libheif (1.21.2-3ubuntu0.4) resolute-security; urgency=medium

  * SECURITY UPDATE: Integer underflow in Fraction constructor via double clap
    transform application
    - debian/patches/CVE-2026-62289.patch: Fix clap transform double-application
      in image tiling in libheif/box.cc, libheif/context.cc,
      libheif/image-items/image_item.cc, tests/CMakeLists.txt,
      tests/clap_zero_size.cc.
    - CVE-2026-62289
  * SECURITY UPDATE: Out-of-bounds read in uncompressed unci tile range slicing
    - debian/patches/CVE-2026-62292.patch: fix possible integer overflow in
      libheif/codecs/uncompressed/decoder_abstract.cc.
    - CVE-2026-62292

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Mon, 17 Aug 2026 13:59:51 -0400

libheif (1.21.2-3ubuntu0.3) resolute-security; urgency=medium

  * SECURITY UPDATE: Heap Buffer Overflow in Track::get_next_sample_raw_data
    - debian/patches/CVE-2026-47254-1.patch: Validate stsc sample coverage
      in libheif/sequences/track.cc
    - debian/patches/CVE-2026-47254-2.patch: add defensive check in
      init_sample_timing_table() in libheif/sequences/track.cc
    - CVE-2026-47254
  * SECURITY UPDATE: Integer overflow when parsing uncC.
    - debian/patches/CVE-2026-47709-1.patch: Prevent integer overflow
      when parsing uncC in libheif/codecs/uncompressed/unc_boxes.cc
    - debian/patches/CVE-2026-47709-2.patch: Reject unci images with no ispe
      box in libheif/image-items/unc_image.cc
    - CVE-2026-47709
  * SECURITY UPDATE: Integer overflow in inline mask size calculation
    - debian/patches/CVE-2026-47714.patch: Fix computation of size of inline
      region mask in libheif/region.cc
    - CVE-2026-47714
  * SECURITY UPDATE: OOB read in ImageItem_Grid::decode_grid_tile.
    - debian/patches/CVE-2026-48029.patch: Fix tile coordinates validation
      in rotated images in libheif/api/libheif/heif_tiling.cc and
      libheif/image-items/image_item.cc
    - CVE-2026-48029
  * SECURITY UPDATE: Unbounded heap allocation in sequence parser.
    - debian/patches/CVE-2026-50142.patch: Fix check against security limit
      in libheif/sequences/seq_boxes.cc and ../track.cc
    - CVE-2026-50142

 -- Kyle Kernick <kyle.kernick@canonical.com>  Tue, 07 Jul 2026 12:04:31 -0600

libheif (1.21.2-3ubuntu0.2) resolute-security; urgency=medium

  * SECURITY UPDATE: Out-of-bound memory access in tiled chroma decode.
    - debian/patches/CVE-2026-47178.patch: Fix heap OOB in
      libheif/codecs/uncompressed/decoder_component_interleave.cc,
      ../decoder_mixed_interleave.cc, and tests/uncompressed_encode.cc
    - CVE-2026-47178
  * SECURITY UPDATE: Integer overflow in UNCI.
    - debian/patches/CVE-2026-49271.patch: Prevent integer overflow
      when reading compressed data in
      libheif/codecs/uncompressed/decoder_abstract.cc
    - CVE-2026-49271

