From 554cec6e547b5c774cebdaf962365b82b2813b59 Mon Sep 17 00:00:00 2001 From: Debian Med Packaging Team Date: Tue, 7 Jul 2026 22:38:06 +0200 Subject: [PATCH] CVE-2025-14841 MIME-Version: 1.0 Content-Type: text/plain; charset=utf8 Content-Transfer-Encoding: 8bit commit ffb1a4a37d2c876e3feeb31df4930f2aed7fa030 Author: Marco Eichelberg Date: Fri Nov 28 12:24:07 2025 +0100 Fixed two possible segfaults in dcmqrscp. Fixed two places where invalid messages may trigger a segmentation fault due to a NULL pointer being de-referenced. Thanks to 邹 迪凯 for the bug report and proof-of-concept. Gbp-Pq: Name 0017-CVE-2025-14841.patch --- dcmqrdb/libsrc/dcmqrdbi.cc | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/dcmqrdb/libsrc/dcmqrdbi.cc b/dcmqrdb/libsrc/dcmqrdbi.cc index 132f8a11..42467467 100644 --- a/dcmqrdb/libsrc/dcmqrdbi.cc +++ b/dcmqrdb/libsrc/dcmqrdbi.cc @@ -1381,8 +1381,10 @@ OFCondition DcmQueryRetrieveIndexDatabaseHandle::startFindRequest( /* only char string type tags are supported at the moment */ char *s = NULL; dcelem->getString(s); + /* the available space is always elem.ValueLength+1 */ - OFStandard::strlcpy(elem.PValueField, s, elem.ValueLength+1); + if (s) OFStandard::strlcpy(elem.PValueField, s, elem.ValueLength+1); + else elem.PValueField[0]='\0'; } /** If element is the Query Level, store it in handle */ @@ -2066,8 +2068,10 @@ OFCondition DcmQueryRetrieveIndexDatabaseHandle::startMoveRequest( /* only char string type tags are supported at the moment */ char *s = NULL; dcelem->getString(s); + /* the available space is always elem.ValueLength+1 */ - OFStandard::strlcpy(elem.PValueField, s, elem.ValueLength+1); + if (s) OFStandard::strlcpy(elem.PValueField, s, elem.ValueLength+1); + else elem.PValueField[0]='\0'; } /** If element is the Query Level, store it in handle -- 2.39.5