Fixed issue with invalid "YBR_FULL" DICOM images.
authorJoerg Riesmeier <dicom@jriesmeier.com>
Thu, 12 Feb 2026 18:47:48 +0000 (19:47 +0100)
committerÉtienne Mollier <emollier@debian.org>
Thu, 12 Feb 2026 18:47:48 +0000 (19:47 +0100)
commit36f0aec0aea8a0fdb1fdd25d613edffb7ee5dd81
tree4b2c482288bba517ba5a02513b2ad401af79af01
parentd3d4bba099e4cf378c99287f8047bc8f9aa4ec37
Fixed issue with invalid "YBR_FULL" DICOM images.

Applied-Upstream: 7ad81d69b19714936e18ea5fc74edaeb9f021ce7
Reviewed-By: Étienne Mollier <emollier@debian.org>
Last-Update: 2025-08-15

Fixed an issue when processing an invalid DICOM image with a Photometric
Interpretation of "YBR_FULL" and a Planar Configuration of "1" where
the number of pixels stored does not match the expected number of pixels
(much too less). Now, the pixel data of such an image is not processed
at all, but an empty image (black pixels) is created instead. The user
is warned about this by an appropriate log message.

Thanks to Ding zhengzheng <xiaozheng.ding399@gmail.com> for the report
and the sample file (PoC).

Gbp-Pq: Name 0013-CVE-2025-9732.patch
dcmimage/include/dcmtk/dcmimage/dicopxt.h
dcmimage/include/dcmtk/dcmimage/diybrpxt.h
dcmimgle/libsrc/dcmimage.cc