Projects
home:manfred-h:Packman:Essentials
libheif
libheif.changes
Sign Up
Log In
Username
Password
Sorry, you are not authorized to perform this action.
×
Overview
Repositories
Revisions
Requests
Users
Attributes
Meta
File libheif.changes of Package libheif
------------------------------------------------------------------- Sun Nov 1 21:47:44 UTC 2026 - Dirk Müller <dmueller@suse.com> - update to 1.23.7: * CVE-2026-XXXXX (GHSA-xwcv-cp39-m2w4) Out-of-bounds read in the OpenH264 decoder plugin. An AVC SPS that libheif's coded- size check could not parse was skipped and still passed to OpenH264, which accepts cropping offsets whose sum wraps around and returns plane pointers far outside of its frame buffer. An SPS that cannot be parsed is now an error, also in subset SPS NAL units. The VVC SPS check had the same pattern and fails closed as well. Introduced with the coded-size check of v1.23.5. (high) * CVE-2026-XXXXX (GHSA-jx54-6rm6-2cgj) The AV1 coded-size check of v1.23.5 could be bypassed with libaom through an OBU without a size field. libheif stopped scanning at that OBU, while libaom continued and decoded a later, larger sequence header and frame. The last OBU of a sample is now given an explicit size before the data is scanned and decoded, so that both see the same framing. (high) * CVE-2026-XXXXX (GHSA-fpr5-xpfr-vcq3) The AV1 coded-size check of v1.23.5 could be bypassed with libaom. `num_ticks_per_picture_minus_1` was read with a UVLC reader that stops after 20 leading zero bits, although AV1 allows 31, and the error was ignored. The sequence header was then skipped, or scanned from the middle of the code where it could yield a small decoy size, and libaom allocated the real, much larger frame. The AV1 UVLC reader now follows the AV1 specification, and a sequence header that cannot be scanned completely is rejected. (high) * CVE-2026-XXXXX (GHSA-35mc-3887-rr37) Heap use-after-free when grid tiles are decoded in parallel. Several derived tiles (`iovl`, `iden` or `grid`) can share one coded input image. Their bit-depth queries read the decoder data of that input while another tile thread replaced it during decoding. A crafted file could crash the application or corrupt the heap with default options. The bit-depth queries now lock the decode mutex of the queried item. Only v1.23.6 is affected. (high) * CVE-2026-XXXXX (GHSA-hpg4-g2gc-pq42) Heap buffer overflow when padding an image to a size that is larger in one dimension and smaller in the other. `heif_image_extend_padding_to_size()` could be reached with such a size by re-encoding a sequence whose frames have different sizes with the x265 or x264 sequence encoder. Padding now refuses a size below the image or any of its planes, checks all planes before changing them, and the sequence encoders refuse a frame whose size differs from the first frame. (high) * CVE-2026-XXXXX (GHSA-9rpf-2x22-78m9) `heif_context_encode_thumbnail()` returned success without setting the output handle when the image already fits into the bounding box. Callers that released the handle, among them `heif-enc -t` and the C++ wrapper, freed an uninitialized or stale pointer (use-after-free, double free). The handle is now set to NULL in that case, as the API documentation says. (high) * CVE-2026-XXXXX (GHSA-48p4-gj45-w9v6) CPU exhaustion through derived images that decode a large image again and again and use only a few pixels of it, for example a grid of 1x1 tiles that are each a `clap` crop of an 8192x8192 overlay. A 2.6 kB file took 26 seconds to decode. Each decode now has a pixel budget of twice the size of the distinct images it uses (at least 2048x2048, at most `max_image_size_pixels`), single- tile decodes get their share of it, an exceeded security limit in a grid tile is an error also without strict decoding, and grid tiles outside of the image are not decoded. (high) * CVE-2026-XXXXX (GHSA-2g6j-vhr6-6wrj) CPU exhaustion through many coded pictures in one image item or sequence sample. The decoder decoded all of them, although only one image is returned: a 16 kB file with 1000 hidden HEVC pictures of 4096x4096 took 14 seconds. More than eight coded pictures per decode are now refused. HEVC, AVC and VVC count picture starts, AV1 counts frame OBUs, and AVC data with embedded start codes is refused. (high) * CVE-2026-XXXXX (GHSA-7qm8-hj35-269r) CPU exhaustion through repeated transformations. An item could carry many associations of the same `irot`, `imir` or `clap` property, and `iden` chains multiplied them: a 28 kB file took 73 seconds to decode. An item may now have at most one association of each of these properties, as HEIF requires, and at most 32 transformations are applied along a decode path. (high) * CVE-2026-XXXXX (GHSA-hhg3-fxg7-3gxw) CPU exhaustion while opening a file whose images have many `colr` associations. Reading the file regenerated and compared a colour profile property for every association. Reading and encoding now store colour profiles separately, so that opening a file does not create properties. (high) * CVE-2026-XXXXX (GHSA-73j7-gvm9-x8q6) CPU exhaustion in sequence decoding through samples that produce no output, for example when an edit list repeats a sample that the decoder does not display. One call of `heif_track_decode_next_image()` could run for minutes, also with `ignore_sequence_editlist`. The number of samples that are decoded without returning frames is now limited per codec, and `ignore_sequence_editlist` stops after the original samples. (high) * CVE-2026-XXXXX (GHSA-74mj-m37q-h3q9) Quadratic CPU time when opening a file with a `moov` box. The `stsc` entry of every chunk was looked up by a linear scan, so a file with many chunks and `stsc` entries took seconds to minutes to open, also when the application only reads the still image. The lookup is now a binary search, and an `stsc` table whose `first_chunk` values decrease is refused. (high) * CVE-2026-XXXXX (GHSA-rcqc-842v-m26h) Deadlock when decoding a grid image with parallel tile decoding and non-strict decoding. A tile that was skipped because it is not valid left an empty entry in the job queue, which was dispatched as a decode of item ID 0 and could deadlock with the other tile threads. Skipped tiles no longer create decode jobs. (high) * CVE-2026-XXXXX (GHSA-pfcm-ffqg-84hx) CPU exhaustion through cyclic Exif IFD pointers in the `heifio` helper of `heif- dec`, `heif-thumbnailer` and `heif-enc`. The tag search followed IFD pointers in loops. The traversal is now bounded by the size of the Exif data. Applications that use only the library, and the gdk-pixbuf loader, are not affected. (high) * CVE-2026-XXXXX (GHSA-gff5-3vgr-p8h2) The gdk-pixbuf loader ignored the error of `heif_image_scale_image()` and used an uninitialized image pointer, which gdk-pixbuf later released. A small valid file made the scaling fail when an application loaded it with a fixed width or height and kept the aspect ratio (a 1x65536 AVIF loaded at a width of 3840 requests a 2.9 TB image), which crashed the application. The loader now checks the result and refuses output sizes above `max_image_size_pixels`. (medium) * (GHSA-r9cg-w542-g7hj) `heif-dec -S` and `heif-info` printed and released an uninitialized URI pointer when a `urim` sample entry has no `uri ` box. Depending on the build, they crashed, or read and freed the URI of a previous track a second time. The library is not affected. (low) * All of these issues were found by Anthropic's OSS Scanner. Thanks also to @iPlayForSG and @SounLabs, who reported GHSA-74mj-m37q-h3q9 independently. * `heif_image_scale_image()` and `heif_track_get_urim_sample_entry_uri_of_first_cluster()` set their output pointer to NULL on error, so that a caller that misses the error check does not use an uninitialized pointer * A JPEG stream whose SOF marker cannot be parsed is refused instead of being passed to the decoder without a size check * The libde265 plugin refuses NAL units of 2 GB or more. libde265 takes the size as `int`, and versions 1.1.0 to 1.1.2 did not reject the negative value * Reading sample auxiliary information with a constant size from `saiz` is bounded by the sample count of the `saiz` box, as it already was for variable sizes * The chroma bit depth query of a grid image whose first tile is missing returns -1 instead of dereferencing a null pointer * heif-enc: the WebVMT parser was rewritten without `std::regex`, whose recursion overflowed the stack for long sync data (about 30,000 characters). Timestamps are checked as the WebVMT specification defines them (minutes and seconds up to 59, three fraction digits, hours that fit the 32-bit millisecond counter), invalid hex and base64 data and payloads that are not JSON are reported, and a missing file or a file without WEBVMT signature is an error * heif-enc: the PNG loader read past the end of the row for 16-bit grayscale images with alpha ------------------------------------------------------------------- Wed Oct 14 20:15:07 UTC 2026 - Dirk Müller <dmueller@suse.com> - description typo fixes ------------------------------------------------------------------- Wed Oct 14 14:14:14 UTC 2026 - olaf@aepfle.de - Add optional vvenc plugin ------------------------------------------------------------------- Tue Oct 13 15:03:35 UTC 2026 - Bjørn Lie <bjorn.lie@gmail.com> - Update to version 1.23.6: * Security fixes: + (GHSA-h4h8-qgvc-m7r2) Memory exhaustion in the OpenJPEG decoder plugin through the tile and component counts of a JPEG 2000 codestream. + (GHSA-fcmw-5764-7rq8) Memory exhaustion in the uncompressed (unci) decoder with generic compression. + (GHSA-6fqc-p7r8-2g36) CPU exhaustion in the unci decoder with generic compression. + (GHSA-q7mw-2fmm-5q94) Heap out-of-bounds read in libsharpyuv through sample values above the bit depth of an image. + (GHSA-vv35-6hxg-95x8) The bit depth that an image handle reports could differ from the bit depth of the decoded image, so that an application reading the planes with the bit depth of the handle read out of bounds. + (GHSA-8p2c-9wv4-rx4p) Null pointer dereference when decoding an image sequence in which a chunk of a visual track references a non-visual sample entry. + (GHSA-86ch-j429-fpr2) With the FFmpeg decoder plugin, the image size limit was not reliably applied before an HEVC bitstream reached FFmpeg, so a file could make the decoder allocate buffers for a much larger picture than its ispe property declares. + (GHSA-3gwx-cjv4-jr74) Reachable assertion when decoding a grid image whose tiles have an alpha plane of more than 16 bits, which unci tiles can have since v1.22.0. + (GHSA-hqpw-h8p6-22q9) Heap out-of-bounds read of up to 6 bytes in the FFmpeg decoder plugin. + (GHSA-hvwh-xpj6-ph5x) Use after free of an error message in the WebP (since v1.22.1) and raw (since v1.22.0) input loaders of heif-enc. + (GHSA-v5rj-g4wv-j5w3) Decoded images could contain sample values above their declared bit depth. * For hardening, bug fixes and behavior changes, please see: https://github.com/strukturag/libheif/releases/tag/v1.23.6 ------------------------------------------------------------------- Mon Sep 28 20:17:30 UTC 2026 - Dirk Müller <dmueller@suse.com> - fix typo ------------------------------------------------------------------- Mon Sep 21 19:05:50 UTC 2026 - Dirk Müller <dmueller@suse.com> - update to 1.23.5: * (GHSA-v8qw-hwjv-44hw) Memory exhaustion through a mismatch between the container and the bitstream image size. A crafted image can declare a small size in its ispe property while the bitstream declares a much larger coded frame. The container-level checks used the ispe size, so the oversized bitstream reached the decoder, which allocated a frame buffer for the in-band size before libheif rejected the mismatch. The advisory demonstrated this for AV1 with the libaom backend (a 351-byte AVIF declaring 64x64 but coding up to 27648x27648, allocating hundreds of MB to more than 10 GB), but the same class affects every codec whose real frame size lives in the bitstream. The coded size is now checked against max_image_size_pixels in the codec- independent decode path, before any bytes reach a decoder plugin: all AV1 sequence headers, all HEVC/AVC/VVC SPS NAL units (including those carried in the item data, not only the ones in the configuration record), the JPEG SOF marker and the JPEG 2000 SIZ reference grid are scanned for the largest coded size. (high) * (GHSA-qwpf-5wf7-r996) Heap use-after-free and double free when encoding an image that carries a TAI timestamp, including transcoding a file with an itai property. ImageDescription shallow-copied its raw heif_tai_timestamp_packet pointer, and a temporary in ImageItem::encode_to_bitstream_and_boxes() freed the packet while the item and the source image still held it. The timestamp is now stored by value. (medium) * (GHSA-9c75-9g8r-4728) Memory amplification through a JPEG 2000 pclr box declaring zero palette columns. The entry-count bound was skipped for zero columns, so an 11-byte box allocated 65,535 empty palette entries, and nested j2kH containers could repeat this within the child and nesting limits: a 3 KB file reached about 330 MB RSS, none of it charged to max_total_memory. Zero columns are rejected (ISO/IEC 15444-1 requires 1 to 255), the byte bound is unconditional, and the palette storage is charged to the memory limits. (medium) * (GHSA-r7gr-2xm2-23wf) Heap out-of-bounds read in alpha compositing for uncompressed (unci) images whose colour planes have different bit depths. Op_flatten_alpha_plane read every plane through the sample type of the first colour plane, so an 8-bit blue plane next to 16-bit red and green planes was read with a halved stride past its end, and the bytes ended up in the composited output. ColorState now tracks one bit depth per plane, and the operator declines mixed sample widths at planning time. (medium) * (GHSA-q492-cfcm-895h) The OpenJPEG decoder plugin's pre-decode size check bounded the JPEG 2000 window span (x1-x0)*(y1-y0) but not the absolute reference-grid coordinates, so a codestream with a 17-pixel window on a grid near the 32-bit boundary reached opj_decode(). Against OpenJPEG 2.3.1 this produced a heap-buffer-overflow write