================================================================= ==3818==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x52500001118f at pc 0x7fb9ee2fb303 bp 0x7fb9e835b980 sp 0x7fb9e835b128 WRITE of size 32 at 0x52500001118f thread T4 #0 0x7fb9ee2fb302 in memcpy ../../../../src/libsanitizer/sanitizer_common/sanitizer_common_interceptors_memintrinsics.inc:115 #1 0x7fb9edc47cd0 in HeifPixelImage::copy_image_to(std::shared_ptr const&, unsigned int, unsigned int) /root/.pruva/runs/cve-2026-32740_20260523-061427/external/libheif/libheif/pixelimage.cc:964 #2 0x7fb9eddebbd6 in ImageItem_Grid::decode_and_paste_tile_image(unsigned int, unsigned int, unsigned int, std::shared_ptr&, heif_decoding_options const&, int&, std::shared_ptr > >, std::set, std::allocator >) const /root/.pruva/runs/cve-2026-32740_20260523-061427/external/libheif/libheif/image-items/grid.cc:564 #3 0x7fb9ede0b484 in Error std::__invoke_impl&, heif_decoding_options const&, int&, std::shared_ptr > >, std::set, std::allocator >) const, ImageItem_Grid const*, unsigned int, unsigned int, unsigned int, std::reference_wrapper >, heif_decoding_options, std::reference_wrapper, std::shared_ptr > >, std::set, std::allocator > >(std::__invoke_memfun_deref, Error (ImageItem_Grid::*&&)(unsigned int, unsigned int, unsigned int, std::shared_ptr&, heif_decoding_options const&, int&, std::shared_ptr > >, std::set, std::allocator >) const, ImageItem_Grid const*&&, unsigned int&&, unsigned int&&, unsigned int&&, std::reference_wrapper >&&, heif_decoding_options&&, std::reference_wrapper&&, std::shared_ptr > >&&, std::set, std::allocator >&&) /usr/include/c++/13/bits/invoke.h:74 #4 0x7fb9ede0abca in std::__invoke_result&, heif_decoding_options const&, int&, std::shared_ptr > >, std::set, std::allocator >) const, ImageItem_Grid const*, unsigned int, unsigned int, unsigned int, std::reference_wrapper >, heif_decoding_options, std::reference_wrapper, std::shared_ptr > >, std::set, std::allocator > >::type std::__invoke&, heif_decoding_options const&, int&, std::shared_ptr > >, std::set, std::allocator >) const, ImageItem_Grid const*, unsigned int, unsigned int, unsigned int, std::reference_wrapper >, heif_decoding_options, std::reference_wrapper, std::shared_ptr > >, std::set, std::allocator > >(Error (ImageItem_Grid::*&&)(unsigned int, unsigned int, unsigned int, std::shared_ptr&, heif_decoding_options const&, int&, std::shared_ptr > >, std::set, std::allocator >) const, ImageItem_Grid const*&&, unsigned int&&, unsigned int&&, unsigned int&&, std::reference_wrapper >&&, heif_decoding_options&&, std::reference_wrapper&&, std::shared_ptr > >&&, std::set, std::allocator >&&) /usr/include/c++/13/bits/invoke.h:97 #5 0x7fb9ede0a71b in Error std::thread::_Invoker&, heif_decoding_options const&, int&, std::shared_ptr > >, std::set, std::allocator >) const, ImageItem_Grid const*, unsigned int, unsigned int, unsigned int, std::reference_wrapper >, heif_decoding_options, std::reference_wrapper, std::shared_ptr > >, std::set, std::allocator > > >::_M_invoke<0ul, 1ul, 2ul, 3ul, 4ul, 5ul, 6ul, 7ul, 8ul, 9ul>(std::_Index_tuple<0ul, 1ul, 2ul, 3ul, 4ul, 5ul, 6ul, 7ul, 8ul, 9ul>) /usr/include/c++/13/bits/std_thread.h:292 #6 0x7fb9ede0a1a3 in std::thread::_Invoker&, heif_decoding_options const&, int&, std::shared_ptr > >, std::set, std::allocator >) const, ImageItem_Grid const*, unsigned int, unsigned int, unsigned int, std::reference_wrapper >, heif_decoding_options, std::reference_wrapper, std::shared_ptr > >, std::set, std::allocator > > >::operator()() /usr/include/c++/13/bits/std_thread.h:299 #7 0x7fb9ede09b16 in std::__future_base::_Task_setter, std::__future_base::_Result_base::_Deleter>, std::thread::_Invoker&, heif_decoding_options const&, int&, std::shared_ptr > >, std::set, std::allocator >) const, ImageItem_Grid const*, unsigned int, unsigned int, unsigned int, std::reference_wrapper >, heif_decoding_options, std::reference_wrapper, std::shared_ptr > >, std::set, std::allocator > > >, Error>::operator()() const /usr/include/c++/13/future:1409 #8 0x7fb9ede09643 in std::unique_ptr, std::__future_base::_Result_base::_Deleter> std::__invoke_impl, std::__future_base::_Result_base::_Deleter>, std::__future_base::_Task_setter, std::__future_base::_Result_base::_Deleter>, std::thread::_Invoker&, heif_decoding_options const&, int&, std::shared_ptr > >, std::set, std::allocator >) const, ImageItem_Grid const*, unsigned int, unsigned int, unsigned int, std::reference_wrapper >, heif_decoding_options, std::reference_wrapper, std::shared_ptr > >, std::set, std::allocator > > >, Error>&>(std::__invoke_other, std::__future_base::_Task_setter, std::__future_base::_Result_base::_Deleter>, std::thread::_Invoker&, heif_decoding_options const&, int&, std::shared_ptr > >, std::set, std::allocator >) const, ImageItem_Grid const*, unsigned int, unsigned int, unsigned int, std::reference_wrapper >, heif_decoding_options, std::reference_wrapper, std::shared_ptr > >, std::set, std::allocator > > >, Error>&) /usr/include/c++/13/bits/invoke.h:61 #9 0x7fb9ede090e1 in std::enable_if, std::__future_base::_Task_setter, std::__future_base::_Result_base::_Deleter>, std::thread::_Invoker&, heif_decoding_options const&, int&, std::shared_ptr > >, std::set, std::allocator >) const, ImageItem_Grid const*, unsigned int, unsigned int, unsigned int, std::reference_wrapper >, heif_decoding_options, std::reference_wrapper, std::shared_ptr > >, std::set, std::allocator > > >, Error>&>, std::unique_ptr >::type std::__invoke_r, std::__future_base::_Task_setter, std::__future_base::_Result_base::_Deleter>, std::thread::_Invoker&, heif_decoding_options const&, int&, std::shared_ptr > >, std::set, std::allocator >) const, ImageItem_Grid const*, unsigned int, unsigned int, unsigned int, std::reference_wrapper >, heif_decoding_options, std::reference_wrapper, std::shared_ptr > >, std::set, std::allocator > > >, Error>&>(std::__future_base::_Task_setter, std::__future_base::_Result_base::_Deleter>, std::thread::_Invoker&, heif_decoding_options const&, int&, std::shared_ptr > >, std::set, std::allocator >) const, ImageItem_Grid const*, unsigned int, unsigned int, unsigned