libheif-1.23.1

[Bruce Dubbs]

New point version.

[Joe Locash]

v1.23.1

This is primarily a bugfix release with a few new decoder/encoder capabilities.

New features
    FFmpeg decoder plugin gains AV1, VVC, JPEG, and JPEG 2000/HTJ2K decoding (thanks to @torusrxxx)
    SVT-AV1 encoder: new tune=iq and ms-ssim tune parameters (thanks to @pszemus)
    C++ API: added getters/setters for the CLLI and MDCV HDR metadata boxes (#1825)
    Sequence decoder now scales the alpha auxiliary track to the main image size

Bug fixes
    Fixed pixi box writing for multi-channel images
    Corrected the placement of the TAI clock_type field into the top 2 bits (thanks to @ocrete)
    Empty/unset plugin directory is no longer scanned

Security fixes
    CVE-TBD (GHSA-jc8f-p23p-5hjg) Integer underflow in Fraction constructor via double clap transform application
    CVE-TBD (GHSA-73p7-m7gg-w2jv) Out-of-bounds read in uncompressed unci tile range slicing
    CVE-TBD (GHSA-xpw3-9rhw-482x) Heap out of bounds write in libheif uncompressed encoder when writing images with mismatched auxiliary alpha dimensions
    CVE-TBD (GHSA-9ww4-9v47-m7pj) Reachable assertion in HeifContext::get_track() aborts on a valid-but-empty HEIF sequence file
    (GHSA-46rp-pcq2-rpmr) Heap out-of-bounds write in the uncompressed encoder for RRGGBB images with interleaved bit-depth ≤ 8

Fixed at c609039646. Leaving open for SA.

[Bruce Dubbs]

Advisory sa-13.0-168 has been issued.