Description
I’ve installed the latest ConvertX (ghcr.io/c4illin/convertx:latest) in Docker and cannot convert HEIC images taken on an iPhone 17 Pro Max to JPEG.
The conversion fails immediately with:
`heif: Invalid input: Security limit exceeded: Number of references in iref box (45) exceeds the security limits of 16 references. (2.1000)
Failed to convert ./data/uploads/1/3/IMG_0734.HEIC from heic to jpeg using vips.`
Environment
- ConvertX: v0.18.0
- libheif: 1.21.2
- libvips: 8.18.3
- ImageMagick: 7.1.2-24
- Docker image: ghcr.io/c4illin/convertx:latest
What I’ve verified
- The uploaded file is intact (~3 MB).
- The HEIC file has a valid header:
00 00 00 34 66 74 79 70 68 65 69 63
(ftypheic)
- The container has write permissions to both upload and output directories.
- The failure is reproducible every time.
Logs
`stderr: heif: Invalid input: Security limit exceeded:
Number of references in iref box (45) exceeds the security limits of 16 references. (2.1000)
Failed to convert ./data/uploads/1/3/IMG_0734.HEIC from heic to jpeg using vips.`
Additional investigation
I tried setting:
LIBHEIF_SECURITY_LIMITS=off
(and also OFF)
inside the container environment and recreated the container.
The environment variable is present inside the container, but it makes no difference.
I also tested directly inside the container:
vips copy input.HEIC output.jpg
which produces the same security limit error.
Interestingly, heif-dec and ImageMagick also fail:
Could not read HEIF/AVIF file: Invalid input: No 'ftyp' box
despite the file clearly containing a valid ftypheic header.
Question
Is this a known limitation or regression with the bundled libheif/libvips versions when decoding newer HEIC files from recent iPhones (iPhone 17 Pro Max)?
Description
I’ve installed the latest ConvertX (ghcr.io/c4illin/convertx:latest) in Docker and cannot convert HEIC images taken on an iPhone 17 Pro Max to JPEG.
The conversion fails immediately with:
`heif: Invalid input: Security limit exceeded: Number of references in iref box (45) exceeds the security limits of 16 references. (2.1000)
Failed to convert ./data/uploads/1/3/IMG_0734.HEIC from heic to jpeg using vips.`
Environment
What I’ve verified
00 00 00 34 66 74 79 70 68 65 69 63(ftypheic)
Logs
`stderr: heif: Invalid input: Security limit exceeded:
Number of references in iref box (45) exceeds the security limits of 16 references. (2.1000)
Failed to convert ./data/uploads/1/3/IMG_0734.HEIC from heic to jpeg using vips.`
Additional investigation
I tried setting:
LIBHEIF_SECURITY_LIMITS=off(and also OFF)
inside the container environment and recreated the container.
The environment variable is present inside the container, but it makes no difference.
I also tested directly inside the container:
vips copy input.HEIC output.jpgwhich produces the same security limit error.
Interestingly, heif-dec and ImageMagick also fail:
Could not read HEIF/AVIF file: Invalid input: No 'ftyp' boxdespite the file clearly containing a valid ftypheic header.
Question
Is this a known limitation or regression with the bundled libheif/libvips versions when decoding newer HEIC files from recent iPhones (iPhone 17 Pro Max)?