Commit 7d81c9ec for libheif

commit 7d81c9ecd9a148ffc6d33b78c37621307de0ce35
Author: Dirk Farin <dirk.farin@gmail.com>
Date:   Thu Oct 15 20:37:48 2026 +0200

    heif-enc: reject WebVMT hour values that overflow the millisecond counter

    The hour field is unbounded in the pattern, but the timestamp is a
    32 bit millisecond counter. Hours above 596 overflowed the int
    arithmetic and hour strings that do not fit an int made std::stoi throw
    and abort heif-enc. Compute in 64 bit and report such timestamps as bad.

diff --git a/examples/vmt.cc b/examples/vmt.cc
index 89d0d395..356910e8 100644
--- a/examples/vmt.cc
+++ b/examples/vmt.cc
@@ -181,12 +181,22 @@ static uint32_t parse_vmt_timestamp(const std::string& vmt_time)

   uint32_t ms = std::stoi(fs); // the pattern guarantees exactly three digits

-  uint32_t ts = ((hh != "" ? std::stoi(hh) : 0) * 3600 * 1000 +
+  // The timestamp is stored in a 32 bit millisecond counter. Reject hour values that cannot fit
+  // (and that would overflow std::stoi) before doing any arithmetic.
+  if (hh.length() > 9) {
+    return BAD_VMT_TIMESTAMP;
+  }
+
+  uint64_t ts = ((hh != "" ? std::stoull(hh) : 0) * 3600 * 1000 +
                  std::stoi(mm) * 60 * 1000 +
                  std::stoi(ss) * 1000 +
                  ms);

-  return ts;
+  if (ts >= BAD_VMT_TIMESTAMP) {
+    return BAD_VMT_TIMESTAMP;
+  }
+
+  return static_cast<uint32_t>(ts);
 }

 int encode_vmt_metadata_track(heif_context* context, heif_track* visual_track,