Added check to make sure: HighBit < BitsAllocated.
authorJoerg Riesmeier <dicom@jriesmeier.com>
Thu, 12 Feb 2026 18:47:48 +0000 (19:47 +0100)
committerÉtienne Mollier <emollier@debian.org>
Thu, 12 Feb 2026 18:47:48 +0000 (19:47 +0100)
commitea27f6a6a418d0640ec54eaa846e79c2cd943ba1
tree76e7a95332610bdc454b78d00a3edb1dbb0a8b0e
parent5e0b461ce64e0411acd855cd09f22878ec39a65c
Added check to make sure: HighBit < BitsAllocated.

Forwarded: https://git.dcmtk.org/?p=dcmtk.git;a=commit;h=03e851b0586d05057c3268988e180ffb426b2e03
Bug-Debian: https://bugs.debian.org/1093047
Reviewed-By: Étienne Mollier <emollier@debian.org>
Last-Update: 2025-01-18

Added check to the image preprocessing to make sure that the value of
HighBit is always less than the value of BitsAllocated. Before, this
missing check could lead to memory corruption if an invalid combination
of values was retrieved from a malformed DICOM dataset.

Thanks to Emmanuel Tacheau from the Cisco Talos team
<vulndiscovery@external.cisco.com> for the report, sample file (PoC)
and detailed analysis. See TALOS-2024-2121 and CVE-2024-52333.

Gbp-Pq: Name 0008-CVE-2024-52333.patch
dcmimgle/libsrc/diimage.cc