inside OpenJPEG (the class of CVE-2020-6851); OpenJPEG 2.5.4 rejects the input. The reference-grid area is now bounded as well. (low) * (GHSA-qfj5-c4pq-q998) Heap out-of-bounds read in the uncompressed encoder when an application attached a separate alpha plane to an image with an interleaved chroma format. The interleaved encoders took their component list from the chroma format (three entries) but decided whether to write alpha from the presence of an alpha plane, and indexed the list at [3]. heif_image_add_plane() now rejects a separate alpha plane on interleaved images, and the encoders derive both decisions from the chroma format. Only reachable through the public API; decoding never produces such an image. (low) * (GHSA-7pwf-qh74-p35w) The caller's heif_security_limits were not applied when parsing a mini box (the MIAF minimized image format) or the av1C/hvcC blob embedded in it; the built-in defaults were used instead. An application that tightened the limits got no enforcement of its max_memory_block_size or max_total_memory on such files. The allocations are bounded by the bytes present in the box, so this could not amplify memory use. (low) - fixes GHSA-v8qw-hwjv-44hw [bsc#1281953] GHSA-qwpf-5wf7-r996 [bsc#1281949] GHSA-9c75-9g8r-4728 [bsc#1281950] GHSA-r7gr-2xm2-23wf [bsc#1281951] GHSA-q492-cfcm-895h [bsc#1281954] GHSA-qfj5-c4pq-q998 [bsc#1281948] GHSA-7pwf-qh74-p35w [bsc#1281952] ------------------------------------------------------------------- Sun Sep 6 18:57:16 UTC 2026 - Andreas Stieger <andreas.stieger@gmx.de> - Update to version 1.23.4: * CVE-2026-XXXXX: The max_items security limit was not enforced for the child boxes of iinf, so a file could declare an unbounded number of items. * CVE-2026-XXXXX: Unbounded recursion in the reference-cycle check crashed the parser on a long chain of derived items, without bound when the item-count limit is disabled. * CVE-2026-XXXXX: Permanent decoder deadlock through a lock-order inversion in parallel grid tile decoding (enabled by default). * CVE-2026-XXXXX: Heap out-of-bounds read in the encoder pluginsi for images whose luma and chroma bit depths differ. * CVE-2026-XXXXX: Unreclaimable memory leak in heif_track_get_next_raw_sequence_sample(). * CVE-2026-XXXXX: Heap out-of-bounds read in the WebCodecs decoder plugin - includes fixes from 1.23.3: * CVE-2026-XXXXX: Heap buffer overflow (write) in the uncompressed (unci) mixed-interleave decoder when the two chroma components declare different bit depths. * CVE-2026-XXXXX: Permanent decoder deadlock through a reference cycle between an image and its alpha auxiliary image. * CVE-2026-XXXXX: Heap out-of-bounds read in the YCbCr 4:2:0 to 16-bit interleaved RGB conversion when the chroma planes have a lower bit depth than luma * CVE-2026-XXXXX: Heap buffer overflow in the SVT-AV1 encoder plugin when encoding a high-bit-depth alpha channel, and a double free on its send-picture error path. * CVE-2026-84451: Incomplete fix: the tile range check of the unci decoder (without icef) could still overflow, allowing an out-of-bounds read * CVE-2026-XXXXX: Heap out-of-bounds read when converting odd- height 4:2:0 frames of an uncompressed (uncv) image sequence to RGB. * CVE-2026-XXXXX: Out-of-bounds read in the RGB to YCbCr identity- matrix color conversion when the R, G, and B planes have different bit depths * CVE-2026-84450: A clap property combined with an oversized ispe reached an assert() in the Fraction arithmetic and aborted the process (incomplete fix). An error is returned instead. * Fix Several smaller findings * Fix Undefined behavior (negative shift) in the HDR bit-depth up-conversion for target bit depths above 16. Such conversions are now rejected. * A number of bug fixes ------------------------------------------------------------------- Thu Aug 27 16:25:23 UTC 2026 - Andreas Stieger <andreas.stieger@gmx.de> - Update to version 1.23.2: * CVE-2026-84383: Heap buffer overflow in scale_nearest_neighbor() via duplicate alpha planes from nested iden/auxl items. (boo#CVE-2026-84383) * Out-of-bounds read and write in derived-item and pixel-plane handling. Through iden and auxl item chains, a crafted file could attach pixel planes whose size differs from the image geometry; crop, scale, and plane-extraction code then indexed those planes with the wrong size. A working code-execution exploit was confirmed. Plane sizes are now validated wherever they are consumed. (boo#1279444) * CVE-2026-84384: brotli/zlib decompression of mime metadata and unci image data had no effective output-size limit, so a decompression bomb could exhaust memory. Decompressed output is now bounded by the security limits. (boo#1279445) * CVE-2026-84447: Chains of derived-image references (grid, iovl, iden) bypassed decode caching and memory limits, causing CPU and memory amplification. (boo#1279446) * CVE-2026-84446: Sequence sample-timing initialization could produce non-terminating decode loops and unbounded memory, bypassing max_sequence_frames. (boo#1279447) * CVE-2026-84444: Out-of-bounds write in the unci encoder when heif_context_add_image_tile() is given a tile whose planes do not match its declared size. (boo#1279448) * CVE-2026-84448: Heap out-of-bounds read in the inline-mask region API when mask_data_len does not match the region geometry. (boo#1279449) * C++ exceptions such as std::bad_alloc can no longer escape the C API read/decode entry points; they are returned as a heif_error instead of aborting the process * assert()s in the pixel-image plane allocation were replaced by runtime errors * stts/ctts tables describing more samples than the track can have are rejected * pclr (JPEG 2000 palette) box: the number of palette entries is bounded by the box size * BitReader::skip_bytes() is now constant time (fixes a fuzzer timeout on bogus alignment values) * iden items now validate the decoded image size like all other items * The uncompressed (unci) encoder rejects images without pixel planes * meta, mini, and moov boxes with size 0 (extending to the end of the file) are now parsed correctly * Fixed an integer overflow when probing the file size * Fixed undefined behavior (signed shift) when reading the NAL unit length in the OpenH264 decoder * heif_region_item_add_region_inline_mask_data() now requires non-zero width and height and the mask_data_len must equal the expected (width * height + 7) / 8; otherwise it returns an error instead of storing the mask * heif_image_add_plane() returns an error instead of aborting for bit depths outside 1..128 or interleaved component counts outside 1..255 - fixes CVE-2026-84383 [bsc#1279443] CVE-2026-84384 [bsc#1279445] CVE-2026-84447 [bsc#1279446] CVE-2026-84446 [bsc#1279447] CVE-2026-84444 [bsc#1279448] CVE-2026-84450 [bsc#1280002] GHSA-2jg2-4ch7-h545 [bsc#1279444] CVE-2026-84448 [bsc#1279449] ------------------------------------------------------------------- Thu Jul 30 06:58:39 UTC 2026 - Richard Rahl <rrahl0@opensuse.org> - Update to version 1.23.1: [jsc#PED-16355] + FFmpeg decoder plugin gains AV1, VVC, JPEG, and JPEG 2000/HTJ2K decoding + SVT-AV1 encoder: new