heifload: limit per-image memory usage to 2GB by default (#4514)

lovell · web-flow · commit d87f9ed45f2d · 2025-05-13T09:02:54.000+01:00
The existing unlimited flag can be used to remove this
diff --git a/ChangeLog b/ChangeLog
@@ -32,6 +32,7 @@ master
 - jxlsave writes in chunks, for lower memory use on large images (but we now
   need libjxl 0.11 at minimum)
 - increase minimum version of libheif dependency to 1.11.0
+- heifload: limit per-image memory usage to 2GB (requires libheif 1.20.0+).
 
 8.16.1
 
diff --git a/libvips/foreign/heifload.c b/libvips/foreign/heifload.c
@@ -355,6 +355,11 @@ vips_foreign_load_heif_build(VipsObject *object)
 		 */
 		heif_context_set_maximum_image_size_limit(heif->ctx,
 			heif->unlimited ? USHRT_MAX : 0x4000);
+#ifdef HAVE_HEIF_MAX_TOTAL_MEMORY
+		if (!heif->unlimited)
+			heif_context_get_security_limits(heif->ctx)
+				->max_total_memory = 2UL * 1024 * 1024 * 1024;
+#endif /* HAVE_HEIF_MAX_TOTAL_MEMORY */
 #ifdef HAVE_HEIF_GET_DISABLED_SECURITY_LIMITS
 		if (heif->unlimited)
 			heif_context_set_security_limits(heif->ctx,
diff --git a/meson.build b/meson.build
@@ -500,6 +500,8 @@ if libheif_dep.found()
     cfg_var.set('HAVE_HEIF_ERROR_SUCCESS', libheif_dep.version().version_compare('>=1.17.0'))
     # heif_get_disabled_security_limits added in 1.19.0
     cfg_var.set('HAVE_HEIF_GET_DISABLED_SECURITY_LIMITS', cpp.has_function('heif_get_disabled_security_limits', prefix: '#include <libheif/heif.h>', dependencies: libheif_dep))
+    # heif_security_limits.max_total_memory added in 1.20.0
+    cfg_var.set('HAVE_HEIF_MAX_TOTAL_MEMORY', cpp.has_member('struct heif_security_limits', 'max_total_memory', prefix: '#include <libheif/heif.h>', dependencies: libheif_dep))
 endif
 
 # need v0.11+ for chunked write
