Commit 385fcba1 for libheif
commit 385fcba1eb3890d7b398e6ed88155d93b6a6df59
Author: Dirk Farin <dirk.farin@gmail.com>
Date: Mon Sep 21 02:36:11 2026 +0200
Tolerate a repeated track ID within one 'tref' reference type box
Box_tref rejected a TrackReferenceTypeBox that lists the same track ID
twice ("'tref' has double references"), both when parsing and when
writing. ISO/IEC 14496-12 does not forbid it, and no consumer in libheif
depends on the entries being unique: the alpha-track lookup tests for
membership, the reference listing API returns the entries as-is, and the
referring-track search stops at the first match. A redundant entry is
therefore no reason to reject a file, and the write-side check turned
two calls of heif_track_add_reference_to_track() with the same target
into an unwritable file.
Same reasoning as b8065513 for item references. Add a round-trip test
with URI metadata tracks, which needs no codec.
diff --git a/libheif/sequences/seq_boxes.cc b/libheif/sequences/seq_boxes.cc
index 8861a00a..565ea8cb 100644
--- a/libheif/sequences/seq_boxes.cc
+++ b/libheif/sequences/seq_boxes.cc
@@ -2331,43 +2331,16 @@ Error Box_tref::parse(BitstreamRange& range, const heif_security_limits* limits)
m_references.push_back(ref);
}
-
- // --- check for duplicate references
-
- if (auto error = check_for_double_references()) {
- return error;
- }
+ // Note: a track ID may appear several times within one reference type box.
+ // ISO/IEC 14496-12 does not forbid it and no consumer depends on uniqueness,
+ // so a redundant entry is tolerated instead of rejecting the whole file.
return range.get_error();
}
-Error Box_tref::check_for_double_references() const
-{
- for (const auto& ref : m_references) {
- std::set<uint32_t> to_ids;
- for (const auto to_id : ref.to_track_id) {
- if (to_ids.find(to_id) == to_ids.end()) {
- to_ids.insert(to_id);
- }
- else {
- return {heif_error_Invalid_input,
- heif_suberror_Unspecified,
- "'tref' has double references"};
- }
- }
- }
-
- return Error::Ok;
-}
-
-
Error Box_tref::write(StreamWriter& writer) const
{
- if (auto error = check_for_double_references()) {
- return error;
- }
-
size_t box_start = reserve_box_header_space(writer);
for (const auto& ref : m_references) {
diff --git a/libheif/sequences/seq_boxes.h b/libheif/sequences/seq_boxes.h
index 729ea2f4..8ab02788 100644
--- a/libheif/sequences/seq_boxes.h
+++ b/libheif/sequences/seq_boxes.h
@@ -996,8 +996,6 @@ protected:
Error write(StreamWriter& writer) const override;
- Error check_for_double_references() const;
-
private:
std::vector<Reference> m_references;
};
diff --git a/tests/CMakeLists.txt b/tests/CMakeLists.txt
index 933a4f91..08e5b50a 100644
--- a/tests/CMakeLists.txt
+++ b/tests/CMakeLists.txt
@@ -116,6 +116,7 @@ add_libheif_test(sequence_mixed_bit_depth)
add_libheif_test(sequence_no_track)
add_libheif_test(sequence_null_options)
add_libheif_test(sequence_timing_overflow)
+add_libheif_test(track_reference_duplicates)
add_libheif_test(sequence_raw_sample_errors)
add_libheif_test(tai)
add_libheif_test(text)
diff --git a/tests/track_reference_duplicates.cc b/tests/track_reference_duplicates.cc
new file mode 100644
index 00000000..8e7721a2
--- /dev/null
+++ b/tests/track_reference_duplicates.cc
@@ -0,0 +1,140 @@
+/*
+ libheif unit tests
+
+ MIT License
+
+ Copyright (c) 2026 Dirk Farin <dirk.farin@gmail.com>
+
+ Permission is hereby granted, free of charge, to any person obtaining a copy
+ of this software and associated documentation files (the "Software"), to deal
+ in the Software without restriction, including without limitation the rights
+ to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+ copies of the Software, and to permit persons to whom the Software is
+ furnished to do so, subject to the following conditions:
+
+ The above copyright notice and this permission notice shall be included in all
+ copies or substantial portions of the Software.
+
+ THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+ AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+ OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+ SOFTWARE.
+*/
+
+// A track reference type box may list the same track ID more than once.
+// ISO/IEC 14496-12 does not forbid it, no consumer in libheif depends on the
+// entries being unique, and a redundant entry is no reason to reject a file.
+// Box_tref used to refuse such a box on both the read and the write path
+// ("'tref' has double references"), so calling heif_track_add_reference_to_track()
+// twice with the same target made the whole file unwritable, and a file written
+// by another muxer with a repeated ID could not be opened.