tune=iq and ms-ssim tune parameters + C++ API: added getters/setters for the CLLI and MDCV HDR metadata boxes + Sequence decoder now scales the alpha auxiliary track to the main image size + Fixed pixi box writing for multi-channel images + Corrected the placement of the TAI clock_type field into the top 2 bits + Empty/unset plugin directory is no longer scanned + CVE-2026-62289 (GHSA-jc8f-p23p-5hjg) Integer underflow in Fraction constructor via double clap transform application + CVE-2026-62291 (GHSA-xpw3-9rhw-482x) Heap out of bounds write in libheif uncompressed encoder when writing images with mismatched auxiliary alpha dimensions + CVE-2026-62292 (GHSA-73p7-m7gg-w2jv) Out-of-bounds read in uncompressed unci tile range slicing + CVE-2026-62377 (GHSA-9ww4-9v47-m7pj) Reachable assertion in HeifContext::get_track() aborts on a valid-but-empty HEIF sequence file + (GHSA-46rp-pcq2-rpmr) Heap out-of-bounds write in the uncompressed encoder for RRGGBB images with interleaved bit-depth ≤ 8 - fixes CVE-2026-62289 [bsc#1273079] CVE-2026-62291 [bsc#1273080] CVE-2026-62292 [bsc#1273081] CVE-2026-62377 [bsc#1273082] GHSA-46rp-pcq2-rpmr [bsc#1273083] CVE-2026-84451 [bsc#1280001] ------------------------------------------------------------------- Tue Jun 2 06:19:35 UTC 2026 - Petr Gajdos <pgajdos@suse.com> - version update to 1.23.0: * add API functions to read and write metadata: ambient viewing environment nominal diffuse white luminance * adds a output_image_nclx_profile_passthrough option to heif_decoding_options * CVE-2026-50142 (GHSA-jvmp-j3cw-84mh) - unbounded heap allocation in HEIF sequence parser (stsz fixed-size mode missing bound check) - fixes [bsc#1267455] ------------------------------------------------------------------- Tue May 26 06:32:22 UTC 2026 - Petr Gajdos <pgajdos@suse.com> - version update to 1.22.2: * build issues with OpenJPEG plugin (#1813) * non-plain C in header (#1812) * CVE-2026-49271 (GHSA-r7qj-cg5r-r6vf) - Wrapped icef compressed-unit range check causes out-of-bounds read in uncompressed HEIF decoder * CVE TBD (GHSA-5hqq-636x-r3cr) - Out-of-bounds write in inline mask region API when source mask exceeds declared region - deleted patches * libheif-fix-tests-no-HEVC.patch (upstreamed) - fixes [bsc#1266281] [bsc#1266282] CVE-2026-49271 ------------------------------------------------------------------- Mon May 25 12:26:20 UTC 2026 - Petr Gajdos <pgajdos@suse.com> - added patches https://github.com/strukturag/libheif/commit/5780da88104270ef316c764c2c2945e0c43af624 * libheif-fix-tests-no-HEVC.patch ------------------------------------------------------------------- Wed May 20 17:59:54 UTC 2026 - Dirk Müller <dmueller@suse.com> - update to 1.22.0: * This is a large release with substantial new functionality, mainly focusing on generalized image formats (e.g., multi- spectral images) and a reworked implementation of ISO/IEC 23001-17 (lossless image codec). * HDR up to 64 bpp * Multi-component images with arbitrary component layouts (multi-spectral images, arbitrary non-visual data) * Filter-array (Bayer / mosaic) images, with debayering in color transformation pipeline * Metadata: chroma-sample location (cloc), sample non- uniformity (snuc), sensor bad-pixel map (sbpm), polarization pattern (splz) * heif-dec can now convert to WebP (thanks to @torusrxxx). * heif-enc can now accept input from WebP, HEIF, pure raw files (including floating point pixel data), and CMYK JPEG (converted to RGB). * TIFF input can now read many TIFF formats used in geospatial imaging, like: 16-bit, signed integers, float samples, tiled TIFFs, GeoTIFF overview images, CMYK JPEG, YCbCr-as-JPEG. TIFFs with image tiling and multi-resolution layers are now reproduced as HEIFs when converted. * PNG decoder/encoder: cICP, cLLI, and mDCV chunk support (#1697). * heif-dec: auto-correct option to fix known input errors (e.g. mismatched NCLX/VUI). * Image, Track, Sequence samples, image component GIMI content IDs * Embedding of Turtle (.ttl) metadata files; automatic parsing of GIMI content IDs from Turtle * AOM encoder plugin now auto-selects IQ tune mode * mini-box syntax updated to the current HEIF version 4 draft (thanks @bradh for the initial implementation) * unif brand (globally-unique-ID) support * OMAF (omnidirectional images): indicate ISO/IEC 23000-22 spherical/omnidirectional image projection * alpha bit-depth tracked through the color-conversion pipeline * CVE-2026-32738 (GHSA-7f2h-cmpf-v9ww) : Heap OOB Read / SEGV Crash via Zero samples_per_chunk in stsc (bsc#1265874) * CVE-2026-32739 (GHSA-j9g7-q9hv-gq8c) : Infinite Loop DoS in stts Sample Duration Lookup (bsc#1265875) * CVE-2026-32740 (GHSA-frfr-f3vg-2g6j) : Heap-Buffer-Overflow Write in Grid Tile Chroma Compositing (bsc#1265876) * CVE-2026-32741 (GHSA-j3w5-7whq-p37q) : heap buffer overflow in decode_mask_image() (bsc#1265877) * CVE-2026-32814 (GHSA-4m8r-34pg-rvwc) : Uninitialized Heap Memory Information Leak via Failed Grid Tiles (bsc#1265878) * CVE-2026-32882 (GHSA-hg7q-rjr2-8x46) : Heap Buffer OOB Read in overlay compositing due to wrong alpha stride (bsc#1265879) * CVE-2026-41069 (GHSA-p82x-fpmv-576r) : Out-of-bounds vector access leading to invalid dereference (bsc#1265979) * CVE-2026-41071 (GHSA-xj92-xjff-h8w3) : Heap buffer over-read in SampleAuxInfoReader via crafted HEIF sequence file with mismatched saiz sample count (bsc#1265980) * CVE-2026-47178 (GHSA-5x55-x5pf-9c6g) : Heap Out Of Bounds Write in unci subsystem (bsc#1265981) * CVE-2026-47247 (GHSA-2vh6-whr3-cmq3) : Heap Information Disclosure via Grid Image Gap + Uninitialized Pixel Plane Allocation (bsc#1265982) * CVE-2026-47251 (GHSA-p6q9-fhf2-vj9v) : Incomplete fix for (bsc#1265983) CVE-2026-3949: integer overflow bypass in vvdec_push_data2 * CVE-2026-47254 (GHSA-wqjg-4x9g-6cvg) : Heap Buffer Overflow in `Track::get_next_sample_raw_data()` -- OOB Chunk Vector Access (bsc#1265987) * CVE-2026-47709 (GHSA-4h72-vqgp-9376) : NULL pointer dereference in heif_image_handle_get_image_tiling for malformed unci image missing ispe (bsc#1265988) * CVE-2026-47714 (GHSA-h4wm-6wwf-qvhx) : Integer overflow in inline mask size calculation causes undersized buffer allocation (bsc#1265989) * CVE-2026-48029 (GHSA-6x5f-qchq-cxqv) : heap OOB read in ImageItem_Grid::decode_grid_tile via irot-induced tile- coordinate underflow (bsc#1265990) * (GHSA-95jx-g5vf-cpp8) : Integer Overflow in SampleAuxInfoReader Offset Calculation (bsc#1265992) * (GHSA-p4r6-6972-g26m) : Incorrect byte-count initialization in BitstreamRange constructor allows container-boundary check bypass (bsc#1265995) * (GHSA-jh2w-m72q-q595) : Out-of-bounds read and assertion- based DoS in EXIF parsing (find_exif_tag / read32) with short EXIF TIFF payload (bsc#1265996) * (GHSA-9h96-c44j-jpq9) : Heap buffer overflow via uint32_t stride overflow in image plane allocation (bsc#1265997) * ## Build / CI * requires C++20 * oss-fuzz integration overhauled * fuzzers for tile API, generic API surface, and per-codec encoders - drop libheif-CVE-2026-3950.patch, libheif-CVE-2026-3949.patch: upstream ------------------------------------------------------------------- Mon