From: Debian Med Packaging Team Date: Tue, 7 Jul 2026 20:38:06 +0000 (+0200) Subject: CVE-2025-14841 X-Git-Tag: archive/raspbian/3.6.9-5+rpi1+deb13u3^2~9 X-Git-Url: https://dgit.raspbian.org/%22http://www.example.com/cgi/%22/%22http:/www.example.com/cgi/%22?a=commitdiff_plain;h=554cec6e547b5c774cebdaf962365b82b2813b59;p=dcmtk.git CVE-2025-14841 commit ffb1a4a37d2c876e3feeb31df4930f2aed7fa030 Author: Marco Eichelberg Date: Fri Nov 28 12:24:07 2025 +0100 Fixed two possible segfaults in dcmqrscp. Fixed two places where invalid messages may trigger a segmentation fault due to a NULL pointer being de-referenced. Thanks to 邹 迪凯 for the bug report and proof-of-concept. Gbp-Pq: Name 0017-CVE-2025-14841.patch --- diff --git a/dcmqrdb/libsrc/dcmqrdbi.cc b/dcmqrdb/libsrc/dcmqrdbi.cc index 132f8a11..42467467 100644 --- a/dcmqrdb/libsrc/dcmqrdbi.cc +++ b/dcmqrdb/libsrc/dcmqrdbi.cc @@ -1381,8 +1381,10 @@ OFCondition DcmQueryRetrieveIndexDatabaseHandle::startFindRequest( /* only char string type tags are supported at the moment */ char *s = NULL; dcelem->getString(s); + /* the available space is always elem.ValueLength+1 */ - OFStandard::strlcpy(elem.PValueField, s, elem.ValueLength+1); + if (s) OFStandard::strlcpy(elem.PValueField, s, elem.ValueLength+1); + else elem.PValueField[0]='\0'; } /** If element is the Query Level, store it in handle */ @@ -2066,8 +2068,10 @@ OFCondition DcmQueryRetrieveIndexDatabaseHandle::startMoveRequest( /* only char string type tags are supported at the moment */ char *s = NULL; dcelem->getString(s); + /* the available space is always elem.ValueLength+1 */ - OFStandard::strlcpy(elem.PValueField, s, elem.ValueLength+1); + if (s) OFStandard::strlcpy(elem.PValueField, s, elem.ValueLength+1); + else elem.PValueField[0]='\0'; } /** If element is the Query Level, store it in handle