 -- Kyle Kernick <kyle.kernick@canonical.com>  Tue, 23 Jun 2026 15:00:39 -0600

libheif (1.21.2-3ubuntu0.1) resolute-security; urgency=medium

  * SECURITY UPDATE: Denial of service in Chuck construtor
    - debian/patches/CVE-2026-32738.patch: Check that 'stsc' box does not
      have zero samples per chunk in libheif/sequences/seq_boxes.cc
    - CVE-2026-32738
  * SECURITY UPDATE: Infinite loop for sequences with variable frame-rate.
    - debian/patches/CVE-2026-32739.patch: Fix infinite loop for sequences
      with variable frame-rate in libheif/api/libheif/heif_uncompressed.h
      and libheif/sequences/seq_boxes.cc
    - CVE-2026-32739
  * SECURITY UPDATE: Heap overflow in grid tile compositing.
    - debian/patches/CVE-2026-32740.patch: Fix computation of tile memory
      area for 4:2:0 chroma and odd tile sizes in libheif/pixelimage.cc
    - CVE-2026-32740
  * SECURITY UPDATE: Buffer overflow when reading mask image.
    - debian/patches/CVE-2026-32741.patch: Fix possible buffer overflow when
      reading mask image in libheif/image-items/mask_image.cc
    - CVE-2026-32741
  * SECURITY UPDATE: Information leak in decode.
    - debian/patches/CVE-2026-32814.patch: Initialize allocated memory to
      avoid information leak in
      libheif/image-items/grid.cc and libheif/pixelimage.cc
    - CVE-2026-32814
  * SECURITY UPDATE: Heap overflow in HeifPixelImage.
    - debian/patches/CVE-2026-32882.patch: Fix overlay image with alpha
      channels with stride different from color channel in
      libheif/pixelimage.cc
    - CVE-2026-32882
  * SECURITY UPDATE: Out-of-bounds read in Track::load.
    - debian/patches/CVE-2026-3950.patch: Validate stsc sample coverage
      against stsz/stts in libheif/sequences/track.cc
    - CVE-2026-3950
  * SECURITY UPDATE: Out-of-bounds read in decoder.
    - debian/patches/CVE-2026-41069.patch: Reject malformed sequence
      files with saiz samples but no chunks in libheif/sequences/track.cc
    - CVE-2026-41069
  * SECURITY UPDATE: Out-of-bounds read in SampleAuxInfoReader
    - debian/patches/CVE-2026-41071.patch: Reject malformed sequence
      files where saiz sample count exceeds actual samples in
      libheif/sequences/track.cc
    - CVE-2026-41071

 -- Kyle Kernick <kyle.kernick@canonical.com>  Tue, 16 Jun 2026 15:03:55 -0600

libheif (1.21.2-3) unstable; urgency=medium

  * Team upload
  * Have libheif-dev depend on libbrotli-dev as required by the
    pkgconfig file.
  * Demote libheif-plugin-libde265 from Depends to Suggests on Ubuntu
    to avoid possible patent concerns.
  * d/rules: Fix substvar assignment syntax for libheif:Suggests and
    libheif:Recommends (colon was used instead of equals sign, causing
    the variables to expand to empty strings)

 -- Charles <charles05@canonical.com>  Sat, 21 Feb 2026 14:12:49 -0000

libheif (1.21.2-2) unstable; urgency=medium

  * Team upload
  * Don't build kvazaar plugin on loong64 because kvazaar FTBFS there

 -- Jeremy Bícha <jbicha@ubuntu.com>  Sat, 07 Feb 2026 11:24:57 -0500

libheif (1.21.2-1) unstable; urgency=medium

  * New upstream version 1.21.2
    - Fixes CVE-2025-68431 (Closes: #1124317).
  * Remove patches applied upstream.
  * Update symbols for new upstream version.
  * d/control: Update build dependencies for cmake AOM detection.
  * d/control: Update Standards-Version to 4.7.3 and remove optional priority.

 -- Joachim Bauch <fancycode@debian.org>  Mon, 19 Jan 2026 16:27:41 +0100

libheif (1.20.2-2) unstable; urgency=medium

  * Upload to unstable.

 -- Joachim Bauch <fancycode@debian.org>  Mon, 18 Aug 2025 13:26:19 +0200

libheif (1.20.2-1) experimental; urgency=medium

  * New upstream version 1.20.2

 -- Joachim Bauch <fancycode@debian.org>  Tue, 05 Aug 2025 15:44:43 +0200

libheif (1.20.1-1) experimental; urgency=medium

  * New upstream version 1.20.1
  * Add patch to fix undefined symbol in svtenc plugin.
  * Update symbols for new upstream version.
  * Add "heif-view" binary package.
  * Add patch to load (encoding) plugins earlier.