May 18 15:55:36 UTC 2026 - Petr Gajdos <pgajdos@suse.com> - added patches CVE-2026-3950: manipulation of the component stsz/stts can lead to out-of-bounds read [bsc#1259544] * libheif-CVE-2026-3950.patch ------------------------------------------------------------------- Mon Mar 16 09:03:49 UTC 2026 - Petr Gajdos <pgajdos@suse.com> - added patches CVE-2026-3949: manipulation of the argument size of a malicious frame can lead to out-of-bounds read (bsc#1259541) * libheif-CVE-2026-3949.patch ------------------------------------------------------------------- Fri Jan 16 08:12:26 UTC 2026 - Arjen de Korte <suse+build@de-korte.org> - update to 1.21.2: * build script for JS/WASM now supports building with JPEG2000 and "ISO23001-17 Uncompressed" support. * image sequence SAI data now works when using the OpenH264 decoder plugin ------------------------------------------------------------------- Sat Jan 3 17:48:42 UTC 2026 - Arjen de Korte <suse+build@de-korte.org> - update to 1.21.1: * This patch release only fixes a build error with some GCC versions because of a missing #include. - update to 1.21.0: * This release adds full support for reading and writing HEIF image sequences. libheif will now encode HEIF image sequences with all included codecs. * Since HEIF image sequences are very similar to MP4 videos, this new version is also capable of decoding most MP4 videos (without audio, of course). * heif-enc documentation for sequence encoding * API documentation for reading and writing sequences * Support for image sequences with alpha channels. For most codecs, the alpha channel will be stored in a separate, auxiliary, monochrome track. For ISO/IEC 23001-17 (uncompressed) streams, the alpha channel is stored in the main video track. * Support for sequence track edit lists to define the number of sequence repetitions (without actually repeating the video data). * New encoder plugin using x264 to write H.264-compressed video streams and images. * The FFmpeg decoder plugin will now decode both H.265 and H.264. * Support for HEIF text items and language properties. * CVEs fixed: CVE-2025-68431 - fixes [bsc#1255735] ------------------------------------------------------------------- Thu Sep 11 12:34:56 UTC 2025 - olaf@aepfle.de - version 1.20 requires at least ffmpeg 4, so go with version 7+ ------------------------------------------------------------------- Fri Aug 8 00:55:54 UTC 2025 - Marcus Rueckert <mrueckert@suse.de> - update to 1.20.2: - When opening tiled images, do not check against maximum image size immediately to allow for tile-based decoding of very large images. - Several smaller fixes in writing image sequences - CMake option to disable building of heif-view, which pulls in dependency on SDL - Fixes reading/writing of GIMI content IDs - Some build fixes ------------------------------------------------------------------- Tue Jul 29 08:01:31 UTC 2025 - Bjørn Lie <bjorn.lie@gmail.com> - Remove conditionals for openh264, we can build against noopenh264 ------------------------------------------------------------------- Sat Jul 5 15:51:19 UTC 2025 - Marcus Rueckert <mrueckert@suse.de> - update to 1.20.1: - Fixes a bug in decoder plugin loading. - Changes from 1.20.0: - Sequences: - API for reading and writing image sequences. You can read and write sequences for all codecs (not just H.265 / AV1, but also JPEG-2000, ISO-23001-17 uncompressed, ...). Currently only intra-coded sequences are supported. - API for reading and writing metadata sequences. The metadata tracks can contain any raw timed data. - Support for SAI (sample auxiliary information). Timed samples (from image sequences or metadata) can have auxiliary data attached. Currently we support TAI timestamps and GIMI content description IDs. - Support for track references. - The API for sequences is described here: https://github.com/strukturag/libheif/wiki/Reading-and-Writing-Sequences - New command line tool heif-view to show HEIF sequences (requires libSDL). - Other new features: - You can specify a security limit for the maximum total memory libheif may use for decoding. This is easier to handle than specifying limits on the maximum image size or single memory allocations. - Support for TAI timestamps (in images and sequences) has been promoted from experimental to stable. - FFMPEG plugin now supports HDR decoding - Header files are now split into individual headers by topic. However, it should still be backwards compatible with heif.h being a catch-all covering the old content. For new functionality (sequences, TAI), you will need to include the specific headers. - All struct names of the API are now also typedefs. - add build requires for brotli which it looks for since 1.18 - prepare building heif-view ------------------------------------------------------------------- Sun Apr 27 20:13:21 UTC 2025 - Arjen de Korte <suse+build@de-korte.org> - update to 1.19.8: * Set essential flag for transformative properties as required by MIAF. This fixes the display of AVIF images with transformations encoded by libheif in Chrome, which checks whether this flag is set. This mainly affected images encoded by ImageMagick. * If the environment variable LIBHEIF_SECURITY_LIMITS is set to OFF, libheif will not check any security limits. This can be used if a user works with large images and the application software does not allow to adjust the libheif security limits. * Resolved processing 16-bit JPEG-2000 ------------------------------------------------------------------- Mon Mar 3 18:28:54 UTC 2025 - Arjen de Korte <suse+build@de-korte.org> - update to 1.19.7: * Fixes a build error with SVT-AV1 encoder plugin when using reduced symbol visibility ------------------------------------------------------------------- Sun Mar 2 21:15:49 UTC 2025 - Arjen de Korte <suse+build@de-korte.org> - update to 1.19.6: * C++ and Go wrapper licenses have been changed to MIT * supports SVT-AV1 v3.0.0 encoder * support emscripten builds for ES6 modules - Use correct license (these were changed in 2018) - Remove 0001-support-SVT-AV1-3.0.0.patch (no longer needed) - fixes CVE-2026-84449 [bsc#1281829] ------------------------------------------------------------------- Fri Feb 28 15:42:34 UTC 2025 - Jan Engelhardt <jengelh@inai.de> - Add 0001-support-SVT-AV1-3.0.0.patch to make build succeed with new SVT-AV1 API. ------------------------------------------------------------------- Thu Feb 27 11:34:41 UTC 2025 - Dominique Leuenberger <dimstar@opensuse.org> - Ensure Name: is conditionalized for the multibuild flavors to not overwrite the .src.rpm (which is a processed .spec) and to allow OBS to properly distinguish them flavors. ------------------------------------------------------------------- Thu Dec 12 11:32:04 UTC 2024 - pgajdos@suse.com - complete rpm changelog: * 0.18.0 fixed CVE-2023-0996 [bsc#1208640] and CVE-2024-41311 [bsc#1231714] * 1.15.2 fixed CVE-2023-29659 [bsc#1211174] ------------------------------------------------------------------- Wed Nov 20 06:01:59 UTC 2024 - Arjen de Korte <suse+build@de-korte.org> - update to 