From bae45287ad2bc60c3fc009c039fc80c3458b4c24 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Daniel=20Novomesk=C3=BD?= <dnovomesky@gmail.com>
Date: Thu, 20 Aug 2026 19:20:10 +0200
Subject: [PATCH] heif: check crop values

---
 src/imageformats/heif.cpp | 25 +++++++++++++++++++++++--
 1 file changed, 23 insertions(+), 2 deletions(-)

diff --git a/src/imageformats/heif.cpp b/src/imageformats/heif.cpp
index 96ebeb4..973b07a 100644
--- a/src/imageformats/heif.cpp
+++ b/src/imageformats/heif.cpp
@@ -642,10 +642,31 @@ bool HEIFHandler::read_crop(void *heif_handle, const void *heif_ctx, const QSize
     if (heif_item_get_properties_of_type(ctx, item_id, heif_item_property_type_transform_crop, &crop_id, 1) > 0) {
         int l = 0, t = 0, r = 0, b = 0;
         heif_item_get_property_transform_crop_borders(ctx, item_id, crop_id, size.width(), size.height(), &l, &t, &r, &b);
-        crop = QRect(QPoint(t, l), size - QSize(b + t, r + l));
+
+        if (l >= size.width() || r >= size.width() || t >= size.height() || b >= size.height()) {
+            qCWarning(LOG_HEIFPLUGIN) << "Invalid crop values: left=" << l << "top=" << t << "right=" << r << "bottom=" << b;
+        }
+        if (l < 0) {
+            l = 0;
+        }
+        if (t < 0) {
+            t = 0;
+        }
+        if (r < 0) {
+            r = 0;
+        }
+        if (b < 0) {
+            b = 0;
+        }
+        if (l == 0 && t == 0 && r == 0 && b == 0) {
+            // no cropping needed
+            return false;
+        }
+        crop = QRect(QPoint(l, t), size - QSize(l + r, t + b));
+        return crop.isValid();
     }
 
-    return crop.isValid();
+    return false;
 }
 
 bool HEIFHandler::isSupportedBMFFType(const QByteArray &header)