Mercurial > hg > orthanc
changeset 6649:cc45eb4c1371 machine-spirits
Fix possible overflow in PMSCT_RLE1 encoded images
| author | Alain Mazy <am@orthanc.team> |
|---|---|
| date | Wed, 04 Mar 2026 11:50:00 +0100 |
| parents | dbc3ab1ce86a |
| children | 57d94b9fa1e4 |
| files | NEWS OrthancFramework/Sources/DicomParsing/Internals/DicomImageDecoder.cpp |
| diffstat | 2 files changed, 11 insertions(+), 0 deletions(-) [+] |
line wrap: on
line diff
--- a/NEWS Wed Mar 04 11:42:48 2026 +0100 +++ b/NEWS Wed Mar 04 11:50:00 2026 +0100 @@ -145,6 +145,7 @@ https://discourse.orthanc-server.org/t/jobs-api-the-dicommovescu-job-doesnt-seems-to-track-progress/3140/14 - Fix possible overflow when calling /tools/create-dicom with a PAM file. - Fix possible overflow when rows/columns DICOM tags exceed the maximum value for a US (65535). + - Fix possible overflow in PMSCT_RLE1 encoded images. * Upgraded dependencies for static builds: - civetweb 1.16, including patch for CVE-2025-55763 - SQLite 3.50.4
--- a/OrthancFramework/Sources/DicomParsing/Internals/DicomImageDecoder.cpp Wed Mar 04 11:42:48 2026 +0100 +++ b/OrthancFramework/Sources/DicomParsing/Internals/DicomImageDecoder.cpp Wed Mar 04 11:50:00 2026 +0100 @@ -192,6 +192,11 @@ { if (inbuffer[i] == 0xa5) { + if (i + 2 >= length) + { + throw OrthancException(ErrorCode_BadFileFormat, "Truncated PMSCT_RLE1 escape sequence"); + } + temp.push_back(inbuffer[i+2]); for (uint8_t repeat = inbuffer[i + 1]; repeat != 0; repeat--) { @@ -215,6 +220,11 @@ if (temp[i] == 0x5a) { + if (i + 2 >= temp.size()) + { + throw OrthancException(ErrorCode_BadFileFormat, "Truncated PMSCT_RLE1 delta sequence"); + } + uint16_t v1 = temp[i + 1]; uint16_t v2 = temp[i + 2]; value = (v2 << 8) + v1;