From 5d4fe5478b0529a90da1aaa963ff3c93699c1bf7 Mon Sep 17 00:00:00 2001
From: kuflierl <41301536+kuflierl@users.noreply.github.com>
Date: Thu, 22 Jan 2026 09:47:55 +0100
Subject: [PATCH 1/2] libheif: finalAttrs

---
 pkgs/by-name/li/libheif/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/li/libheif/package.nix b/pkgs/by-name/li/libheif/package.nix
index 2ac0eb645df0..5b07410c6963 100644
--- a/pkgs/by-name/li/libheif/package.nix
+++ b/pkgs/by-name/li/libheif/package.nix
@@ -22,7 +22,7 @@
   vips,
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "libheif";
   version = "1.20.2";
 
@@ -36,7 +36,7 @@ stdenv.mkDerivation rec {
   src = fetchFromGitHub {
     owner = "strukturag";
     repo = "libheif";
-    rev = "v${version}";
+    rev = "v${finalAttrs.version}";
     hash = "sha256-PVfdX3/Oe3DXpYU5WMnCSi2p9X4fPszq2X3uuyh8RVU=";
   };
 
@@ -83,4 +83,4 @@ stdenv.mkDerivation rec {
     platforms = lib.platforms.unix;
     maintainers = with lib.maintainers; [ kuflierl ];
   };
-}
+})

From c12294290dad2c1b56f599292874c24da0701d6e Mon Sep 17 00:00:00 2001
From: kuflierl <41301536+kuflierl@users.noreply.github.com>
Date: Thu, 22 Jan 2026 09:48:42 +0100
Subject: [PATCH 2/2] libheif: backport fix for CVE-2025-68431

---
 pkgs/by-name/li/libheif/package.nix | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/pkgs/by-name/li/libheif/package.nix b/pkgs/by-name/li/libheif/package.nix
index 5b07410c6963..81b059b98a70 100644
--- a/pkgs/by-name/li/libheif/package.nix
+++ b/pkgs/by-name/li/libheif/package.nix
@@ -2,6 +2,7 @@
   lib,
   stdenv,
   fetchFromGitHub,
+  fetchpatch,
   cmake,
   pkg-config,
   dav1d,
@@ -40,6 +41,15 @@ stdenv.mkDerivation (finalAttrs: {
     hash = "sha256-PVfdX3/Oe3DXpYU5WMnCSi2p9X4fPszq2X3uuyh8RVU=";
   };
 
+  patches = [
+    # CVE-2025-68431 (https://github.com/strukturag/libheif/security/advisories/GHSA-j87x-4gmq-cqfq)
+    (fetchpatch {
+      name = "001-fix-wrong-copy-width-in-overlay-images.patch";
+      url = "https://github.com/strukturag/libheif/commit/b8c12a7b70f46c9516711a988483bed377b78d46.patch";
+      hash = "sha256-PzGfcbdWAPdfExbSrPQwpk4v++TcNCXOhtwhgLGM13c=";
+    })
+  ];
+
   nativeBuildInputs = [
     pkg-config
     cmake