# HG changeset patch
# User Sebastien Jodogne <s.jodogne@gmail.com>
# Date 1774014875 -3600
# Node ID 6ea250bc6f68aa672ce7d004706de0349c1915b0
# Parent  68675600a967581d80a2453bc8c1cd8c37379e83
fix incorrect resolution of CWE-190

diff -r 68675600a967 -r 6ea250bc6f68 OrthancFramework/Sources/DicomParsing/Internals/DicomImageDecoder.cpp
--- a/OrthancFramework/Sources/DicomParsing/Internals/DicomImageDecoder.cpp	Fri Mar 20 14:37:15 2026 +0100
+++ b/OrthancFramework/Sources/DicomParsing/Internals/DicomImageDecoder.cpp	Fri Mar 20 14:54:35 2026 +0100
@@ -470,16 +470,12 @@
           throw OrthancException(ErrorCode_NotImplemented, std::string("Palette Color Lookup Table Descriptor invalid palette size: '") + r.c_str() + "'");
         }
 
-        uint64_t expectedSize = static_cast<uint64_t>(target->GetWidth()) * target->GetHeight();
+        const uint64_t expectedSize = (static_cast<uint64_t>(target->GetWidth()) *
+                                       static_cast<uint64_t>(target->GetHeight()));
         
-        if (static_cast<uint64_t>(pixelLength) != expectedSize)
+        if (pixelLength != expectedSize)
         {
-          throw OrthancException(ErrorCode_BadFileFormat, "Invalid size");
-        }
-
-        if (pixelLength != target->GetWidth() * target->GetHeight())
-        {
-          DcmElement *elem;
+          DcmElement *elem = NULL;
           Uint16 bitsAllocated = 0;
 
           if (!dataset.findAndGetUint16(DCM_BitsAllocated, bitsAllocated).good())
@@ -487,7 +483,8 @@
             throw OrthancException(ErrorCode_NotImplemented);  
           }
 
-          if (!dataset.findAndGetElement(DCM_PixelData, elem).good())
+          if (!dataset.findAndGetElement(DCM_PixelData, elem).good() ||
+              elem == NULL)
           {
             throw OrthancException(ErrorCode_NotImplemented);  
           }
@@ -495,9 +492,11 @@
           // In implicit VR files, pixelLength is expressed in words (OW) although pixels can actually be 8 bits
           // -> pixelLength is wrong by a factor of two and the image can still be decoded!
           // seen in some Philips ClearVue 650 images (using 8 bits LUT)
-          if (!(elem->getVR() == EVR_OW && bitsAllocated == 8 && (2*pixelLength == target->GetWidth() * target->GetHeight())))  
+          if (elem->getVR() != EVR_OW ||
+              bitsAllocated != 8 ||
+              2 * pixelLength != expectedSize)
           {
-            throw OrthancException(ErrorCode_NotImplemented);
+            throw OrthancException(ErrorCode_BadFileFormat, "Invalid size");
           }
         }