Hi, 
I just discovered that there is CVE-2023-49460 + CVE-2023-49464 impacting libheif1 when the library is compiled with the `WITH_UNCOMPRESSED_CODEC` option and that the vulnerable function is used. So I asked myself, should this experimental option be enabled by default?

There is difference between the Default CMakeLists.txt option (https://github.com/strukturag/libheif/blob/3ebec35955aeff0a24ec132a6a208e60d51ea11d/CMakeLists.txt#L182) and the CMakePresets's default configuration (https://github.com/strukturag/libheif/blob/3ebec35955aeff0a24ec132a6a208e60d51ea11d/CMakePresets.json#L32).

If it was by default disabled (as it is in the CMakeLists.txt file), it should be the same for the `default` presets otherwise it is not coherent and the experimental option is enabled by default for all builds. 

Only the `develop` preset should enable it IMO.
The same for all experimental modes IMO to make the default library file more secure.

WDYT?

Uncompressed codec enabled by default even if experimental?
This is a GitHub Issue
repo:libheif
owner:strukturag
Title : Uncompressed codec enabled by default even if experimental?
Issue date:

--- start body ---
Hi, 
I just discovered that there is CVE-2023-49460 + CVE-2023-49464 impacting libheif1 when the library is compiled with the `WITH_UNCOMPRESSED_CODEC` option and that the vulnerable function is used. So I asked myself, should this experimental option be enabled by default?

There is difference between the Default CMakeLists.txt option (https://github.com/strukturag/libheif/blob/3ebec35955aeff0a24ec132a6a208e60d51ea11d/CMakeLists.txt#L182) and the CMakePresets's default configuration (https://github.com/strukturag/libheif/blob/3ebec35955aeff0a24ec132a6a208e60d51ea11d/CMakePresets.json#L32).

If it was by default disabled (as it is in the CMakeLists.txt file), it should be the same for the `default` presets otherwise it is not coherent and the experimental option is enabled by default for all builds. 

Only the `develop` preset should enable it IMO.
The same for all experimental modes IMO to make the default library file more secure.

WDYT?

--- end body ---