1.19.5: * fix heif_image_handle_is_premultiplied_alpha() #1394 - update to 1.19.4: * fix crash when encoding tiled unci images * fix crash in heif_context_encode_grid() * fix querying the preferred colorspace for monochroma AVIF files * error when using a chroma format or bit depth that is not supported by the Kvazaar plugin * output proper error message when memory allocation failed and use adapted security limits * heif-dec: do not show progress with option --quiet it given ------------------------------------------------------------------- Fri Nov 15 19:33:39 UTC 2024 - Arjen de Korte <suse+build@de-korte.org> - Fix build for Tumbleweed ------------------------------------------------------------------- Thu Nov 14 15:18:09 UTC 2024 - Dirk Müller <dmueller@suse.com> - cleanup ------------------------------------------------------------------- Wed Nov 13 14:47:35 UTC 2024 - pgajdos@suse.com - build for 15: * openjpeg only for 16+ * require correct gcc version ------------------------------------------------------------------- Tue Nov 12 18:42:42 UTC 2024 - Arjen de Korte <suse+build@de-korte.org> - update to 1.19.3: * fixes a race condition that may lead to some image tiles not being included in the output image (#1379) * fix a potential crash when querying overlay image information ------------------------------------------------------------------- Wed Nov 6 17:54:42 UTC 2024 - Arjen de Korte <suse+build@de-korte.org> - update to 1.19.2: * fix DLL symbol export for non MSVC-compilers on Windows * fix running the unit tests from the build directory when building with plugins * switch to catch2 testing framework. We can now check for prerequisites at runtime and skip tests accordingly - Remove patch that is no longer needed - only-run-test-when-HEVC-encoder-available.patch ------------------------------------------------------------------- Sat Nov 2 18:19:58 UTC 2024 - Arjen de Korte <suse+build@de-korte.org> - update to 1.19.1: * Fixes backwards compatibility of heif_context_set_maximum_image_size_limit() - update to 1.19.0: * The major new feature in this decoding separate tiles of images and also encoding an image tile by tile. This allows to process high-resolution images that do not fit into memory. We support three tiling methods: - grid, which is the default tiling method used in most existing HEIC or AVIF images. - unci, which is the built-in tiling method of the ISO 23001-17 uncompressed codec. - tili, which is a proprietary scheme with much less overhead than grid and which supports efficient streaming of high-resolution images over networks without having to download huge amounts of metadata. It also supports much larger images than possible with grid. As an extra, it supports the processing of multi-dimensional images, like 3D image cubes, or image sets addressed by several parameter dimensions. * decoding is faster, especially if you let libheif decide on the best colorspace to work in by passing heif_colorspace_unknown and heif_chroma_unknown to heif_decode_image(). It will then use the input colorspace and avoid unnecessary conversions. * support for multi-resolution pyramids (pymd) to show downscaled versions of high-resolution images * improved reader interface that enables to connect libheif to a network source. Libheif will request the portions of the image file that have to be downloaded from the server. This is especially useful in connection with the tiling / multi-resolution pyramid feature. * function to generate overlay images * decoding progress is signaled to the client application and decoding can be cancelled * decoding of AVC encoded images through OpenH264 * security limits can be changed to be able to read very large images - Skip test when HEVC encoder is unavailable + only-run-test-when-HEVC-encoder-available.patch ------------------------------------------------------------------- Mon Oct 21 13:25:54 UTC 2024 - pgajdos@suse.com - build *-test subpackage with multibuild for running the test suite - added sources + _multibuild ------------------------------------------------------------------- Mon Aug 19 14:20:33 UTC 2024 - Manfred Hollstein <manfred.h@gmx.net> - Add heif-convert to the files list of the heif-examples sub-package ------------------------------------------------------------------- Thu Aug 8 19:03:34 UTC 2024 - Arjen de Korte <suse+build@de-korte.org> - update to 1.18.2: * fix regression that Exif orientation was not correctly reset when converting rotated HEIF (heif-dec) * swap Exif width/height when rotating image by 90 degrees * fix memory leak in OpenJPEG decoding plugin * pay attention to DESTDIR variable when installing heif-convert symlink ------------------------------------------------------------------- Sat Jul 27 19:29:36 UTC 2024 - Richard Rahl <rrahl0@opensuse.org> - update to 1.18.1: * Fix libbrotlidec pkg-config requires * tiff: Fix wrong type for "seekTIFF" function. * fix 32bit compiler warnings in box.cc * fix memory leaks in Brotli decoder ------------------------------------------------------------------- Wed Jul 10 16:13:42 UTC 2024 - Arjen de Korte <suse+build@de-korte.org> - update to 1.18.0: * now reads images generated by iOS 18 * heif-convert has been renamed to heif-dec * encoding: property item boxes with identical content are reused * support ISO 23001-17 version 1 uncC minimized headers * support ISO 23001-17 images with 'deflate', 'zlib' and Brotli compression * heif-enc can read TIFF images * API functions to read/write raw items and item properties * many bug fixes and smaller enhancements - Remove libheif-svtav1.patch: no longer needed ------------------------------------------------------------------- Thu Apr 18 12:18:46 UTC 2024 - Dominique Leuenberger <dimstar@opensuse.org> - Add libheif-svtav1.patch: Fix compilation with libsvtav1 2.0.0. ------------------------------------------------------------------- Wed Jan 3 09:26:08 UTC 2024 - Dirk Müller <dmueller@suse.com> - update to 1.17.6: * A couple of build fixes and bug fixes detected by fuzzing. * Corrects these issues: * CVE-2023-49462 - #1043 * CVE-2023-49463 - #1042 - drop libheif-CVE-2023-49462.patch, libheif-CVE-2023-49464.patch, libheif-CVE-2023-49460.patch: upstream ------------------------------------------------------------------- Tue Dec 19 10:40:25 UTC 2023 - pgajdos@suse.com - security update - added patches fix CVE-2023-49460 [bsc#1217902], segmentation violation in decode_uncompressed_image() + libheif-CVE-2023-49460.patch ------------------------------------------------------------------- Mon Dec 18 18:18:18 UTC 2023 - olaf@aepfle.de - sync ExclusiveArch with SVT-AV1 - move HEIF plugins from examples to separate package - make sure all subpackages use the same libheif1 ABI ------------------------------------------------------------------- Tue Dec 12 12:12:12 UTC 2023 - olaf@aepfle.de - remove usage of presets to allow any cmake - remove plugin conditional, to provide plugins on Leap as well - remove rav1e conditional, because it is always available ------------------------------------------------------------------- Mon Dec 11 12:26:56 