 -- Joachim Bauch <fancycode@debian.org>  Mon, 28 Jul 2025 11:41:29 +0200

libheif (1.19.8-1) unstable; urgency=medium

  * New upstream version 1.19.8
  * d/control: Update Standards-Version to 4.7.2

 -- Joachim Bauch <fancycode@debian.org>  Tue, 29 Apr 2025 10:32:58 +0200

libheif (1.19.7-1) unstable; urgency=medium

  * New upstream version 1.19.7
  * Remove patch no longer necessary with new upstream version.

 -- Joachim Bauch <fancycode@debian.org>  Mon, 10 Mar 2025 13:46:58 +0100

libheif (1.19.5-1) unstable; urgency=medium

  * New upstream version 1.19.5
  * d/copyright: Update entry for renamed files.

 -- Joachim Bauch <fancycode@debian.org>  Tue, 07 Jan 2025 13:23:42 +0100

libheif (1.19.3-1) unstable; urgency=medium

  * New upstream version 1.19.3
  * d/rules: Don't treat all warnings as errors (matches upstream "release"
    preset).

 -- Joachim Bauch <fancycode@debian.org>  Mon, 11 Nov 2024 16:04:55 +0100

libheif (1.19.1-1) unstable; urgency=medium

  * Explicitly Build-Depend on libz-dev instead of pulling automagically.
  * New upstream version 1.19.1
  * d/rules: Enabled uncompressed codec (fixed upstream, Closes: #1077762).
  * Update symbols for new upstream version.
  * Adjust name of define to enable header compression.
  * Update patch for new upstream version.
  * d/rules: Check DEB_BUILD_OPTIONS in "override_dh_auto_test".

 -- Joachim Bauch <fancycode@debian.org>  Mon, 04 Nov 2024 09:56:34 +0100

libheif (1.18.2-2) unstable; urgency=medium

  * d/control: Only depend on rav1e plugin on architectures where it exists.

 -- Joachim Bauch <fancycode@debian.org>  Thu, 26 Sep 2024 09:05:32 +0200

libheif (1.18.2-1) unstable; urgency=medium

  * Change to use my @debian.org address.
  * New upstream version 1.18.2
  * d/control: Add metapackage "libheif-plugins-all" depending on all plugins.
  * d/control: Update dependencies of -dev package for plugin packages.
  * No need to manually symlink example, done by upstream.

 -- Joachim Bauch <fancycode@debian.org>  Tue, 24 Sep 2024 10:45:02 +0200

libheif (1.18.1-2) unstable; urgency=medium

  * Fix trailing comma in description.
  * d/control: Add reason for architecture list of librav1e-dev dependency.
  * d/rules: Disable uncompressed codec which doesn't work correctly on big-endian systems.
  * d/control: Add links to used libraries to plugin package descriptions.
  * Add decoding smoke test.

 -- Joachim Bauch <bauch@struktur.de>  Wed, 28 Aug 2024 11:33:20 +0200

libheif (1.18.1-1) unstable; urgency=medium

  * New upstream version 1.18.1
  * Remove patches now part of the upstream release.
  * Add patch to fix detection of OpenJPEG 2 in Debian.
  * Update libheif-examples for renamed and symlinked tool.
  * Update symbols for new upstream version.
  * d/copyright: Add more details and update for new upstream version.
  * Add symlink for manpage of renamed and symlinked tool from libheif-examples.
  * Update package descriptions.

 -- Joachim Bauch <bauch@struktur.de>  Thu, 01 Aug 2024 12:13:56 +0200

libheif (1.17.6-4) unstable; urgency=medium

  * Add kvazaar plugin (Closes: #1072007).
  * d/copyright: Update DEP-5 license ids, add missing exceptions.

