From b97c8b5f198b27f375127cd597a35f2113544d03 Mon Sep 17 00:00:00 2001
From: Dirk Farin <dirk.farin@gmail.com>
Date: Tue, 24 Feb 2026 00:32:48 +0100
Subject: [PATCH] vvdec: check that NAL size does not exceed data size (#1712)

---
 libheif/plugins/decoder_vvdec.cc | 17 +++++++++++++++++
 1 file changed, 17 insertions(+)

Index: libheif-1.19.7/libheif/plugins/decoder_vvdec.cc
===================================================================
--- libheif-1.19.7.orig/libheif/plugins/decoder_vvdec.cc
+++ libheif-1.19.7/libheif/plugins/decoder_vvdec.cc
@@ -44,6 +44,7 @@ struct vvdec_decoder
   std::vector<std::vector<uint8_t>> nalus;
 };
 
+static const char kEmptyString[] = "";
 static const char kSuccess[] = "Success";
 
 static const int VVDEC_PLUGIN_PRIORITY = 100;
@@ -146,12 +147,28 @@ struct heif_error vvdec_push_data(void*
 
   const auto* data = (const uint8_t*) frame_data;
 
+  if (frame_size < 4) {
+    return {
+      heif_error_Decoder_plugin_error,
+      heif_suberror_End_of_data,
+      kEmptyString
+    };
+  }
+
   for (;;) {
     uint32_t size = ((((uint32_t) data[0]) << 24) |
                      (((uint32_t) data[1]) << 16) |
                      (((uint32_t) data[2]) << 8) |
                      (data[3]));
 
+    if (frame_size < 4 + size) {
+      return {
+        heif_error_Decoder_plugin_error,
+        heif_suberror_End_of_data,
+        kEmptyString
+      };
+    }
+
     data += 4;
 
     std::vector<uint8_t> nalu;