From 9370012fc2fba6909239ff4c9771dc5265aede23 Mon Sep 17 00:00:00 2001
From: =?utf8?q?=C3=89tienne=20Mollier?= <emollier@debian.org>
Date: Thu, 11 Jun 2026 20:54:21 +0200
Subject: [PATCH] 0018-CVE-2026-10194.patch: new: fix CVE-2026-10194.

Closes: #1139181
---
 debian/patches/0018-CVE-2026-10194.patch | 66 ++++++++++++++++++++++++
 debian/patches/series                    |  1 +
 2 files changed, 67 insertions(+)
 create mode 100644 debian/patches/0018-CVE-2026-10194.patch

diff --git a/debian/patches/0018-CVE-2026-10194.patch b/debian/patches/0018-CVE-2026-10194.patch
new file mode 100644
index 00000000..3b3d3c0a
--- /dev/null
+++ b/debian/patches/0018-CVE-2026-10194.patch
@@ -0,0 +1,66 @@
+commit 0f78a4ef6f645ea5530166e445e5436a5de58e75
+Author: Marco Eichelberg <eichelberg@offis.de>
+Date:   Mon May 4 17:48:30 2026 +0200
+
+    Fixed remote heap buffer overflow in dcmqrscp.
+    
+    Thanks to 'elp3pinill0' for the bug report, detailed
+    analysis, proof of concept and proposed fix.
+    
+    This closes DCMTK issue #1206.
+
+--- dcmtk.orig/dcmqrdb/libsrc/dcmqrdbi.cc
++++ dcmtk/dcmqrdb/libsrc/dcmqrdbi.cc
+@@ -1,6 +1,6 @@
+ /*
+  *
+- *  Copyright (C) 1993-2024, OFFIS e.V.
++ *  Copyright (C) 1993-2026, OFFIS e.V.
+  *  All rights reserved.  See COPYRIGHT file for details.
+  *
+  *  This software and supporting documentation were developed by
+@@ -2475,12 +2475,16 @@
+ 
+     DB_IdxInitLoop (&(handle_ -> idxCounter)) ;
+     while ( DB_IdxGetNext(&(handle_ -> idxCounter), &idxRec) == EC_Normal ) {
+-    if ( ! ( strncmp(idxRec. StudyInstanceUID, StudyUID, n) ) ) {
+-
+-        StudyArray[nbimages]. idxCounter = handle_ -> idxCounter ;
+-        StudyArray[nbimages]. RecordedDate = idxRec. RecordedDate ;
+-        StudyArray[nbimages++]. ImageSize = idxRec. ImageSize ;
+-    }
++        if ( ! ( strncmp(idxRec. StudyInstanceUID, StudyUID, n) ) ) {
++            StudyArray[nbimages]. idxCounter = handle_ -> idxCounter ;
++            StudyArray[nbimages]. RecordedDate = idxRec. RecordedDate ;
++            StudyArray[nbimages++]. ImageSize = idxRec. ImageSize ;
++            if (nbimages == MAX_NUMBER_OF_IMAGES) {
++                // too many images in this study, bail out
++                DCMQRDB_ERROR("maximum number of images per study (" << MAX_NUMBER_OF_IMAGES << ") exceeded");
++                return QR_EC_IndexDatabaseError;
++            }
++        }
+     }
+ 
+     /** Sort the StudyArray in order to have the oldest images first
+@@ -2567,6 +2571,8 @@
+     s = matchStudyUIDInStudyDesc (pStudyDesc, StudyUID,
+                      (int)(handle_ -> maxStudiesAllowed)) ;
+ 
++    OFCondition cond;
++
+     /** If Study already exists
+      */
+ 
+@@ -2587,10 +2593,10 @@
+ 
+         RequiredSize = imageSize -
+             ( handle_ -> maxBytesPerStudy - pStudyDesc[s]. StudySize ) ;
+-        deleteOldestImages(pStudyDesc, s, StudyUID, RequiredSize) ;
++        cond = deleteOldestImages(pStudyDesc, s, StudyUID, RequiredSize) ;
++        if (cond.bad()) return cond;
+     }
+ 
+-
+     }
+     else {
+ #ifdef DEBUG
diff --git a/debian/patches/series b/debian/patches/series
index 8321f329..7313c56b 100644
--- a/debian/patches/series
+++ b/debian/patches/series
@@ -13,3 +13,4 @@ remove_version.patch
 0015-CVE-2025-14607.patch
 0016-CVE-2026-5663.patch
 0017-CVE-2025-14841.patch
+0018-CVE-2026-10194.patch
-- 
2.30.2