 -- Joachim Bauch <bauch@struktur.de>  Mon, 24 Jun 2024 09:43:29 +0200

libheif (1.17.6-3) unstable; urgency=medium

  * Team upload
  * Stop building rav1e plugin on i386
  * On Ubuntu, demote libheif-plugin-x265 to Suggests
    and prefer libheif-plugin-aomdec to libheif-plugin-dav1d (LP: #2061089)

 -- Jeremy Bícha <jbicha@ubuntu.com>  Thu, 06 Jun 2024 10:10:36 -0400

libheif (1.17.6-2) unstable; urgency=medium

  [ Dylan Aïssi ]
  * Cherry-pick upstream patches:
      - a911b26: Fix compilation with libsvtav1 2.0.0 (Closes: #1072335)
      - 877de6b: fix memory leaks (CVE-2024-25269)

  [ Joachim Bauch ]
  * d/control: Update "Standards-Version" to 4.7.0
  * Migrate from "pkg-config" to "pkgconf".

 -- Joachim Bauch <bauch@struktur.de>  Mon, 03 Jun 2024 13:28:11 +0200

libheif (1.17.6-1) unstable; urgency=medium

  * New upstream version 1.17.6
  * Fixes CVE-2023-49460, CVE-2023-49462, CVE-2023-49463,
    CVE-2023-49464 (Closes: #1059151).
  * Remove patch now applied upstream.

 -- Joachim Bauch <bauch@struktur.de>  Thu, 21 Dec 2023 10:45:41 +0100

libheif (1.17.4-1) unstable; urgency=medium

  * New upstream version 1.17.4
  * Add patch to fix installing thumbnailer file.

 -- Joachim Bauch <bauch@struktur.de>  Tue, 21 Nov 2023 10:03:52 +0100

libheif (1.17.1-1) unstable; urgency=medium

  * New upstream version 1.17.1

 -- Joachim Bauch <bauch@struktur.de>  Mon, 23 Oct 2023 11:04:57 +0200

libheif (1.17.0-1) unstable; urgency=medium

  * New upstream version 1.17.0
    - Fix loading of plugins in some cases (Closes: #1041242, #1043506)
  * Update symbols for new upstream version.
  * Update codec selection for new upstream version.
  * Build new codec plugins (ffmpegdec, jpeg{dec,enc}, j2k{dec,enc}).
  * Pass path to plugins when running tests.

 -- Joachim Bauch <bauch@struktur.de>  Mon, 16 Oct 2023 14:30:23 +0200

libheif (1.16.2-3) unstable; urgency=medium

  * Team upload
  * Explicitly enable sharpyuv and have libheif-dev depend on libsharpyuv-dev
    per its pkgconfig file. Previously this was an automagic dependency
    and the pkgconfig file broke with a binNMU (Closes: #1052932)

 -- Jeremy Bícha <jbicha@ubuntu.com>  Sat, 30 Sep 2023 05:23:55 -0400

libheif (1.16.2-2) unstable; urgency=medium

  [ Pino Toscano ]
  * Enable the rav1e plugin only on archs where librav1e is available

  [ Fabian Greffrath ]
  * Let the libheif1 package depend on at least one HEIF and AVIF decoder plugin
    (Closes: #1040520)

 -- Joachim Bauch <bauch@struktur.de>  Mon, 17 Jul 2023 09:21:51 +0200

libheif (1.16.2-1) unstable; urgency=medium

  [ Sebastian Ramacher ]
  * Use libgdk-pixbuf-2.0-dev
  * Set MA for heif-gdk-pixbuf and heif-thumbnailer (Closes: #981551)

  [ Joachim Bauch ]
  * New upstream version 1.16.2
  * Update symbols for new upstream version.
  * Build codecs as plugins and separate packages that are pulled using
    "Recommends".
  * Add codec plugins using "rav1e" and "svtenc".
  * Remove duplicate MA entry in heif-gdk-pixbuf.
  * d/rules: No need to override "dh_autoreconf", no longer used.

 -- Joachim Bauch <bauch@struktur.de>  Tue, 20 Jun 2023 11:37:08 +0200

# Older entries have been removed from this changelog.
# To read the complete changelog use `apt changelog libheif-plugin-aomdec`.
