Mercurial > hg > orthanc
changeset 6650:57d94b9fa1e4 machine-spirits
Fix possible out-of-bound access in palette images
| author | Alain Mazy <am@orthanc.team> |
|---|---|
| date | Wed, 04 Mar 2026 12:22:47 +0100 |
| parents | cc45eb4c1371 |
| children | 7053ed3deb68 |
| files | NEWS OrthancFramework/Sources/DicomParsing/Internals/DicomImageDecoder.cpp |
| diffstat | 2 files changed, 9 insertions(+), 3 deletions(-) [+] |
line wrap: on
line diff
--- a/NEWS Wed Mar 04 11:50:00 2026 +0100 +++ b/NEWS Wed Mar 04 12:22:47 2026 +0100 @@ -143,9 +143,10 @@ - Avoid adding twice the same tag in DB for the same resource, e.g. when "TimeZoneOffsetFromUTC" is added to the "ExtraMainDicomTags" at Patient level. https://discourse.orthanc-server.org/t/jobs-api-the-dicommovescu-job-doesnt-seems-to-track-progress/3140/14 - - Fix possible overflow when calling /tools/create-dicom with a PAM file. - - Fix possible overflow when rows/columns DICOM tags exceed the maximum value for a US (65535). - - Fix possible overflow in PMSCT_RLE1 encoded images. + - Fix possible out-of-bound access when calling /tools/create-dicom with a PAM file. + - Fix possible out-of-bound access when rows/columns DICOM tags exceed the maximum value for a US (65535). + - Fix possible out-of-bound access in PMSCT_RLE1 encoded images. + - Fix possible out-of-bound access in palette images. * Upgraded dependencies for static builds: - civetweb 1.16, including patch for CVE-2025-55763 - SQLite 3.50.4
--- a/OrthancFramework/Sources/DicomParsing/Internals/DicomImageDecoder.cpp Wed Mar 04 11:50:00 2026 +0100 +++ b/OrthancFramework/Sources/DicomParsing/Internals/DicomImageDecoder.cpp Wed Mar 04 12:22:47 2026 +0100 @@ -511,6 +511,11 @@ for (unsigned int x = 0; x < width; x++) { + if (*source >= paletteSize) + { + throw OrthancException(ErrorCode_BadFileFormat, "Pixel value exceeds palette"); + } + p[0] = lutRed[*source] >> offsetBits; p[1] = lutGreen[*source] >> offsetBits; p[2] = lutBlue[*source] >> offsetBits;