.
Recommended action: Upgrade to 0.3.27 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.