Denial of service via unchecked stsz sample_count

Resource exhaustion in the HEIF sequence parser in libheif before 1.23.0 allows remote attackers to crash or stall a process via a crafted HEIF sequence file. In libheif/sequences/seq_boxes.cc, Box_stsz::parse() reads stsz sample_count and enforces max_sequence_frames only for variable-size samples, while fixed-size mode stores the attacker-controlled count without a bound; Track::load() in libheif/sequences/track.cc also uses 32-bit addition for chunk range checks, so wraparound can bypass the consistency guard and drive Chunk::Chunk() into gigabyte-scale allocation. Exploitation requires only that an application parse an msf1-branded HEIF sequence through heif_context_read_from_memory(); no authentication, special privileges, or decoder backend is required, and the bounded consequence is denial of service through memory exhaustion rather than code execution.