AIKIDO-2026-518573

TL;DR

When parsing the iinf box, libheif passes the file-declared item count to the child-box reader without checking it against the configured item limit, because the cardinality check runs only on a different parse branch. A file that declares a very large item count forces quadratic parsing time and a large allocation, and on WebAssembly builds an unbounded alloca corrupts the stack. This lets a small crafted file exhaust resources at parse time. The fix enforces the item limit on the iinf child count.