Threats affecting pkg:cargo/heifer-hevc-dec

A vulnerability in the heifer-hevc-dec crate causes a panic when decoding HEVC Range Extensions streams that enable chroma QP offsets but provide an empty offset list. This panic results from an out-of-range access when reading the empty list, aborting the decoding thread or the entire process if built with panic abort. The issue does not cause memory corruption due to the crate's safe Rust codebase. The flaw affects all versions before 0.3.27 and was fixed in version 0.3.27 by treating empty offset lists as zero offsets.

A vulnerability in the heifer-hevc-dec Rust crate allows a crafted HEVC stream to cause a panic during decoding by redefining tile layouts that do not match the active sequence parameter set (SPS). This leads to an out-of-bounds indexing panic, aborting the decoding thread or process. The issue is fixed in version 0.3.27 by rejecting invalid tile layouts at decode time.