int, std::reference_wrapper >, heif_decoding_options, std::reference_wrapper, std::shared_ptr > >, std::set, std::allocator > > >, Error>&) /usr/include/c++/13/bits/invoke.h:116 #10 0x7fb9ede08adf in std::_Function_handler (), std::__future_base::_Task_setter, std::__future_base::_Result_base::_Deleter>, std::thread::_Invoker&, heif_decoding_options const&, int&, std::shared_ptr > >, std::set, std::allocator >) const, ImageItem_Grid const*, unsigned int, unsigned int, unsigned int, std::reference_wrapper >, heif_decoding_options, std::reference_wrapper, std::shared_ptr > >, std::set, std::allocator > > >, Error> >::_M_invoke(std::_Any_data const&) /usr/include/c++/13/bits/std_function.h:291 #11 0x7fb9eddf9e95 in std::function ()>::operator()() const (/root/.pruva/runs/cve-2026-32740_20260523-061427/external/libheif/build_vuln/libheif/libheif.so.1+0x3f9e95) (BuildId: e08de893b3bc9e22f6c02a74dd91d0537524df3b) #12 0x7fb9eddf8e33 in std::__future_base::_State_baseV2::_M_do_set(std::function ()>*, bool*) /usr/include/c++/13/future:589 #13 0x7fb9eddff31c in void std::__invoke_impl ()>*, bool*), std::__future_base::_State_baseV2*, std::function ()>*, bool*>(std::__invoke_memfun_deref, void (std::__future_base::_State_baseV2::*&&)(std::function ()>*, bool*), std::__future_base::_State_baseV2*&&, std::function ()>*&&, bool*&&) /usr/include/c++/13/bits/invoke.h:74 #14 0x7fb9eddfc154 in std::__invoke_result ()>*, bool*), std::__future_base::_State_baseV2*, std::function ()>*, bool*>::type std::__invoke ()>*, bool*), std::__future_base::_State_baseV2*, std::function ()>*, bool*>(void (std::__future_base::_State_baseV2::*&&)(std::function ()>*, bool*), std::__future_base::_State_baseV2*&&, std::function ()>*&&, bool*&&) /usr/include/c++/13/bits/invoke.h:96 #15 0x7fb9eddf99ab in std::call_once ()>*, bool*), std::__future_base::_State_baseV2*, std::function ()>*, bool*>(std::once_flag&, void (std::__future_base::_State_baseV2::*&&)(std::function ()>*, bool*), std::__future_base::_State_baseV2*&&, std::function ()>*&&, bool*&&)::{lambda()#1}::operator()() const (/root/.pruva/runs/cve-2026-32740_20260523-061427/external/libheif/build_vuln/libheif/libheif.so.1+0x3f99ab) (BuildId: e08de893b3bc9e22f6c02a74dd91d0537524df3b) #16 0x7fb9eddfc18c in std::once_flag::_Prepare_execution::_Prepare_execution ()>*, bool*), std::__future_base::_State_baseV2*, std::function ()>*, bool*>(std::once_flag&, void (std::__future_base::_State_baseV2::*&&)(std::function ()>*, bool*), std::__future_base::_State_baseV2*&&, std::function ()>*&&, bool*&&)::{lambda()#1}>(void (std::__future_base::_State_baseV2::*&)(std::function ()>*, bool*))::{lambda()#1}::operator()() const /usr/include/c++/13/mutex:836 #17 0x7fb9eddfc1a1 in std::once_flag::_Prepare_execution::_Prepare_execution ()>*, bool*), std::__future_base::_State_baseV2*, std::function ()>*, bool*>(std::once_flag&, void (std::__future_base::_State_baseV2::*&&)(std::function ()>*, bool*), std::__future_base::_State_baseV2*&&, std::function ()>*&&, bool*&&)::{lambda()#1}>(void (std::__future_base::_State_baseV2::*&)(std::function ()>*, bool*))::{lambda()#1}::_FUN() /usr/include/c++/13/mutex:836 #18 0x7fb9ed6a1ed2 in __pthread_once_slow nptl/pthread_once.c:116 #19 0x7fb9edde4975 in __gthread_once /usr/include/x86_64-linux-gnu/c++/13/bits/gthr-default.h:700 #20 0x7fb9eddf9b62 in void std::call_once ()>*, bool*), std::__future_base::_State_baseV2*, std::function ()>*, bool*>(std::once_flag&, void (std::__future_base::_State_baseV2::*&&)(std::function ()>*, bool*), std::__future_base::_State_baseV2*&&, std::function ()>*&&, bool*&&) (/root/.pruva/runs/cve-2026-32740_20260523-061427/external/libheif/build_vuln/libheif/libheif.so.1+0x3f9b62) (BuildId: e08de893b3bc9e22f6c02a74dd91d0537524df3b) #21 0x7fb9eddf881c in std::__future_base::_State_baseV2::_M_set_result(std::function ()>, bool) /usr/include/c++/13/future:428 #22 0x7fb9ede07ace in std::__future_base::_Async_state_impl&, heif_decoding_options const&, int&, std::shared_ptr > >, std::set, std::allocator >) const, ImageItem_Grid const*, unsigned int, unsigned int, unsigned int, std::reference_wrapper >, heif_decoding_options, std::reference_wrapper, std::shared_ptr > >, std::set, std::allocator > > >, Error>::_M_run() /usr/include/c++/13/future:1774 #23 0x7fb9ede0c9ee in void std::__invoke_impl&, heif_decoding_options const&, int&, std::shared_ptr > >, std::set, std::allocator >) const, ImageItem_Grid const*, unsigned int, unsigned int, unsigned int, std::reference_wrapper >, heif_decoding_options, std::reference_wrapper, std::shared_ptr > >, std::set, std::allocator > > >, Error>::*)(), std::__future_base::_Async_state_impl&, heif_decoding_options const&, int&, std::shared_ptr > >, std::set, std::allocator >) const, ImageItem_Grid const*, unsigned int, unsigned int, unsigned int, std::reference_wrapper >, heif_decoding_options, std::reference_wrapper, std::shared_ptr > >, std::set, std::allocator > > >, Error>*>(std::__invoke_memfun_deref, void (std::__future_base::_Async_state_impl&, heif_decoding_options const&, int&, std::shared_ptr > >, std::set, std::allocator >) const, ImageItem_Grid const*, unsigned int, unsigned int, unsigned int, std::reference_wrapper >, heif_decoding_options, std::reference_wrapper, std::shared_ptr > >, std::set, std::allocator > > >, Error>::*&&)(), std::__future_base::_Async_state_impl&, heif_decoding_options const&, int&, std::shared_ptr > >, std::set, std::allocator >) const, ImageItem_Grid const*, unsigned int, unsigned int, unsigned int, std::reference_wrapper >, heif_decoding_options, std::reference_wrapper, std::shared_ptr > >, std::set, std::allocator > > >, Error>*&&) /usr/include/c++/13/bits/invoke.h:74 #24 0x7fb9ede0c810 in std::__invoke_result&, heif_decoding_options const&, int&, std::shared_ptr > >, std::set, std::allocator >) const, ImageItem_Grid const*, unsigned int, unsigned int, unsigned int, std::reference_wrapper >, heif_decoding_options, std::reference_wrapper, std::shared_ptr > >, std::set, std::allocator > > >, Error>::*)(), std::__future_base::_Async_state_impl&, heif_decoding_options const&, int&, std::shared_ptr > >, std::set, std::allocator >) const, ImageItem_Grid