Skip to content

Commit

Permalink
Fixed another issue with invalid DICOM images.
Browse files Browse the repository at this point in the history
Fixed issue when processing an invalid DICOM image where the number of
pixels stored does not match the expected number of pixels (too less)
and the combination of BitsAllocated and BitsStored is really unusual
(e.g. 1 bit stored, but 52 bits allocated). In cases where the last
pixel (e.g. a single bit) does not fit into the buffer of the input
pixel data, a buffer overflow occurred on the heap. Now, the last entry
of the buffer is filled with the smallest possible value (e.g. 0 in case
of unsigned data).

Thanks to Ding zhengzheng <[email protected]> for the report
and the sample file (PoC).
  • Loading branch information
jriesmeier committed Jan 21, 2025
1 parent 87ec2e1 commit 1d205bc
Showing 1 changed file with 7 additions and 0 deletions.
7 changes: 7 additions & 0 deletions dcmimgle/include/dcmtk/dcmimgle/diinpxt.h
Original file line number Diff line number Diff line change
Expand Up @@ -617,6 +617,13 @@ class DiInputPixelTemplate
skip -= times * bitsof_T1;
}
}
/* fill the remaining entry (if any) with the smallest value that is possible */
if (q < Data + Count)
{
DCMIMGLE_TRACE("not enough data, filling last entry of input buffer with value = " << getAbsMinimum());
*q = OFstatic_cast(T2, getAbsMinimum());
}

}
} else
DCMIMGLE_DEBUG("cannot allocate memory buffer for 'Data' in DiInputPixelTemplate::convert()");
Expand Down

0 comments on commit 1d205bc

Please sign in to comment.