# HG changeset patch
# User Alain Mazy <am@orthanc.team>
# Date 1772623367 -3600
# Node ID 57d94b9fa1e4d67f10acf24e8068dcc6fc52253d
# Parent  cc45eb4c1371eec7aff24c7a92576823ed69a3af
Fix possible out-of-bound access in palette images

diff -r cc45eb4c1371 -r 57d94b9fa1e4 NEWS
--- a/NEWS	Wed Mar 04 11:50:00 2026 +0100
+++ b/NEWS	Wed Mar 04 12:22:47 2026 +0100
@@ -143,9 +143,10 @@
   - Avoid adding twice the same tag in DB for the same resource, e.g. when
     "TimeZoneOffsetFromUTC" is added to the "ExtraMainDicomTags" at Patient level.
     https://discourse.orthanc-server.org/t/jobs-api-the-dicommovescu-job-doesnt-seems-to-track-progress/3140/14
-  - Fix possible overflow when calling /tools/create-dicom with a PAM file.
-  - Fix possible overflow when rows/columns DICOM tags exceed the maximum value for a US (65535).
-  - Fix possible overflow in PMSCT_RLE1 encoded images.
+  - Fix possible out-of-bound access when calling /tools/create-dicom with a PAM file.
+  - Fix possible out-of-bound access when rows/columns DICOM tags exceed the maximum value for a US (65535).
+  - Fix possible out-of-bound access in PMSCT_RLE1 encoded images.
+  - Fix possible out-of-bound access in palette images.
 * Upgraded dependencies for static builds:
   - civetweb 1.16, including patch for CVE-2025-55763
   - SQLite 3.50.4
diff -r cc45eb4c1371 -r 57d94b9fa1e4 OrthancFramework/Sources/DicomParsing/Internals/DicomImageDecoder.cpp
--- a/OrthancFramework/Sources/DicomParsing/Internals/DicomImageDecoder.cpp	Wed Mar 04 11:50:00 2026 +0100
+++ b/OrthancFramework/Sources/DicomParsing/Internals/DicomImageDecoder.cpp	Wed Mar 04 12:22:47 2026 +0100
@@ -511,6 +511,11 @@
 
           for (unsigned int x = 0; x < width; x++)
           {
+            if (*source >= paletteSize)
+            {
+              throw OrthancException(ErrorCode_BadFileFormat, "Pixel value exceeds palette");
+            }
+
             p[0] = lutRed[*source] >> offsetBits;
             p[1] = lutGreen[*source] >> offsetBits;
             p[2] = lutBlue[*source] >> offsetBits;