const*, unsigned int, unsigned int, unsigned int, std::reference_wrapper >, heif_decoding_options, std::reference_wrapper, std::shared_ptr > >, std::set, std::allocator > > >, Error>*>::type std::__invoke&, heif_decoding_options const&, int&, std::shared_ptr > >, std::set, std::allocator >) const, ImageItem_Grid const*, unsigned int, unsigned int, unsigned int, std::reference_wrapper >, heif_decoding_options, std::reference_wrapper, std::shared_ptr > >, std::set, std::allocator > > >, Error>::*)(), std::__future_base::_Async_state_impl&, heif_decoding_options const&, int&, std::shared_ptr > >, std::set, std::allocator >) const, ImageItem_Grid const*, unsigned int, unsigned int, unsigned int, std::reference_wrapper >, heif_decoding_options, std::reference_wrapper, std::shared_ptr > >, std::set, std::allocator > > >, Error>*>(void (std::__future_base::_Async_state_impl&, heif_decoding_options const&, int&, std::shared_ptr > >, std::set, std::allocator >) const, ImageItem_Grid const*, unsigned int, unsigned int, unsigned int, std::reference_wrapper >, heif_decoding_options, std::reference_wrapper, std::shared_ptr > >, std::set, std::allocator > > >, Error>::*&&)(), std::__future_base::_Async_state_impl&, heif_decoding_options const&, int&, std::shared_ptr > >, std::set, std::allocator >) const, ImageItem_Grid const*, unsigned int, unsigned int, unsigned int, std::reference_wrapper >, heif_decoding_options, std::reference_wrapper, std::shared_ptr > >, std::set, std::allocator > > >, Error>*&&) /usr/include/c++/13/bits/invoke.h:96 #25 0x7fb9ede0c732 in void std::thread::_Invoker&, heif_decoding_options const&, int&, std::shared_ptr > >, std::set, std::allocator >) const, ImageItem_Grid const*, unsigned int, unsigned int, unsigned int, std::reference_wrapper >, heif_decoding_options, std::reference_wrapper, std::shared_ptr > >, std::set, std::allocator > > >, Error>::*)(), std::__future_base::_Async_state_impl&, heif_decoding_options const&, int&, std::shared_ptr > >, std::set, std::allocator >) const, ImageItem_Grid const*, unsigned int, unsigned int, unsigned int, std::reference_wrapper >, heif_decoding_options, std::reference_wrapper, std::shared_ptr > >, std::set, std::allocator > > >, Error>*> >::_M_invoke<0ul, 1ul>(std::_Index_tuple<0ul, 1ul>) /usr/include/c++/13/bits/std_thread.h:292 #26 0x7fb9ede0c6ab in std::thread::_Invoker&, heif_decoding_options const&, int&, std::shared_ptr > >, std::set, std::allocator >) const, ImageItem_Grid const*, unsigned int, unsigned int, unsigned int, std::reference_wrapper >, heif_decoding_options, std::reference_wrapper, std::shared_ptr > >, std::set, std::allocator > > >, Error>::*)(), std::__future_base::_Async_state_impl&, heif_decoding_options const&, int&, std::shared_ptr > >, std::set, std::allocator >) const, ImageItem_Grid const*, unsigned int, unsigned int, unsigned int, std::reference_wrapper >, heif_decoding_options, std::reference_wrapper, std::shared_ptr > >, std::set, std::allocator > > >, Error>*> >::operator()() /usr/include/c++/13/bits/std_thread.h:299 #27 0x7fb9ede0bcb1 in std::thread::_State_impl&, heif_decoding_options const&, int&, std::shared_ptr > >, std::set, std::allocator >) const, ImageItem_Grid const*, unsigned int, unsigned int, unsigned int, std::reference_wrapper >, heif_decoding_options, std::reference_wrapper, std::shared_ptr > >, std::set, std::allocator > > >, Error>::*)(), std::__future_base::_Async_state_impl&, heif_decoding_options const&, int&, std::shared_ptr > >, std::set, std::allocator >) const, ImageItem_Grid const*, unsigned int, unsigned int, unsigned int, std::reference_wrapper >, heif_decoding_options, std::reference_wrapper, std::shared_ptr > >, std::set, std::allocator > > >, Error>*> > >::_M_run() /usr/include/c++/13/bits/std_thread.h:244 #28 0x7fb9ed2ecdb3 (/lib/x86_64-linux-gnu/libstdc++.so.6+0xecdb3) (BuildId: 753c6c8608b61d4e67be8f0c890e03e0aa046b8b) #29 0x7fb9ee25ea41 in asan_thread_start ../../../../src/libsanitizer/asan/asan_interceptors.cpp:234 #30 0x7fb9ed69caa3 in start_thread nptl/pthread_create.c:447 #31 0x7fb9ed729c6b in clone3 ../sysdeps/unix/sysv/linux/x86_64/clone3.S:78 0x52500001118f is located 0 bytes after 8335-byte region [0x52500000f100,0x52500001118f) allocated by thread T4 here: #0 0x7fb9ee2fe990 in operator new[](unsigned long, std::nothrow_t const&) ../../../../src/libsanitizer/asan/asan_new_delete.cpp:104 #1 0x7fb9edc41bed in HeifPixelImage::ImagePlane::alloc(unsigned int, unsigned int, heif_channel_datatype, int, int, heif_security_limits const*, MemoryHandle&) /root/.pruva/runs/cve-2026-32740_20260523-061427/external/libheif/libheif/pixelimage.cc:440 #2 0x7fb9edc40961 in HeifPixelImage::add_plane(heif_channel, unsigned int, unsigned int, int, heif_security_limits const*) /root/.pruva/runs/cve-2026-32740_20260523-061427/external/libheif/libheif/pixelimage.cc:357 #3 0x7fb9edc50a90 in HeifPixelImage::create_clone_image_at_new_size(std::shared_ptr const&, unsigned int, unsigned int, heif_security_limits const*) /root/.pruva/runs/cve-2026-32740_20260523-061427/external/libheif/libheif/pixelimage.cc:1786 #4 0x7fb9eddeb768 in ImageItem_Grid::decode_and_paste_tile_image(unsigned int, unsigned int, unsigned int, std::shared_ptr&, heif_decoding_options const&, int&, std::shared_ptr > >, std::set, std::allocator >) const /root/.pruva/runs/cve-2026-32740_20260523-061427/external/libheif/libheif/image-items/grid.cc:532 #5 0x7fb9ede0b484 in Error std::__invoke_impl&, heif_decoding_options const&, int&, std::shared_ptr > >, std::set, std::allocator >) const, ImageItem_Grid const*, unsigned int, unsigned int, unsigned int, std::reference_wrapper >, heif_decoding_options, std::reference_wrapper, std::shared_ptr > >, std::set, std::allocator > >(std::__invoke_memfun_deref, Error (ImageItem_Grid::*&&)(unsigned int, unsigned int, unsigned int, std::shared_ptr&, heif_decoding_options const&, int&, std::shared_ptr > >, std::set, std::allocator >) const, ImageItem_Grid const*&&, unsigned int&&, unsigned int&&, unsigned int&&, std::reference_wrapper >&&, heif_decoding_options&&, std::reference_wrapper&&, std::shared_ptr > >&&, std::set, std::allocator >&&) /usr/include/c++/13/bits/invoke.h:74 #6 0x7fb9ede0abca in std::__invoke_result&, heif_decoding_options const&, int&, std::shared_ptr > >, std::set, std::allocator >) const, ImageItem_Grid const*, unsigned int, unsigned int, unsigned int, std::reference_wrapper >, heif_decoding_options, std::reference_wrapper, std::shared_ptr > >, std::set, std::allocator > >::type std::__invoke&, heif_decoding_options const&, int&, std::shared_ptr > >, std::set, std::allocator >) const, ImageItem_Grid const*, unsigned int, unsigned int, unsigned int, std::reference_wrapper >, heif_decoding_options, std::reference_wrapper, std::shared_ptr > >, std::set, std::allocator > >(Error (ImageItem_Grid::*&&)(unsigned int, unsigned int, unsigned int, std::shared_ptr&, heif_decoding_options const&, int&, std::shared_ptr > >, std::set, std::allocator >) const, ImageItem_Grid const*&&, unsigned int&&, unsigned int&&, unsigned int&&, std::reference_wrapper >&&, heif_decoding_options&&, std::reference_wrapper&&, std::shared_ptr > >&&, std::set, std::allocator >&&) /usr/include/c++/13/bits/invoke.h:97 #7 0x7fb9ede0a71b in Error std::thread::_Invoker&, heif_decoding_options const&, int&, std::shared_ptr > >, std::set, std::allocator >) const, ImageItem_Grid const*, unsigned int, unsigned int, unsigned int, std::reference_wrapper >, heif_decoding_options, std::reference_wrapper, std::shared_ptr > >, std::set, std::allocator > > >::_M_invoke<0ul, 1ul, 2ul, 3ul, 4ul, 5ul, 6ul, 7ul, 8ul, 9ul>(std::_Index_tuple<0ul, 1ul, 2ul, 3ul, 4ul, 5ul, 6ul, 7ul, 8ul, 9ul>) /usr/include/c++/13/bits/std_thread.h:292 #8 0x7fb9ede0a1a3 in std::thread::_Invoker&, heif_decoding_options const&, int&, std::shared_ptr > >, std::set, std::allocator >) const, ImageItem_Grid const*, unsigned int, unsigned int, unsigned int, std::reference_wrapper >, heif_decoding_options, std::reference_wrapper, std::shared_ptr > >, std::set, std::allocator > > >::operator()() /usr/include/c++/13/bits/std_thread.h:299 #9 0x7fb9ede09b16 in std::__future_base::_Task_setter, std::__future_base::_Result_base::_Deleter>, std::thread::_Invoker&, heif_decoding_options const&, int&, std::shared_ptr > >, std::set, std::allocator >) const, ImageItem_Grid const*, unsigned int, unsigned int, unsigned int, std::reference_wrapper >, heif_decoding_options, std::reference_wrapper, std::shared_ptr > >, std::set, std::allocator > > >, Error>::operator()() const /usr/include/c++/13/future:1409 #10 0x7fb9ede09643 in std::unique_ptr, std::__future_base::_Result_base::_Deleter> std::__invoke_impl, std::__future_base::_Result_base::_Deleter>, std::__future_base::_Task_setter, std::__future_base::_Result_base::_Deleter>, std::thread::_Invoker&, heif_decoding_options const&, int&, std::shared_ptr > >, std::set, std::allocator >) const, ImageItem_Grid const*, unsigned int, unsigned int, unsigned int, std::reference_wrapper >, heif_decoding_options, std::reference_wrapper, std::shared_ptr > >, std::set, std::allocator > > >, Error>&>(std::__invoke_other, std::__future_base::_Task_setter, std::__future_base::_Result_base::_Deleter>, std::thread::_Invoker&, heif_decoding_options const&, int&, std::shared_ptr > >, std::set, std::allocator >) const, ImageItem_Grid const*, unsigned int, unsigned int, unsigned int, std::reference_wrapper >, heif_decoding_options, std::reference_wrapper, std::shared_ptr > >, std::set, std::allocator > > >, Error>&) /usr/include/c++/13/bits/invoke.h:61 #11 0x7fb9ede090e1 in std::enable_if, std::__future_base::_Task_setter, std::__future_base::_Result_base::_Deleter>, std::thread::_Invoker&, heif_decoding_options const&, int&, std::shared_ptr > >, std::set, std::allocator >) const, ImageItem_Grid const*, unsigned int, unsigned int, unsigned int, std::reference_wrapper >, heif_decoding_options, std::reference_wrapper, std::shared_ptr > >, std::set, std::allocator > > >, Error>&>, std::unique_ptr >::type std::__invoke_r, std::__future_base::_Task_setter, std::__future_base::_Result_base::_Deleter>, std::thread::_Invoker&, heif_decoding_options const&, int&, std::shared_ptr > >, std::set, std::allocator >) const, ImageItem_Grid const*, unsigned int, unsigned int, unsigned int, std::reference_wrapper >, heif_decoding_options, std::reference_wrapper, std::shared_ptr > >, std::set, std::allocator > > >, Error>&>(std::__future_base::_Task_setter, std::__future_base::_Result_base::_Deleter>, std::thread::_Invoker&, heif_decoding_options const&, int&, std::shared_ptr > >, std::set, std::allocator >) const, ImageItem_Grid const*, unsigned int, unsigned int, unsigned int, std::reference_wrapper >, heif_decoding_options, std::reference_wrapper, std::shared_ptr > >, std::set, std::allocator > > >, Error>&) /usr/include/c++/13/bits/invoke.h:116 #12 0x7fb9ede08adf in std::_Function_handler (), std::__future_base::_Task_setter, std::__future_base::_Result_base::_Deleter>, std::thread::_Invoker&, heif_decoding_options const&, int&, std::shared_ptr > >, std::set, std::allocator >) const, ImageItem_Grid const*, unsigned int, unsigned int, unsigned int, std::reference_wrapper >, heif_decoding_options, std::reference_wrapper, std::shared_ptr > >, std::set, std::allocator > > >, Error> >::_M_invoke(std::_Any_data const&) /usr/include/c++/13/bits/std_function.h:291 #13 0x7fb9eddf9e95 in std::function ()>::operator()() const (/root/.pruva/runs/cve-2026-32740_20260523-061427/external/libheif/build_vuln/libheif/libheif.so.1+0x3f9e95) (BuildId: e08de893b3bc9e22f6c02a74dd91d0537524df3b) #14 0x7fb9eddf8e33 in std::__future_base::_State_baseV2::_M_do_set(std::function ()>*, bool*) /usr/include/c++/13/future:589 #15 0x7fb9eddff31c in void std::__invoke_impl ()>*, bool*), std::__future_base::_State_baseV2*, std::function ()>*, bool*>(std::__invoke_memfun_deref, void (std::__future_base::_State_baseV2::*&&)(std::function ()>*, bool*), std::__future_base::_State_baseV2*&&, std::function ()>*&&, bool*&&) /usr/include/c++/13/bits/invoke.h:74 #16 0x7fb9eddfc154 in std::__invoke_result ()>*, bool*), std::__future_base::_State_baseV2*, std::function ()>*, bool*>::type std::__invoke ()>*, bool*), std::__future_base::_State_baseV2*, std::function ()>*, bool*>(void (std::__future_base::_State_baseV2::*&&)(std::function ()>*, bool*), std::__future_base::_State_baseV2*&&, std::function ()>*&&, bool*&&) /usr/include/c++/13/bits/invoke.h:96 #17 0x7fb9eddf99ab in std::call_once ()>*, bool*), std::__future_base::_State_baseV2*, std::function ()>*, bool*>(std::once_flag&, void (std::__future_base::_State_baseV2::*&&)(std::function ()>*, bool*), std::__future_base::_State_baseV2*&&, std::function ()>*&&, bool*&&)::{lambda()#1}::operator()() const (/root/.pruva/runs/cve-2026-32740_20260523-061427/external/libheif/build_vuln/libheif/libheif.so.1+0x3f99ab) (BuildId: e08de893b3bc9e22f6c02a74dd91d0537524df3b) #18 0x7fb9eddfc18c in std::once_flag::_Prepare_execution::_Prepare_execution ()>*, bool*), std::__future_base::_State_baseV2*, std::function ()>*, bool*>(std::once_flag&, void (std::__future_base::_State_baseV2::*&&)(std::function ()>*, bool*), std::__future_base::_State_baseV2*&&, std::function ()>*&&, bool*&&)::{lambda()#1}>(void (std::__future_base::_State_baseV2::*&)(std::function ()>*, bool*))::{lambda()#1}::operator()() const /usr/include/c++/13/mutex:836 #19 0x7fb9eddfc1a1 in std::once_flag::_Prepare_execution::_Prepare_execution ()>*, bool*), std::__future_base::_State_baseV2*, std::function ()>*, bool*>(std::once_flag&, void (std::__future_base::_State_baseV2::*&&)(std::function ()>*, bool*), std::__future_base::_State_baseV2*&&, std::function ()>*&&, bool*&&)::{lambda()#1}>(void (std::__future_base::_State_baseV2::*&)(std::function ()>*, bool*))::{lambda()#1}::_FUN() /usr/include/c++/13/mutex:836 #20 0x7fb9ed6a1ed2 in __pthread_once_slow nptl/pthread_once.c:116 #21 0x7fb9edde4975 in __gthread_once /usr/include/x86_64-linux-gnu/c++/13/bits/gthr-default.h:700 #22 0x7fb9eddf9b62 in void std::call_once ()>*, bool*), std::__future_base::_State_baseV2*, std::function ()>*, bool*>(std::once_flag&, void (std::__future_base::_State_baseV2::*&&)(std::function ()>*, bool*), std::__future_base::_State_baseV2*&&, std::function ()>*&&, bool*&&) (/root/.pruva/runs/cve-2026-32740_20260523-061427/external/libheif/build_vuln/libheif/libheif.so.1+0x3f9b62) (BuildId: e08de893b3bc9e22f6c02a74dd91d0537524df3b) #23 0x7fb9eddf881c in std::__future_base::_State_baseV2::_M_set_result(std::function ()>, bool) /usr/include/c++/13/future:428 #24 0x7fb9ede07ace in std::__future_base::_Async_state_impl&, heif_decoding_options const&, int&, std::shared_ptr > >, std::set, std::allocator >) const, ImageItem_Grid const*, unsigned int, unsigned int, unsigned int, std::reference_wrapper >, heif_decoding_options, std::reference_wrapper, std::shared_ptr > >, std::set, std::allocator > > >, Error>::_M_run() /usr/include/c++/13/future:1774 #25 0x7fb9ede0c9ee in void std::__invoke_impl&, heif_decoding_options const&, int&, std::shared_ptr > >, std::set, std::allocator >) const, ImageItem_Grid const*, unsigned int, unsigned int, unsigned int, std::reference_wrapper >, heif_decoding_options, std::reference_wrapper, std::shared_ptr > >, std::set, std::allocator > > >, Error>::*)(), std::__future_base::_Async_state_impl&, heif_decoding_options const&, int&, std::shared_ptr > >, std::set, std::allocator >) const, ImageItem_Grid const*, unsigned int, unsigned int, unsigned int, std::reference_wrapper >, heif_decoding_options, std::reference_wrapper, std::shared_ptr > >, std::set, std::allocator > > >, Error>*>(std::__invoke_memfun_deref, void (std::__future_base::_Async_state_impl&, heif_decoding_options const&, int&, std::shared_ptr > >, std::set, std::allocator >) const, ImageItem_Grid const*, unsigned int, unsigned int, unsigned int, std::reference_wrapper >, heif_decoding_options, std::reference_wrapper, std::shared_ptr > >, std::set, std::allocator > > >, Error>::*&&)(), std::__future_base::_Async_state_impl&, heif_decoding_options const&, int&, std::shared_ptr > >, std::set, std::allocator >) const, ImageItem_Grid const*, unsigned int, unsigned int, unsigned int, std::reference_wrapper >, heif_decoding_options, std::reference_wrapper, std::shared_ptr > >, std::set, std::allocator > > >, Error>*&&) /usr/include/c++/13/bits/invoke.h:74 #26 0x7fb9ede0c810 in std::__invoke_result&, heif_decoding_options const&, int&, std::shared_ptr > >, std::set, std::allocator >) const, ImageItem_Grid const*, unsigned int, unsigned int, unsigned int, std::reference_wrapper >, heif_decoding_options, std::reference_wrapper, std::shared_ptr > >, std::set, std::allocator > > >, Error>::*)(), std::__future_base::_Async_state_impl&, heif_decoding_options const&, int&, std::shared_ptr > >, std::set, std::allocator >) const, ImageItem_Grid const*, unsigned int, unsigned int, unsigned int, std::reference_wrapper >, heif_decoding_options, std::reference_wrapper, std::shared_ptr > >, std::set, std::allocator > > >, Error>*>::type std::__invoke&, heif_decoding_options const&, int&, std::shared_ptr > >, std::set, std::allocator >) const, ImageItem_Grid const*, unsigned int, unsigned int, unsigned int, std::reference_wrapper >, heif_decoding_options, std::reference_wrapper, std::shared_ptr > >, std::set, std::allocator > > >, Error>::*)(), std::__future_base::_Async_state_impl&, heif_decoding_options const&, int&, std::shared_ptr > >, std::set, std::allocator >) const, ImageItem_Grid const*, unsigned int, unsigned int, unsigned int, std::reference_wrapper >, heif_decoding_options, std::reference_wrapper, std::shared_ptr > >, std::set, std::allocator > > >, Error>*>(void (std::__future_base::_Async_state_impl&, heif_decoding_options const&, int&, std::shared_ptr > >, std::set, std::allocator >) const, ImageItem_Grid const*, unsigned int, unsigned int, unsigned int, std::reference_wrapper >, heif_decoding_options, std::reference_wrapper, std::shared_ptr > >, std::set, std::allocator > > >, Error>::*&&)(), std::__future_base::_Async_state_impl&, heif_decoding_options const&, int&, std::shared_ptr > >, std::set, std::allocator >) const, ImageItem_Grid const*, unsigned int, unsigned int, unsigned int, std::reference_wrapper >, heif_decoding_options, std::reference_wrapper, std::shared_ptr > >, std::set, std::allocator > > >, Error>*&&) /usr/include/c++/13/bits/invoke.h:96 #27 0x7fb9ede0c732 in void std::thread::_Invoker&, heif_decoding_options