From 0e429fe59058c8ff7fe82b94579e3078ec00e854 Mon Sep 17 00:00:00 2001 From: =?utf8?q?=C3=89tienne=20Mollier?= Date: Thu, 11 Jun 2026 20:51:34 +0200 Subject: [PATCH] 0017-CVE-2025-14841.patch: new: fix CVE-2025-14841. Closes: #1123584 --- debian/patches/0017-CVE-2025-14841.patch | 37 ++++++++++++++++++++++++ debian/patches/series | 1 + 2 files changed, 38 insertions(+) create mode 100644 debian/patches/0017-CVE-2025-14841.patch diff --git a/debian/patches/0017-CVE-2025-14841.patch b/debian/patches/0017-CVE-2025-14841.patch new file mode 100644 index 00000000..4f9caba3 --- /dev/null +++ b/debian/patches/0017-CVE-2025-14841.patch @@ -0,0 +1,37 @@ +commit ffb1a4a37d2c876e3feeb31df4930f2aed7fa030 +Author: Marco Eichelberg +Date: Fri Nov 28 12:24:07 2025 +0100 + + Fixed two possible segfaults in dcmqrscp. + + Fixed two places where invalid messages may trigger a segmentation fault + due to a NULL pointer being de-referenced. + + Thanks to 邹 迪凯 for the bug report and proof-of-concept. + +--- dcmtk.orig/dcmqrdb/libsrc/dcmqrdbi.cc ++++ dcmtk/dcmqrdb/libsrc/dcmqrdbi.cc +@@ -1381,8 +1381,10 @@ + /* only char string type tags are supported at the moment */ + char *s = NULL; + dcelem->getString(s); ++ + /* the available space is always elem.ValueLength+1 */ +- OFStandard::strlcpy(elem.PValueField, s, elem.ValueLength+1); ++ if (s) OFStandard::strlcpy(elem.PValueField, s, elem.ValueLength+1); ++ else elem.PValueField[0]='\0'; + } + /** If element is the Query Level, store it in handle + */ +@@ -2066,8 +2068,10 @@ + /* only char string type tags are supported at the moment */ + char *s = NULL; + dcelem->getString(s); ++ + /* the available space is always elem.ValueLength+1 */ +- OFStandard::strlcpy(elem.PValueField, s, elem.ValueLength+1); ++ if (s) OFStandard::strlcpy(elem.PValueField, s, elem.ValueLength+1); ++ else elem.PValueField[0]='\0'; + } + + /** If element is the Query Level, store it in handle diff --git a/debian/patches/series b/debian/patches/series index 0cad16a3..8321f329 100644 --- a/debian/patches/series +++ b/debian/patches/series @@ -12,3 +12,4 @@ remove_version.patch 0014-CVE-2025-9732b.patch 0015-CVE-2025-14607.patch 0016-CVE-2026-5663.patch +0017-CVE-2025-14841.patch -- 2.30.2