CVE-2026-48029: Two Grid-Decode Vulnerabilities in libheif

A single afternoon of fuzzing against libheif 1.21.2 produced two memory-safety bugs in the same function. The first is a NULL pointer dereference on a malformed grid dimg reference - deterministic denial of service on any consumer that calls heif_decode_image or heif_image_handle_decode_image_tile. The second is a uint32 underflow in the inverse-rotation tile arithmetic that feeds a debug-only…