const&, int&, std::shared_ptr > >, std::set, std::allocator >) const, ImageItem_Grid const*, unsigned int, unsigned int, unsigned int, std::reference_wrapper >, heif_decoding_options, std::reference_wrapper, std::shared_ptr > >, std::set, std::allocator > > >, Error>::*)(), std::__future_base::_Async_state_impl&, heif_decoding_options const&, int&, std::shared_ptr > >, std::set, std::allocator >) const, ImageItem_Grid const*, unsigned int, unsigned int, unsigned int, std::reference_wrapper >, heif_decoding_options, std::reference_wrapper, std::shared_ptr > >, std::set, std::allocator > > >, Error>*> >::_M_invoke<0ul, 1ul>(std::_Index_tuple<0ul, 1ul>) /usr/include/c++/13/bits/std_thread.h:292 #28 0x7fb9ede0c6ab in std::thread::_Invoker&, heif_decoding_options const&, int&, std::shared_ptr > >, std::set, std::allocator >) const, ImageItem_Grid const*, unsigned int, unsigned int, unsigned int, std::reference_wrapper >, heif_decoding_options, std::reference_wrapper, std::shared_ptr > >, std::set, std::allocator > > >, Error>::*)(), std::__future_base::_Async_state_impl&, heif_decoding_options const&, int&, std::shared_ptr > >, std::set, std::allocator >) const, ImageItem_Grid const*, unsigned int, unsigned int, unsigned int, std::reference_wrapper >, heif_decoding_options, std::reference_wrapper, std::shared_ptr > >, std::set, std::allocator > > >, Error>*> >::operator()() /usr/include/c++/13/bits/std_thread.h:299 #29 0x7fb9ede0bcb1 in std::thread::_State_impl&, heif_decoding_options const&, int&, std::shared_ptr > >, std::set, std::allocator >) const, ImageItem_Grid const*, unsigned int, unsigned int, unsigned int, std::reference_wrapper >, heif_decoding_options, std::reference_wrapper, std::shared_ptr > >, std::set, std::allocator > > >, Error>::*)(), std::__future_base::_Async_state_impl&, heif_decoding_options const&, int&, std::shared_ptr > >, std::set, std::allocator >) const, ImageItem_Grid const*, unsigned int, unsigned int, unsigned int, std::reference_wrapper >, heif_decoding_options, std::reference_wrapper, std::shared_ptr > >, std::set, std::allocator > > >, Error>*> > >::_M_run() /usr/include/c++/13/bits/std_thread.h:244 Thread T4 created by T0 here: #0 0x7fb9ee2f51f9 in pthread_create ../../../../src/libsanitizer/asan/asan_interceptors.cpp:245 #1 0x7fb9ed2eceb0 in std::thread::_M_start_thread(std::unique_ptr >, void (*)()) (/lib/x86_64-linux-gnu/libstdc++.so.6+0xeceb0) (BuildId: 753c6c8608b61d4e67be8f0c890e03e0aa046b8b) #2 0x7fb9ede07e0d in std::thread::thread&, heif_decoding_options const&, int&, std::shared_ptr > >, std::set, std::allocator >) const, ImageItem_Grid const*, unsigned int, unsigned int, unsigned int, std::reference_wrapper >, heif_decoding_options, std::reference_wrapper, std::shared_ptr > >, std::set, std::allocator > > >, Error>::*)(), std::__future_base::_Async_state_impl&, heif_decoding_options const&, int&, std::shared_ptr > >, std::set, std::allocator >) const, ImageItem_Grid const*, unsigned int, unsigned int, unsigned int, std::reference_wrapper >, heif_decoding_options, std::reference_wrapper, std::shared_ptr > >, std::set, std::allocator > > >, Error>*, void>(void (std::__future_base::_Async_state_impl&, heif_decoding_options const&, int&, std::shared_ptr > >, std::set, std::allocator >) const, ImageItem_Grid const*, unsigned int, unsigned int, unsigned int, std::reference_wrapper >, heif_decoding_options, std::reference_wrapper, std::shared_ptr > >, std::set, std::allocator > > >, Error>::*&&)(), std::__future_base::_Async_state_impl&, heif_decoding_options const&, int&, std::shared_ptr > >, std::set, std::allocator >) const, ImageItem_Grid const*, unsigned int, unsigned int, unsigned int, std::reference_wrapper >, heif_decoding_options, std::reference_wrapper, std::shared_ptr > >, std::set, std::allocator > > >, Error>*&&) /usr/include/c++/13/bits/std_thread.h:164 #3 0x7fb9ede07060 in std::__future_base::_Async_state_impl&, heif_decoding_options const&, int&, std::shared_ptr > >, std::set, std::allocator >) const, ImageItem_Grid const*, unsigned int, unsigned int, unsigned int, std::reference_wrapper >, heif_decoding_options, std::reference_wrapper, std::shared_ptr > >, std::set, std::allocator > > >, Error>::_Async_state_impl&, heif_decoding_options const&, int&, std::shared_ptr > >, std::set, std::allocator >) const, ImageItem_Grid const*, unsigned int&, unsigned int&, unsigned int&, std::reference_wrapper >, heif_decoding_options const&, std::reference_wrapper, std::shared_ptr > >&, std::set, std::allocator >&>(Error (ImageItem_Grid::*&&)(unsigned int, unsigned int, unsigned int, std::shared_ptr&, heif_decoding_options const&, int&, std::shared_ptr > >, std::set, std::allocator >) const, ImageItem_Grid const*&&, unsigned int&, unsigned int&, unsigned int&, std::reference_wrapper >&&, heif_decoding_options const&, std::reference_wrapper&&, std::shared_ptr > >&, std::set, std::allocator >&) /usr/include/c++/13/future:1756 #4 0x7fb9ede06445 in void std::_Construct&, heif_decoding_options const&, int&, std::shared_ptr > >, std::set, std::allocator >) const, ImageItem_Grid const*, unsigned int, unsigned int, unsigned int, std::reference_wrapper >, heif_decoding_options, std::reference_wrapper, std::shared_ptr > >, std::set, std::allocator > > >, Error>, Error (ImageItem_Grid::*)(unsigned int, unsigned int, unsigned int, std::shared_ptr&, heif_decoding_options const&, int&, std::shared_ptr > >, std::set, std::allocator >) const, ImageItem_Grid const*, unsigned int&, unsigned int&, unsigned int&, std::reference_wrapper >, heif_decoding_options const&, std::reference_wrapper, std::shared_ptr > >&, std::set, std::allocator >&>(std::__future_base::_Async_state_impl&, heif_decoding_options const&, int&, std::shared_ptr > >, std::set, std::allocator >) const, ImageItem_Grid const*, unsigned int, unsigned int, unsigned int, std::reference_wrapper >, heif_decoding_options, std::reference_wrapper, std::shared_ptr > >, std::set, std::allocator > > >, Error>*, Error (ImageItem_Grid::*&&)(unsigned int, unsigned int, unsigned int, std::shared_ptr&, heif_decoding_options const&, int&, std::shared_ptr > >, std::set, std::allocator >) const, ImageItem_Grid