UTC 2023 - pgajdos@suse.com - security update - added patches fix CVE-2023-49462 [bsc#1217898], read16 segv + libheif-CVE-2023-49462.patch fix CVE-2023-49464 [bsc#1217900], UAF + libheif-CVE-2023-49464.patch ------------------------------------------------------------------- Wed Nov 22 09:38:48 UTC 2023 - Dirk Müller <dmueller@suse.com> - update to 1.17.5: * Fixes installation of the Gnome "heif.thumbnailer" config file. ------------------------------------------------------------------- Mon Nov 20 22:18:40 UTC 2023 - Dirk Müller <dmueller@suse.com> - update to 1.17.4: * ispe boxes in AVIF images with clap boxes were written with the wrong size (would only happen with svt-av1 encoder), always output MIAF brand for AVIF images * fix kvazaar encoding with odd image sizes and encodings with non-4:2:0 chroma ------------------------------------------------------------------- Fri Nov 3 14:49:07 UTC 2023 - Arjen de Korte <suse+build@de-korte.org> - update to 1.17.3 * Bug fix #1026: corrected transform box generation for heif_orientation_flip_vertically and heif_orientation_rotate_90_cw_then_flip_vertically - update to 1.17.2: * #1010 loading of HEIF files with extra zero bytes at the end * #1015 / #1017 default nclx values now match sRGB * support JPEG2000 images with alpha channel * various smaller fixes ------------------------------------------------------------------- Thu Oct 19 16:12:42 UTC 2023 - Arjen de Korte <suse+build@de-korte.org> - update to 1.17.1: * fix issue of loading images with premultiplied alpha channel * correctly set compatible_version for macOS dylib builds * fix loading HDR PNGs, but encoding them as 8-bit SDR * fix saving AVIF with alpha using the SVT-AV1 encoder - cmake-presets version 3 requires cmake >= 3.21 ------------------------------------------------------------------- Tue Oct 17 21:09:55 UTC 2023 - Arjen de Korte <suse+build@de-korte.org> - update to 1.17.0: * Kvazaar encoder (HEIC) as alternative to x265 * ffmpeg decoder (HEIC) decoding with potential hardware decoder support * jpegdec / jpegenc codecs for JPEG in HEIF * j2kdec, j2kenc codecs for JPEG-2000 in HEIF (still experimental) * added support for region masks * added support for alpha channels in images decoded with JS/WASM * heif-enc and heif-convert can be called with only input filenames, input and output filename, or with -o option. This makes the use of the two command more consistent. * added 4:2:2 <-> 4:4:4 color conversion with bilinear upscaling / average filtering * heif_context_get_image_handle() can now also access non-top-level images * add script to build Android libraries for all platforms * known bugs have been fixed ------------------------------------------------------------------- Mon May 22 19:32:26 UTC 2023 - Arjen de Korte <suse+build@de-korte.org> - update to 1.16.2: * adds an option to heif-convert to set the PNG compression level * fixes a few build issues with some compilers * fixes the --encoder option in heif-enc * fixes heif_item_get_properties_of_type and heif_item_get_transformation_properties ------------------------------------------------------------------- Wed May 3 11:14:59 UTC 2023 - Arjen de Korte <suse+build@de-korte.org> - Package the optional plugins in separate packages, so it is possible to install a minimal version of the library without pulling in the libraries needed by the plugins only. - BuildRequires pkgconfig(libwebp) as it is required to make sharp-yuv work. ------------------------------------------------------------------- Wed May 3 07:38:09 UTC 2023 - Dirk Müller <dmueller@suse.com> - update to 1.16.1: * Small maintenance update that fixes building the gdk-pixbuf loader. * The source package name has also been changed back to the old naming scheme. * Support for HEIFv2 regions (rgan) and user annotations (udes). This enables to annotate regions in the image with several geometric primitives and assign user text descriptions to them. Thank you @bradh for the contributions. Mask support will be added soon. * Previously, chroma was downsampled and upsampled with a simple nearest-neighbor method. We now included the sharp-yuv chroma downsampling algorithm. This gives improved image quality when images are downsampled to 4:2:0 and upsampled with bilinear interpolation. Thank you @maryla-uc for the contributions. * The bilinear chroma upsampling and averaging downsampling algorithms are also new. You can choose what to use. * We added experimental support for decoding uncompressed images according to ISO/IEC 23001-17:2023. This is work in progress and currently decoding only. Thank you @bradh for the contributions. * There are new APIs to query the image transformations. Thus, you may choose to get the original image and apply the transformations yourself. * A longstanding bug writing non-compliant 'ispe' boxes (image size) has been fixed. Files should be standard compliant now. * When building binary packages, you can now make use of a CMake presets to set a default configuration. * The deprecated autotools build files have been removed. ------------------------------------------------------------------- Thu Mar 30 18:46:30 UTC 2023 - Arjen de Korte <suse+build@de-korte.org> - update to 1.15.2 * Fixes an incompatibility with AOM v3.6.0. * A couple of smaller fixes. ------------------------------------------------------------------- Thu Feb 28 15:21:03 UTC 2023 - Manfred Hollstein <manfred.h@gmx.net> - Remove no longer existing files avif.xml and heif.xml from the files list ------------------------------------------------------------------- Thu Feb 16 18:49:09 UTC 2023 - Arjen de Korte <suse+build@de-korte.org> - update to 1.15.1 * fix compilation without plugins - update to 1.15.0 * codec plugin system now also works with Windows * heif_convert: manually choose which decoder should be used * support for CLLI (content light level box), MDCV (mastering display colour volume), PASP (pixel aspect) information * ICC profile support in gdk-pixbuf loader * various fixes - build with plugins enabled on Tumbleweed - remove upstreamed patches - 2ca02a128b2f76f7f293aa86a2ce1e04a8306c65.patch - b6812284a2d70f29a5121ec3dbe652da07fdbbb7.patch ------------------------------------------------------------------- Thu Feb 2 19:25:04 UTC 2023 - Manfred Hollstein <manfred.h@gmx.net> - Use chrpath during build to delete otherwise illegal runtime directories stored as RPATH in the executables ------------------------------------------------------------------- Fri Jan 27 14:32:03 UTC 2023 - Dirk Müller <dmueller@suse.com> - add 2ca02a128b2f76f7f293aa86a2ce1e04a8306c65.patch b6812284a2d70f29a5121ec3dbe652da07fdbbb7.patch: (bsc#1206945) * replace internal API with public API and fix typo (Fixes #745) ------------------------------------------------------------------- Fri Jan 27 12:03:34 UTC 2023 - Arjen de Korte <suse+build@de-korte.org> - The fix for rpath error for the examples sub-package was mistakenly moved ------------------------------------------------------------------- Fri Jan 20 14:37:00 UTC 2023 - Arjen de Korte <suse+build@de-korte.org> - Add missing