From 465601b76c50e3775f69c1ca7c62b013a96536e4 Mon Sep 17 00:00:00 2001
From: s17sh70x2jfl031ag <287216888+s17sh70x2jfl031ag@users.noreply.github.com>
Date: Sun, 11 Oct 2026 12:46:22 -0700
Subject: [PATCH] HEIF: move the heic-rs pin from 0.1.1 to 0.1.4

heic-rs 0.1.2 to 0.1.4 fix six panics on malformed files, found by fuzzing:
four in release builds (a uuid box too small for its extended type, a
block starting right of the picture, a conformance window larger than the
picture, and a reference row below the picture) and two with overflow
checks on (a PCM bit depth above the sample bit depth, a slice QP out of
range). The API, MSRV and output are unchanged.

Mirrors the same change in PhotoCraft's photocraft-heif.
---
 Cargo.lock             | 4 ++--
 crates/heif/Cargo.toml | 4 ++--
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/Cargo.lock b/Cargo.lock
index 5f2609a5..6fff653b 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -2548,9 +2548,9 @@ checksum = "2304e00983f87ffb38b55b444b5e3b60a884b5d30c0fca7d82fe33449bbe55ea"
 
 [[package]]
 name = "heic-rs"
-version = "0.1.1"
+version = "0.1.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "adf9dde634bb6d5b718bacd01bef80192f2334306b2f785519a0136cca7b9618"
+checksum = "8883c3bfa6b4ff19a40e52a6dc051c5612cbe21bf408fc6d4875e8dfd777cb66"
 dependencies = [
  "rayon",
 ]
diff --git a/crates/heif/Cargo.toml b/crates/heif/Cargo.toml
index b3bc69d6..95641fb2 100644
--- a/crates/heif/Cargo.toml
+++ b/crates/heif/Cargo.toml
@@ -11,11 +11,11 @@ license.workspace = true
 # Mirrors PhotoCraft's photocraft-heif (same team, same decision): heic-rs was chosen over the
 # other permissive candidates (heif-oxide's HEVC decoder, rust_h265, follows FFmpeg's (LGPL)
 # code structure; gamut-heic has no HEVC decoder of its own).
-heic-rs = { version = "=0.1.1", default-features = false, features = ["std"] }
+heic-rs = { version = "=0.1.4", default-features = false, features = ["std"] }
 
 # The tiles of a HEIC photo decode in parallel on native; wasm stays single-threaded.
 [target.'cfg(not(target_arch = "wasm32"))'.dependencies]
-heic-rs = { version = "=0.1.1", default-features = false, features = ["std", "parallel"] }
+heic-rs = { version = "=0.1.4", default-features = false, features = ["std", "parallel"] }
 rayon = { workspace = true }
 
 [features]