Fix wlmscpfs crash on VR-spoofed seq. attributes.

Fix wlmscpfs crash on VR-spoofed seq. attributes.

Applied-Upstream: f4e0074682645b1a4289d62581926c4394d5c6d5
Last-Update: 2026-05-29
Reviewed-By: Étienne Mollier <emollier@debian.org>
Bug-Debian: https://bugs.debian.org/1141411

wldsfs.cc cast findAndGetElement() results to DcmSequenceOfItems*
without checking the VR. A C-FIND with a dictionary-SQ tag declared
under a non-SQ wire VR (Explicit VR) thus dispatched through the wrong
vtable and crashes the SCP (see also CVE-2024-28130 in dcmpstat).

Use findAndGetSequence(), which validates the VR. Also guard getItem(0)
against an empty ScheduledProcedureStepSequence and drop a bogus cast.

Thanks for the report and analysis to Abhinav Agarwal.

This closes DCMTK issue #1218.

Gbp-Pq: Name CVE-2026-44628a.patch