graphicsmagick:coder_HEIF_fuzzer: Heap-buffer-overflow in Op_YCbCr_to_RGB<unsigned char>::convert_colorspace

GraphicsMagick oss-fuzz testing has produced issue [512988067](https://issues.oss-fuzz.com/issues/512988067) which appears to be due to libheif code. This is the reported stack trace: > ERROR: AddressSanitizer: heap-buffer-overflow on address 0x7d722d1ed40f at pc 0x56eb2ec69ef8 bp 0x7ffed540ee70 sp 0x7ffed540ee68 > READ of size 1 at 0x7d722d1ed40f thread T0 > #0 0x56eb2ec69ef7 in Op_YCbCr_to_RGB<unsigned char>::convert_colorspace(std::__1::shared_ptr<HeifPixelImage const> const&, ColorState const&, ColorState const&, heif_color_conversion_options const&, heif_color_conversion_options_ext const&, heif_security_limits const*) const [libheif/libheif/color-conversion/yuv2rgb.cc:269](https://github.com/strukturag/libheif/blob/580ca121af7cc4c608473159a6cf6b977d99e9e0/libheif/color-conversion/yuv2rgb.cc#L269):33 > #1 0x56eb2ec44005 in ColorConversionPipeline::convert_image(std::__1::shared_ptr<HeifPixelImage> const&, heif_security_limits const*) [libheif/libheif/color-conversion/colorconversion.cc:463](https://github.com/strukturag/libheif/blob/580ca121af7cc4c608473159a6cf6b977d99e9e0/libheif/color-conversion/colorconversion.cc#L463):38 > #2 0x56eb2ec4596a in convert_colorspace(std::__1::shared_ptr<HeifPixelImage> const&, heif_colorspace, heif_chroma, nclx_profile const&, int, heif_color_conversion_options const&, heif_color_conversion_options_ext const*, heif_security_limits const*) [libheif/libheif/color-conversion/colorconversion.cc:621](https://github.com/strukturag/libheif/blob/580ca121af7cc4c608473159a6cf6b977d99e9e0/libheif/color-conversion/colorconversion.cc#L621):21 > #3 0x56eb2ee54d8c in HeifContext::convert_to_output_colorspace(std::__1::shared_ptr<HeifPixelImage>, heif_colorspace, heif_chroma, heif_decoding_options const&) const [libheif/libheif/context.cc:1517](https://github.com/strukturag/libheif/blob/580ca121af7cc4c608473159a6cf6b977d99e9e0/libheif/context.cc#L1517):12 > #4 0x56eb2ee53b29 in HeifContext::decode_image(unsigned int, heif_colorspace, heif_chroma, heif_decoding_options const&, bool, unsigned int, unsigned int, std::__1::set<unsigned int, std::__1::less<unsigned int>, std::__1::allocator<unsigned int>>) const [libheif/libheif/context.cc:1429](https://github.com/strukturag/libheif/blob/580ca121af7cc4c608473159a6cf6b977d99e9e0/libheif/context.cc#L1429):21 > #5 0x56eb2eba1d8c in heif_decode_image [libheif/libheif/api/libheif/heif_decoding.cc:244](https://github.com/strukturag/libheif/blob/580ca121af7cc4c608473159a6cf6b977d99e9e0/libheif/api/libheif/heif_decoding.cc#L244):81 > #6 0x56eb2e8c1e26 in ReadHEIFImageFrame /src/graphicsmagick/coders/heif.c:1246:17 > #7 0x56eb2e8be643 in ReadHEIFImage /src/graphicsmagick/coders/heif.c:2407:10 > #8 0x56eb2e6c9f26 in ReadImage /src/graphicsmagick/magick/constitute.c:1682:13 > #9 0x56eb2e67b234 in BlobToImage /src/graphicsmagick/magick/blob.c:785:13 > #10 0x56eb2e605316 in Magick::Image::read(Magick::Blob const&) /src/graphicsmagick/Magick++/lib/Image.cpp:1601:5 > #11 0x56eb2e5f9252 in LLVMFuzzerTestOneInput /src/graphicsmagick/fuzzing/coder_fuzzer.cc:24:11 > #12 0x56eb2e4965bd in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:619:13 > #13 0x56eb2e481332 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:329:6 > #14 0x56eb2e487200 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:865:9 > #15 0x56eb2e4b2d32 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 > #16 0x7e822dca9082 in __libc_start_main /build/glibc-B3wQXB/glibc-2.31/csu/libc-start.c:308:16 > #17 0x56eb2e47a41d in _start These two testcases were provided: [clusterfuzz-testcase-coder_HEIF_fuzzer-5547817258254336.gz](https://github.com/user-attachments/files/27761004/clusterfuzz-testcase-coder_HEIF_fuzzer-5547817258254336.gz) [clusterfuzz-testcase-minimized-coder_HEIF_fuzzer-5547817258254336.gz](https://github.com/user-attachments/files/27761016/clusterfuzz-testcase-minimized-coder_HEIF_fuzzer-5547817258254336.gz)