Mercurial > hg > orthanc

changeset 6655:6ea250bc6f68 machine-spirits

Find changesets by keywords (author, files, the commit message), revision number or hash, or revset expression.
fix incorrect resolution of CWE-190
author Sebastien Jodogne <s.jodogne@gmail.com>
date Fri, 20 Mar 2026 14:54:35 +0100
parents 68675600a967
children 007e2424375f
files OrthancFramework/Sources/DicomParsing/Internals/DicomImageDecoder.cpp
diffstat 1 files changed, 10 insertions(+), 11 deletions(-) [+]
line wrap: on
line diff
--- a/OrthancFramework/Sources/DicomParsing/Internals/DicomImageDecoder.cpp	Fri Mar 20 14:37:15 2026 +0100
+++ b/OrthancFramework/Sources/DicomParsing/Internals/DicomImageDecoder.cpp	Fri Mar 20 14:54:35 2026 +0100
@@ -470,16 +470,12 @@
           throw OrthancException(ErrorCode_NotImplemented, std::string("Palette Color Lookup Table Descriptor invalid palette size: '") + r.c_str() + "'");
         }
 
-        uint64_t expectedSize = static_cast<uint64_t>(target->GetWidth()) * target->GetHeight();
+        const uint64_t expectedSize = (static_cast<uint64_t>(target->GetWidth()) *
+                                       static_cast<uint64_t>(target->GetHeight()));
         
-        if (static_cast<uint64_t>(pixelLength) != expectedSize)
+        if (pixelLength != expectedSize)
         {
-          throw OrthancException(ErrorCode_BadFileFormat, "Invalid size");
-        }
-
-        if (pixelLength != target->GetWidth() * target->GetHeight())
-        {
-          DcmElement *elem;
+          DcmElement *elem = NULL;
           Uint16 bitsAllocated = 0;
 
           if (!dataset.findAndGetUint16(DCM_BitsAllocated, bitsAllocated).good())
@@ -487,7 +483,8 @@
             throw OrthancException(ErrorCode_NotImplemented);  
           }
 
-          if (!dataset.findAndGetElement(DCM_PixelData, elem).good())
+          if (!dataset.findAndGetElement(DCM_PixelData, elem).good() ||
+              elem == NULL)
           {
             throw OrthancException(ErrorCode_NotImplemented);  
           }
@@ -495,9 +492,11 @@
           // In implicit VR files, pixelLength is expressed in words (OW) although pixels can actually be 8 bits
           // -> pixelLength is wrong by a factor of two and the image can still be decoded!
           // seen in some Philips ClearVue 650 images (using 8 bits LUT)
-          if (!(elem->getVR() == EVR_OW && bitsAllocated == 8 && (2*pixelLength == target->GetWidth() * target->GetHeight())))  
+          if (elem->getVR() != EVR_OW ||
+              bitsAllocated != 8 ||
+              2 * pixelLength != expectedSize)
           {
-            throw OrthancException(ErrorCode_NotImplemented);
+            throw OrthancException(ErrorCode_BadFileFormat, "Invalid size");
           }
         }