mirror of
https://github.com/storytold/photocraft.git
synced 2026-10-27 11:27:21 -06:00
null 00000111
0b935da882
heic-rs 0.1.2 to 0.1.4 fix six panics on malformed files, found by fuzzing: four in release builds (a uuid box too small for its extended type, a block starting right of the picture, a conformance window larger than the picture, and a reference row below the picture) and two with overflow checks on (a PCM bit depth above the sample bit depth, a slice QP out of range). The API, MSRV and output are unchanged. Both pins move together: crates/heif and the codecs fuzz target, which calls heic-rs directly. guarded() stays as the backstop it was meant to be.
20 lines
800 B
TOML
20 lines
800 B
TOML
[package]
|
|
name = "photocraft-heif"
|
|
description = "Optional HEIF/HEIC still-image decoder for PhotoCraft (a thin, panic-guarded wrapper around heic-rs)"
|
|
version.workspace = true
|
|
edition.workspace = true
|
|
license.workspace = true
|
|
rust-version.workspace = true
|
|
|
|
[dependencies]
|
|
# Pure Rust, no unsafe. Pinned exactly: a young, single-owner crate that parses untrusted files;
|
|
# moving the pin is a reviewed change (re-run the fuzz target and the heif corpus tests).
|
|
heic-rs = { version = "=0.1.4", default-features = false, features = ["std"] }
|
|
|
|
# The tiles of a HEIC photo decode in parallel on native; wasm stays single-threaded.
|
|
[target.'cfg(not(target_arch = "wasm32"))'.dependencies]
|
|
heic-rs = { version = "=0.1.4", default-features = false, features = ["std", "parallel"] }
|
|
|
|
[lints]
|
|
workspace = true
|