# HG changeset patch # User Alain Mazy # Date 1778071117 -7200 # Node ID ace9135428dda293851f0f20f0e3a2b36a7883f1 # Parent bae99026ca97374577a2567ae9c2ddd724cd2a0b fix a memory leak in C-Get diff -r bae99026ca97 -r ace9135428dd NEWS --- a/NEWS Wed May 06 12:40:49 2026 +0200 +++ b/NEWS Wed May 06 14:38:37 2026 +0200 @@ -34,6 +34,7 @@ was required. * Fix usage of "LocalAet" in C-Find and "queries/../answers/../retrieve". * Fix Orthanc::ImageAccessor that was broken in Orthanc Framework 1.12.11 +* Fix a memory leak in C-GET (https://github.com/orthanc-server/orthanc-builder/issues/36) * Fix a Denial of Service via Deeply Nested DICOM Sequences https://orthanc.uclouvain.be/bugs/show_bug.cgi?id=258 Security issue reported by Jose Lopez Martinez (aka elpe_pinillo) from Deloitte. diff -r bae99026ca97 -r ace9135428dd OrthancFramework/Sources/DicomNetworking/DicomControlUserConnection.cpp --- a/OrthancFramework/Sources/DicomNetworking/DicomControlUserConnection.cpp Wed May 06 12:40:49 2026 +0200 +++ b/OrthancFramework/Sources/DicomNetworking/DicomControlUserConnection.cpp Wed May 06 14:38:37 2026 +0200 @@ -689,16 +689,18 @@ } Uint16 desiredCStoreReturnStatus = 0; - DcmDataset* dataObject = NULL; + DcmDataset* dataObjectRawPtr = NULL; // Receive dataset result = DIMSE_receiveDataSetInMemory(&(association_->GetDcmtkAssociation()), (parameters_.HasTimeout() ? DIMSE_NONBLOCKING : DIMSE_BLOCKING), parameters_.GetTimeout(), &cmdPresId, - &dataObject, + &dataObjectRawPtr, NULL, NULL); + std::unique_ptr dataObject(dataObjectRawPtr); // to handle deallocation correctly + if (result.bad()) { LOG(WARNING) << "C-GET SCU handler: Failed to receive dataset: " << result.text();