+//
+// The test uses URI metadata tracks with raw samples, so it needs no codec.
+
+#include "catch_amalgamated.hpp"
+#include "libheif/heif.h"
+#include "libheif/heif_sequences.h"
+
+#include <cstdint>
+#include <vector>
+
+namespace {
+
+heif_error mem_writer(heif_context*, const void* data, size_t size, void* userdata)
+{
+ auto* out = static_cast<std::vector<uint8_t>*>(userdata);
+ const auto* p = static_cast<const uint8_t*>(data);
+ out->insert(out->end(), p, p + size);
+ return heif_error{heif_error_Ok, heif_suberror_Unspecified, nullptr};
+}
+
+// Add a metadata track with one raw sample so that the track is complete.
+heif_track* add_metadata_track(heif_context* ctx, const char* uri)
+{
+ heif_track* track = nullptr;
+ heif_error err = heif_context_add_uri_metadata_sequence_track(ctx, uri, nullptr, &track);
+ INFO("add_uri_metadata_sequence_track: " << (err.message ? err.message : ""));
+ REQUIRE(err.code == heif_error_Ok);
+ REQUIRE(track != nullptr);
+
+ const uint8_t payload[] = {1, 2, 3, 4};
+ heif_raw_sequence_sample* sample = heif_raw_sequence_sample_alloc();
+ REQUIRE(sample != nullptr);
+ REQUIRE(heif_raw_sequence_sample_set_data(sample, payload, sizeof(payload)).code == heif_error_Ok);
+ heif_raw_sequence_sample_set_duration(sample, 1);
+ REQUIRE(heif_track_add_raw_sequence_sample(track, sample).code == heif_error_Ok);
+ heif_raw_sequence_sample_release(sample);
+
+ return track;
+}
+
+} // namespace
+
+
+TEST_CASE("a track reference type box may list the same track twice")
+{
+ const uint32_t ref_type = heif_track_reference_type_description;
+
+ // --- write a file in which track B references track A twice
+
+ heif_context* ctx = heif_context_alloc();
+ REQUIRE(ctx != nullptr);
+
+ heif_track* track_a = add_metadata_track(ctx, "urn:test:a");
+ heif_track* track_b = add_metadata_track(ctx, "urn:test:b");
+ const uint32_t id_a = heif_track_get_id(track_a);
+ const uint32_t id_b = heif_track_get_id(track_b);
+ REQUIRE(id_a != id_b);
+
+ heif_track_add_reference_to_track(track_b, ref_type, track_a);
+ heif_track_add_reference_to_track(track_b, ref_type, track_a);
+
+ std::vector<uint8_t> file;
+ heif_writer writer{};
+ writer.writer_api_version = 1;
+ writer.write = mem_writer;
+ heif_error err = heif_context_write(ctx, &writer, &file);
+ INFO("write: " << (err.message ? err.message : ""));
+ REQUIRE(err.code == heif_error_Ok); // used to fail with "'tref' has double references"
+
+ heif_track_release(track_a);
+ heif_track_release(track_b);
+ heif_context_free(ctx);
+
+ // --- read it back
+
+ ctx = heif_context_alloc();
+ REQUIRE(ctx != nullptr);
+ err = heif_context_read_from_memory(ctx, file.data(), file.size(), nullptr);
+ INFO("read: " << (err.message ? err.message : ""));
+ REQUIRE(err.code == heif_error_Ok); // used to fail while parsing the 'tref' box
+ REQUIRE(heif_context_has_sequence(ctx) == 1);
+
+ track_a = heif_context_get_track(ctx, id_a);
+ track_b = heif_context_get_track(ctx, id_b);
+ REQUIRE(track_a != nullptr);
+ REQUIRE(track_b != nullptr);
+
+ // Both entries are reported as written.
+ REQUIRE(heif_track_get_number_of_track_reference_types(track_b) == 1);
+ REQUIRE(heif_track_get_number_of_track_reference_of_type(track_b, ref_type) == 2);
+
+ uint32_t targets[2] = {0, 0};
+ REQUIRE(heif_track_get_references_from_track(track_b, ref_type, targets) == 2);
+ REQUIRE(targets[0] == id_a);
+ REQUIRE(targets[1] == id_a);
+
+ // The reverse lookup lists the referring track once, not once per entry.
+ uint32_t referring[4] = {0, 0, 0, 0};
+ REQUIRE(heif_track_find_referring_tracks(track_a, ref_type, referring, 4) == 1);
+ REQUIRE(referring[0] == id_b);
+
+ REQUIRE(heif_track_get_number_of_track_reference_of_type(track_a, ref_type) == 0);
+
+ heif_track_release(track_a);
+ heif_track_release(track_b);
+ heif_context_free(ctx);
+}