# HG changeset patch
# User Alain Mazy <am@orthanc.team>
# Date 1773670146 -3600
# Node ID 7053ed3deb68dd876592b4386b16041badda5d32
# Parent  57d94b9fa1e4d67f10acf24e8068dcc6fc52253d
Fix possible out-of-bound access when reading a DICOM file with invalid group length tag

diff -r 57d94b9fa1e4 -r 7053ed3deb68 NEWS
--- a/NEWS	Wed Mar 04 12:22:47 2026 +0100
+++ b/NEWS	Mon Mar 16 15:09:06 2026 +0100
@@ -147,6 +147,7 @@
   - Fix possible out-of-bound access when rows/columns DICOM tags exceed the maximum value for a US (65535).
   - Fix possible out-of-bound access in PMSCT_RLE1 encoded images.
   - Fix possible out-of-bound access in palette images.
+  - Fix possible out-of-bound access when reading a DICOM file with invalid group length tag.
 * Upgraded dependencies for static builds:
   - civetweb 1.16, including patch for CVE-2025-55763
   - SQLite 3.50.4
diff -r 57d94b9fa1e4 -r 7053ed3deb68 OrthancFramework/Sources/DicomFormat/DicomStreamReader.cpp
--- a/OrthancFramework/Sources/DicomFormat/DicomStreamReader.cpp	Wed Mar 04 12:22:47 2026 +0100
+++ b/OrthancFramework/Sources/DicomFormat/DicomStreamReader.cpp	Mon Mar 16 15:09:06 2026 +0100
@@ -204,6 +204,11 @@
       {
         uint16_t length = ReadUnsignedInteger16(p + pos + 6, true);
 
+        if (pos + 8 + length > block.size())
+        {
+          throw OrthancException(ErrorCode_BadFileFormat, "DICOM meta-header tag length exceeds available data");
+        }
+
         std::string value;
         value.assign(p + pos + 8, length);
         NormalizeValue(value, vr);
@@ -237,6 +242,11 @@
           
         uint32_t length = ReadUnsignedInteger32(p + pos + 8, true);
 
+        if (pos + 12 + static_cast<size_t>(length) > block.size())
+        {
+          throw OrthancException(ErrorCode_BadFileFormat, "DICOM meta-header tag length exceeds available data");
+        }
+
         if (tag.GetGroup() == 0x0002)
         {
           std::string value;