const*&&, unsigned int&, unsigned int&, unsigned int&, std::reference_wrapper >&&, heif_decoding_options const&, std::reference_wrapper&&, std::shared_ptr > >&, std::set, std::allocator >&) /usr/include/c++/13/bits/stl_construct.h:119 #5 0x7fb9ede05086 in void std::allocator_traits >::construct&, heif_decoding_options const&, int&, std::shared_ptr > >, std::set, std::allocator >) const, ImageItem_Grid const*, unsigned int, unsigned int, unsigned int, std::reference_wrapper >, heif_decoding_options, std::reference_wrapper, std::shared_ptr > >, std::set, std::allocator > > >, Error>, Error (ImageItem_Grid::*)(unsigned int, unsigned int, unsigned int, std::shared_ptr&, heif_decoding_options const&, int&, std::shared_ptr > >, std::set, std::allocator >) const, ImageItem_Grid const*, unsigned int&, unsigned int&, unsigned int&, std::reference_wrapper >, heif_decoding_options const&, std::reference_wrapper, std::shared_ptr > >&, std::set, std::allocator >&>(std::allocator&, std::__future_base::_Async_state_impl&, heif_decoding_options const&, int&, std::shared_ptr > >, std::set, std::allocator >) const, ImageItem_Grid const*, unsigned int, unsigned int, unsigned int, std::reference_wrapper >, heif_decoding_options, std::reference_wrapper, std::shared_ptr > >, std::set, std::allocator > > >, Error>*, Error (ImageItem_Grid::*&&)(unsigned int, unsigned int, unsigned int, std::shared_ptr&, heif_decoding_options const&, int&, std::shared_ptr > >, std::set, std::allocator >) const, ImageItem_Grid const*&&, unsigned int&, unsigned int&, unsigned int&, std::reference_wrapper >&&, heif_decoding_options const&, std::reference_wrapper&&, std::shared_ptr > >&, std::set, std::allocator >&) /usr/include/c++/13/bits/alloc_traits.h:661 #6 0x7fb9ede05086 in std::_Sp_counted_ptr_inplace&, heif_decoding_options const&, int&, std::shared_ptr > >, std::set, std::allocator >) const, ImageItem_Grid const*, unsigned int, unsigned int, unsigned int, std::reference_wrapper >, heif_decoding_options, std::reference_wrapper, std::shared_ptr > >, std::set, std::allocator > > >, Error>, std::allocator, (__gnu_cxx::_Lock_policy)2>::_Sp_counted_ptr_inplace&, heif_decoding_options const&, int&, std::shared_ptr > >, std::set, std::allocator >) const, ImageItem_Grid const*, unsigned int&, unsigned int&, unsigned int&, std::reference_wrapper >, heif_decoding_options const&, std::reference_wrapper, std::shared_ptr > >&, std::set, std::allocator >&>(std::allocator, Error (ImageItem_Grid::*&&)(unsigned int, unsigned int, unsigned int, std::shared_ptr&, heif_decoding_options const&, int&, std::shared_ptr > >, std::set, std::allocator >) const, ImageItem_Grid const*&&, unsigned int&, unsigned int&, unsigned int&, std::reference_wrapper >&&, heif_decoding_options const&, std::reference_wrapper&&, std::shared_ptr > >&, std::set, std::allocator >&) /usr/include/c++/13/bits/shared_ptr_base.h:604 #7 0x7fb9ede038ae in std::__shared_count<(__gnu_cxx::_Lock_policy)2>::__shared_count&, heif_decoding_options const&, int&, std::shared_ptr > >, std::set, std::allocator >) const, ImageItem_Grid const*, unsigned int, unsigned int, unsigned int, std::reference_wrapper >, heif_decoding_options, std::reference_wrapper, std::shared_ptr > >, std::set, std::allocator > > >, Error>, std::allocator, Error (ImageItem_Grid::*)(unsigned int, unsigned int, unsigned int, std::shared_ptr&, heif_decoding_options const&, int&, std::shared_ptr > >, std::set, std::allocator >) const, ImageItem_Grid const*, unsigned int&, unsigned int&, unsigned int&, std::reference_wrapper >, heif_decoding_options const&, std::reference_wrapper, std::shared_ptr > >&, std::set, std::allocator >&>(std::__future_base::_Async_state_impl&, heif_decoding_options const&, int&, std::shared_ptr > >, std::set, std::allocator >) const, ImageItem_Grid const*, unsigned int, unsigned int, unsigned int, std::reference_wrapper >, heif_decoding_options, std::reference_wrapper, std::shared_ptr > >, std::set, std::allocator > > >, Error>*&, std::_Sp_alloc_shared_tag >, Error (ImageItem_Grid::*&&)(unsigned int, unsigned int, unsigned int, std::shared_ptr&, heif_decoding_options const&, int&, std::shared_ptr > >, std::set, std::allocator >) const, ImageItem_Grid const*&&, unsigned int&, unsigned int&, unsigned int&, std::reference_wrapper >&&, heif_decoding_options const&, std::reference_wrapper&&, std::shared_ptr > >&, std::set, std::allocator >&) /usr/include/c++/13/bits/shared_ptr_base.h:971 #8 0x7fb9ede01c9f in std::__shared_ptr&, heif_decoding_options const&, int&, std::shared_ptr > >, std::set, std::allocator >) const, ImageItem_Grid const*, unsigned int, unsigned int, unsigned int, std::reference_wrapper >, heif_decoding_options, std::reference_wrapper, std::shared_ptr > >, std::set, std::allocator > > >, Error>, (__gnu_cxx::_Lock_policy)2>::__shared_ptr, Error (ImageItem_Grid::*)(unsigned int, unsigned int, unsigned int, std::shared_ptr&, heif_decoding_options const&, int&, std::shared_ptr > >, std::set, std::allocator >) const, ImageItem_Grid const*, unsigned int&, unsigned int&, unsigned int&, std::reference_wrapper >, heif_decoding_options const&, std::reference_wrapper, std::shared_ptr > >&, std::set, std::allocator >&>(std::_Sp_alloc_shared_tag >, Error (ImageItem_Grid::*&&)(unsigned int, unsigned int, unsigned int, std::shared_ptr&, heif_decoding_options const&, int&, std::shared_ptr > >, std::set, std::allocator >) const, ImageItem_Grid const*&&, unsigned int&, unsigned int&, unsigned int&, std::reference_wrapper >&&, heif_decoding_options const&, std::reference_wrapper&&, std::shared_ptr > >&, std::set, std::allocator >&) /usr/include/c++/13/bits/shared_ptr_base.h:1712 #9 0x7fb9ede008df in std::shared_ptr&, heif_decoding_options const&, int&, std::shared_ptr > >, std::set, std::allocator >) const, ImageItem_Grid const*, unsigned int, unsigned int, unsigned int, std::reference_wrapper >, heif_decoding_options, std::reference_wrapper, std::shared_ptr > >, std::set, std::allocator > > >, Error> >::shared_ptr, Error (ImageItem_Grid::*)(unsigned int, unsigned int, unsigned int, std::shared_ptr&, heif_decoding_options const&, int&, std::shared_ptr > >, std::set, std::allocator >) const, ImageItem_Grid const*, unsigned int&, unsigned int&, unsigned int&, std::reference_wrapper >, heif_decoding_options const&, std::reference_wrapper, std::shared_ptr > >&, std::set, std::allocator >&>(std::_Sp_alloc_shared_tag >, Error (ImageItem_Grid::*&&)(unsigned int, unsigned int, unsigned int, std::shared_ptr&, heif_decoding_options const&, int&, std::shared_ptr > >, std::set, std::allocator >) const, ImageItem_Grid const*&&, unsigned int&, unsigned int&, unsigned int&, std::reference_wrapper >&&, heif_decoding_options const&, std::reference_wrapper&&, std::shared_ptr > >&, std::set, std::allocator >&) /usr/include/c++/13/bits/shared_ptr.h:464 #10 0x7fb9eddfe2e0 in std::shared_ptr&, heif_decoding_options const&, int&, std::shared_ptr > >, std::set, std::allocator >) const, ImageItem_Grid const*, unsigned int, unsigned int, unsigned int, std::reference_wrapper >, heif_decoding_options, std::reference_wrapper, std::shared_ptr > >, std::set, std::allocator > > >, Error> > std::make_shared&, heif_decoding_options const&, int&, std::shared_ptr > >, std::set, std::allocator >) const, ImageItem_Grid const*, unsigned int, unsigned int, unsigned int, std::reference_wrapper >, heif_decoding_options, std::reference_wrapper, std::shared_ptr > >, std::set, std::allocator > > >, Error>, Error (ImageItem_Grid::*)(unsigned int, unsigned int, unsigned int, std::shared_ptr&, heif_decoding_options const&, int&, std::shared_ptr > >, std::set, std::allocator >) const, ImageItem_Grid const*, unsigned int&, unsigned int&, unsigned int&, std::reference_wrapper >, heif_decoding_options const&, std::reference_wrapper, std::shared_ptr > >&, std::set, std::allocator >&>(Error (ImageItem_Grid::*&&)(unsigned int, unsigned int, unsigned int, std::shared_ptr&, heif_decoding_options const&, int&, std::shared_ptr > >, std::set, std::allocator >) const, ImageItem_Grid const*&&, unsigned int&, unsigned int&, unsigned int&, std::reference_wrapper >&&, heif_decoding_options const&, std::reference_wrapper&&, std::shared_ptr > >&, std::set, std::allocator >&) /usr/include/c++/13/bits/shared_ptr.h:1010 #11 0x7fb9eddfb640 in std::future&, heif_decoding_options const&, int&, std::shared_ptr > >, std::set, std::allocator >) const>::type, std::decay::type, std::decay::type, std::decay::type, std::decay::type, std::decay > >::type, std::decay::type, std::decay >::type, std::decay > >&>::type, std::decay, std::allocator >&>::type>::type> std::async&, heif_decoding_options const&, int&, std::shared_ptr > >, std::set, std::allocator >) const, ImageItem_Grid const*, unsigned int&, unsigned int&, unsigned int&, std::reference_wrapper >, heif_decoding_options const&, std::reference_wrapper, std::shared_ptr > >&, std::set, std::allocator >&>(std::launch, Error (ImageItem_Grid::*&&)(unsigned int, unsigned int, unsigned int, std::shared_ptr&, heif_decoding_options const&, int&, std::shared_ptr > >, std::set, std::allocator >) const, ImageItem_Grid const*&&, unsigned int&, unsigned int&, unsigned int&, std::reference_wrapper >&&, heif_decoding_options const&, std::reference_wrapper&&, std::shared_ptr > >&, std::set, std::allocator >&) /usr/include/c++/13/future:1805 #12 0x7fb9edde9ce9 in ImageItem_Grid::decode_full_grid_image(heif_decoding_options const&, std::set, std::allocator >) const /root/.pruva/runs/cve-2026-32740_20260523-061427/external/libheif/libheif/image-items/grid.cc:427 #13 0x7fb9edde79bd in ImageItem_Grid::decode_compressed_image(heif_decoding_options const&, bool, unsigned int, unsigned int, std::set, std::allocator >) const /root/.pruva/runs/cve-2026-32740_20260523-061427/external/libheif/libheif/image-items/grid.cc:226 #14 0x7fb9eddbd94d in ImageItem::decode_image(heif_decoding_options const&, bool, unsigned int, unsigned int, std::set, std::allocator >) const /root/.pruva/runs/cve-2026-32740_20260523-061427/external/libheif/libheif/image-items/image_item.cc:708 #15 0x7fb9edbb51f8 in HeifContext::decode_image(unsigned int, heif_colorspace, heif_chroma, heif_decoding_options const&, bool, unsigned int, unsigned int, std::set, std::allocator >) const /root/.pruva/runs/cve-2026-32740_20260523-061427/external/libheif/libheif/context.cc:1300 #16 0x7fb9edd04b2e in heif_decode_image /root/.pruva/runs/cve-2026-32740_20260523-061427/external/libheif/libheif/api/libheif/heif_decoding.cc:239 #17 0x557cefc02365 in main /root/.pruva/runs/cve-2026-32740_20260523-061427/repro/poc.c:108 #18 0x7fb9ed62a1c9 in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58 #19 0x7fb9ed62a28a in __libc_start_main_impl ../csu/libc-start.c:360 #20 0x557cefc014a4 in _start (/root/.pruva/runs/cve-2026-32740_20260523-061427/repro/poc+0x24a4) (BuildId: fde11520eea426241d544577d48e07056dcaad63) SUMMARY: AddressSanitizer: heap-buffer-overflow ../../../../src/libsanitizer/sanitizer_common/sanitizer_common_interceptors_memintrinsics.inc:115 in memcpy Shadow bytes around the buggy address: 0x525000010f00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x525000010f80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x525000011000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x525000011080: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x525000011100: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 =>0x525000011180: 00[07]fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x525000011200: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x525000011280: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x525000011300: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x525000011380: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x525000011400: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa Shadow byte legend (one shadow byte represents 8 application bytes): Addressable: 00 Partially addressable: 01 02 03 04 05 06 07 Heap left redzone: fa Freed heap region: fd Stack left redzone: f1 Stack mid redzone: f2 Stack right redzone: f3 Stack after return: f5 Stack use after scope: f8 Global redzone: f9 Global init order: f6 Poisoned by user: f7 Container overflow: fc Array cookie: ac Intra object redzone: bb ASan internal: fe Left alloca redzone: ca Right alloca redzone: cb ==3818==ABORTING