BuildRequires for SVT-AV1 support for Tumbleweed (only for x86_64) ------------------------------------------------------------------- Sun Jan 15 12:31:38 UTC 2023 - Arjen de Korte <suse+build@de-korte.org> - Disable dynamic plugin interface and build plugins statically instead (boo#1206945) ------------------------------------------------------------------- Sat Jan 7 16:16:22 UTC 2023 - Dirk Müller <dmueller@suse.com> - update to v1.14.2: * A function name typo in the C++ wrapper was corrected in v1.14.1, but the old function name should not have been removed from the API * (ColorProfile_nclx::set_color_primaries()). The old name is added to the API again in this release. ------------------------------------------------------------------- Tue Jan 3 12:43:46 UTC 2023 - Dirk Müller <dmueller@suse.com> - update to v1.14.1: * various issues is the build system * encoding images smaller than 64x64 with svt-av1 * the 'quality' parameter for svt-av1 * a potentially wrong image orientation for PNG inputs * crash on non-null terminated XMP input * HDR RGB to YCbCr conversion coefficients for limited range coefficients ------------------------------------------------------------------- Sat Dec 3 10:35:42 UTC 2022 - Dirk Müller <dmueller@suse.com> - update to 1.14.0: * adds SVT-AV1 encoder as AVIF backend * dynamic plugin interface for installing codecs independently from libheif (currently Unix only) * add XMP header compression (using zlib) * library should now be initialized with heif_init() * heif_convert: extract EXIF and XMP to separate files * heif_enc: add benchmarking function to compare codecs * copy EXIF/XMP between HEIC/AVIF files and JPEG/PNG in all kinds of combinations * remove EXIF orientation tag from input when converting to HEIC/AVIF and * generate irot/imir boxes matching the input orientation ------------------------------------------------------------------- Thu Nov 3 01:53:22 UTC 2022 - Yifan Jiang <yfjiang@suse.com> - The newly added thumbnailer is not only useful for gnome, so rename the sub-package gnome-heif-thumbnailer to heif-thumbnailer before its debut - Supplement libeheif1 with heif-thumbnailer ------------------------------------------------------------------- Tue Nov 1 18:10:22 UTC 2022 - Andreas Schneider <asn@cryptomilk.org> - Create a gnome-heif-thumbnailer sub-package (boo#1204865) ------------------------------------------------------------------- Mon Oct 31 08:41:43 UTC 2022 - Michael Vetter <mvetter@suse.com> - Update to 1.13.0: * pay attention to the correct chroma sample positions * heif_image now holds a list of decoding warnings * use AOM AOM_USAGE_ALL_INTRA mode instead of AOM_USAGE_GOOD_QUALITY * 'strict' decoding mode with more checks for standard conformity of input * support for EXIF data >64k in JPEG output * proper library initialization and cleanup * separate quality settings for alpha channel (AOM) * improve color conversion speed (no lroundf) * build and packaging fixes - Remove 0f8496f22d284e1a69df12fe0b72f375aed31315.patch: contained - boo#1204865: No HEIC image preview in nautilus fixed by update ------------------------------------------------------------------- Fri Aug 26 12:51:15 UTC 2022 - Andreas Schneider <asn@cryptomilk.org> - Support version 1.0.0 of dav1d - Added 0f8496f22d284e1a69df12fe0b72f375aed31315.patch ------------------------------------------------------------------- Fri Aug 12 16:13:06 UTC 2022 - David Haller <dnh@opensuse.org> - Fix rpath error for the examples sub-package ------------------------------------------------------------------- Fri May 27 16:27:00 UTC 2022 - Stanislav Brabec <sbrabec@suse.com> - Add missing gdk-pixbuf loader scriptlets (bsc#1199987). - Recommend gdk-pixbuf-loader-libheif whenever both related packages are installed. ------------------------------------------------------------------- Fri Jun 11 17:55:11 UTC 2021 - Bjørn Lie <bjorn.lie@gmail.com> - Update to version 1.12.0: + Check for MIAF conformance and add as compatible brand. + Signaling of premultiplied alpha. + Parse AV1 obu_sequence_header for av1C box. + Write pixi box in AVIFs. + Save alpha as monochrome in AVIF if possible. + Many build fixes. ------------------------------------------------------------------- Wed Apr 7 23:21:55 UTC 2021 - Dirk Müller <dmueller@suse.com> - update to 1.11.0: * fix writing ispe box in HEIFs * nclx output profile encoding parameters * change the way nclx profiles is written so that macOS can read them * API for listing file brands and checking file type * fix heif_image_handle_get_depth_image_representation_info() ------------------------------------------------------------------- Fri Jan 8 07:26:59 UTC 2021 - Dominique Leuenberger <dimstar@opensuse.org> - Add baselibs.conf: generate libheif1-32bit, which is a new dependency for ImageMagick-32bit after that one now enabled libheif support. ------------------------------------------------------------------- Fri Dec 25 15:20:28 UTC 2020 - Bjørn Lie <bjorn.lie@gmail.com> - Build with dav1d and rav1e support, do this via: + Add pkgconfig(dav1d) BuildRequires. + Add conditional pkgconfig(rav1e) BuildRequires (currently Tumbleweed only). - Drop libheif-lang Recommends: Package does not exist. ------------------------------------------------------------------- Thu Dec 17 16:54:31 UTC 2020 - malcolmlewis@opensuse.org - Re-download tarball and check with osc service runall download_files, all ok. ------------------------------------------------------------------- Wed Dec 16 14:16:35 UTC 2020 - malcolmlewis@opensuse.org - Updated to version 1.10.0: * New API: may access all (vendor-dependent) auxiliary images (e.g. hdrgainmap, semanticskinmatte, ...). * When ICC profile is present, will now write two color boxes (nclx and ICC) into AVIF files. Also reads files with two color boxes. * Alpha image is now saved as monochrome. * Loading of 16bit greyscale PNGs in heif_enc. * Deprecated heif_enc option "-E". * Remove dependency on alloca(). * Bug fixes. ------------------------------------------------------------------- Sun Nov 1 15:21:34 UTC 2020 - malcolmlewis@opensuse.org - Add build condition to enable additional options, codecs and example binaries. - Remove rav1e and dav1d support for the moment as still WIP. ------------------------------------------------------------------- Tue Oct 13 16:49:04 UTC 2020 - Andreas Schneider <asn@cryptomilk.org> - Fix the License ------------------------------------------------------------------- Mon Oct 12 20:12:32 UTC 2020 - Andreas Schneider <asn@cryptomilk.org> - Only build with AV1-AVIF support - Update to version 1.9.1 * https://github.com/strukturag/libheif/releases/tag/v1.9.1 - fixed CVE-2020-23109 [bsc#1192382] (bca0162018df9a32d21c05aad1fa203881fa7813) ------------------------------------------------------------------- Wed Jul 08 15:54:52 UTC 2018 - plinnell@opensuse.org - initial package for 1.3.2
Locations
Projects
Search
Status Monitor
Help
Open Build Service
OBS Manuals
API Documentation
OBS Portal
Reporting a Bug
Contact
Mailing List
Forums
Chat (IRC)
Twitter
Open Build Service (OBS)
is an
openSUSE project
.