Commit 41788bdf for libheif

commit 41788bdf80ed70d24943912e75cdda4400c7ab92
Author: Dirk Farin <dirk.farin@gmail.com>
Date:   Mon Oct 26 11:09:38 2026 +0100

    heif-dec, heif-info: only use the 'urim' URI when reading it succeeded [GHSA-r9cg-w542-g7hj]

    heif_track_get_urim_sample_entry_uri_of_first_cluster() writes *out_uri
    only on success, but both tools printed the error and then went on to print
    and heif_string_release() the never-assigned pointer. A 'urim' sample entry
    without 'uri ' child box therefore made them free a stack address, or read
    and free again the URI string of a previous 'urim' track.

    Fixes GHSA-r9cg-w542-g7hj (reported as ANT-2026-QVQYWGC7).

diff --git a/examples/heif_dec.cc b/examples/heif_dec.cc
index ef73bd1e..9f89ddcf 100644
--- a/examples/heif_dec.cc
+++ b/examples/heif_dec.cc
@@ -882,13 +882,15 @@ int main(int argc, char** argv)
         uint32_t sample_entry_type = heif_track_get_sample_entry_type_of_first_cluster(track);
         std::cout << "\n  sample entry type: " << heif_examples::fourcc_to_string(sample_entry_type);
         if (sample_entry_type == heif_fourcc('u', 'r', 'i', 'm')) {
-          const char* uri;
+          const char* uri = nullptr;
           err = heif_track_get_urim_sample_entry_uri_of_first_cluster(track, &uri);
           if (err.code) {
             std::cerr << "Cannot read 'urim'-track URI: " << err.message << "\n";
           }
-          std::cout << "\n  URI: " << uri;
-          heif_string_release(uri);
+          else {
+            std::cout << "\n  URI: " << uri;
+            heif_string_release(uri);
+          }
         }

         // get metadata track samples
diff --git a/examples/heif_info.cc b/examples/heif_info.cc
index a6249aff..cb9c1757 100644
--- a/examples/heif_info.cc
+++ b/examples/heif_info.cc
@@ -1098,13 +1098,15 @@ int main(int argc, char** argv)
       std::cout << "  sample entry type: " << heif_examples::fourcc_to_string(sampleEntryType) << "\n";

       if (sampleEntryType == heif_fourcc('u', 'r', 'i', 'm')) {
-        const char* uri;
+        const char* uri = nullptr;
         err = heif_track_get_urim_sample_entry_uri_of_first_cluster(track, &uri);
         if (err.code) {
           std::cerr << "error reading urim-track uri: " << err.message << "\n";
         }
-        std::cout << "  uri: " << uri << "\n";
-        heif_string_release(uri);
+        else {
+          std::cout << "  uri: " << uri << "\n";
+          heif_string_release(uri);
+        }
       }

       std::cout << "  sample auxiliary information: ";